Personal Data Protection Act 2010 — data breach notification

Malaysia had no mandatory breach notification at all until the 2024 amendment commenced on June 1, 2025. The regime it introduced: notify the Commissioner within 72 hours of becoming aware, with written reasons required if that is missed, and notify affected individuals within seven days where the breach causes or is likely to cause significant harm. Controllers must also maintain a data breach register for at least two years recording the nature of the breach, the data affected, and remedial steps. Marked 'check': the amendment is recent, and the Commissioner's implementing guidelines should be read alongside the statute for the operative definitions of 'significant harm' and the register's required contents.