What Is PDPA Malaysia? Guide (Updated 2026)

Last updated: 5 November 2026

The Personal Data Protection Act 2010 (Act 709), known as the PDPA, is Malaysia's main law on personal data in commercial transactions. The 2024 amendment added mandatory breach notification and data protection officers. Since then the Commissioner has issued more guidance. This includes a DPIA guideline from April 2026 and a controller registration circular that has applied since 1 June 2026.

This guide explains who the PDPA covers, what changed, and what to do when a breach happens. It is written for business owners, compliance and IT teams, and data protection officers (DPOs).

What is the PDPA, and who must comply?

The PDPA controls how organisations collect, use, store and share personal data in commercial transactions in Malaysia. The Personal Data Protection Commissioner enforces it, supported by the Personal Data Protection Department under the Ministry of Digital.

Personal data is any information that can identify a person. That includes names, MyKad numbers, contact details and financial records. Sensitive data includes financial, health and biometric information. The Act rests on core principles such as consent, purpose, disclosure, security, retention, data integrity and access.

If your organisation handles customer, employee or supplier data in commercial activity in Malaysia, you are very likely in scope. Several duties below depend on the size of your data, not the size of your company.

What the 2024 amendment changed

The Personal Data Protection (Amendment) Act 2024 was passed in July 2024 and took effect in stages during 2025. The breach notification and DPO duties, and the data portability right, have applied since 1 June 2025.

The term "data user" became "data controller". Data processors, the third parties that handle data for a controller, are now directly bound by the Security Principle. Vendor contracts and cloud arrangements should spell out who is responsible for what. The amendment also introduced a right to data portability and rules for sending personal data outside Malaysia, so map your overseas data flows too.

Mandatory data breach notification

Section 12B requires a data controller to notify the Commissioner of a personal data breach as soon as practicable. The Commissioner's online notification form asks whether you are submitting within 72 hours of becoming aware of the breach. Treat 72 hours as your working deadline.

You notify when the breach causes or is likely to cause significant harm. The Commissioner's form lists five tests, and meeting one or more is enough.

The tests cover harm to people, such as physical injury, financial loss or credit damage. They cover misuse for unlawful purposes and identity fraud. They also cover sensitive personal data. And a breach is significant in scale when more than 1,000 people are affected.

When significant harm is likely, affected individuals must be told without unnecessary delay. You can send further details later, but no later than 30 days after your first notification. Failing to notify the Commissioner is an offence, with a fine of up to RM250,000, up to two years in prison, or both.

The 72-hour clock is the part organisations underestimate. It runs from when you become aware of the breach, not from when you decide it is serious. You cannot meet it without the ability to detect and triage incidents quickly. That is a security operations capability, not a legal one.

Mandatory data protection officer

A data controller or processor must appoint at least one DPO if any one of three things applies. They process personal data of more than 20,000 individuals. They process sensitive personal data, including financial information, of more than 10,000 individuals. Or their activities need regular and systematic monitoring.

After appointing a DPO, notify the Commissioner within 21 days through the PDP Department's online system. You need a dedicated official DPO email address and an appointment letter. Appointing a DPO does not transfer accountability. The organisation stays responsible.

Data protection impact assessments (DPIA)

In April 2026 the Commissioner issued a guideline on data protection impact assessments. A DPIA is a planned review of how a processing activity could affect people's data, so you can reduce the risks early.

The guideline says a controller must carry out a DPIA when a processing activity is likely to cause high risk. High risk is assumed when the processing involves more than 20,000 individuals, or more than 10,000 for sensitive data including financial data. Below those numbers, the DPO weighs other factors.

Examples are automated decisions that seriously affect a person, or systematic monitoring such as face recognition in shops. If the need is unclear, the guideline says a DPIA is good practice.

Who must register as a data controller?

Registration is separate from the DPO duty, and it does not apply to everyone. Commissioner's Circular No. 1 of 2026 has applied since 1 June 2026. You must register if all three points are true.

You process personal data in commercial transactions in Malaysia. You belong to a class of data controller listed in two government orders, P.U.(A) 336/2013 and P.U.(A) 326/2016. And you operate as a sole proprietorship, a partnership (not an LLP), a private limited company or a public company.

Annual fees are RM100 for a sole proprietor, RM200 for a partnership, RM300 for a private limited company and RM400 for a public company. Certificates last one to five years.

You apply online with official supporting documents, such as a licence from your sector regulator. The Department aims to review complete applications within 14 working days. Apply to renew within the 90 days before your certificate expires.

Processing without a valid certificate is an offence if you must hold one. The fine can reach RM500,000, or up to three years in prison, or both. Check the two orders to see whether your sector is a listed class.

Penalties

Breaching the data protection principles can bring a fine of up to RM1 million, up to three years in prison, or both. The PDP Department also publishes a list of compounded cases on its website.

How to approach PDPA compliance

For most organisations, a practical sequence works. Start by mapping your data. Know what personal data you hold, where it lives, who processes it and where it flows. Decide whether you must appoint a DPO and whether you must register.

Update privacy notices and review processor contracts so security duties and breach cooperation are clear.

Then build your breach response. Write an incident response playbook covering detection, containment, assessment and notification, and test it with tabletop exercises. Run a DPIA before any high-risk project. Keep records of your decisions, including why you chose not to notify, because good records show good faith.

Where a managed security partner fits

Several PDPA duties are security operations problems, not paperwork. The 72-hour target depends on detecting incidents quickly, which is what managed detection and response and a security operations centre provide. The Security Principle calls for safeguards such as identity and access control and endpoint protection and monitoring.

Vendor reviews and cross-border checks fit with threat intelligence and cloud moves with a migration assessment. Governance and DPO support fit a structured security services programme.

Primary Guard supports organisations across Malaysia, Indonesia and Thailand on these areas. If you lack the capacity to detect breaches inside the 72-hour target, a free assessment is a practical first step.

If your organisation is a financial institution, read this with our BNM RMiT compliance guide. If you hold an MCMC licence, see our MCMC compliance guide.

Frequently asked questions

Do I have to report every data breach?

No. Notification applies when the breach causes or is likely to cause significant harm, judged against the Commissioner's five tests. Record your assessment either way, so you can show how you decided.

Who is responsible for a DPIA, the DPO or management?

The data controller is responsible, and senior management carries the final responsibility. The DPO supports and advises, but does not have to lead the assessment. The controller can name any suitable person as the DPIA lead.

Can my IT or cloud vendor handle PDPA for me?

Not completely. Processors now have their own security duty, and the DPIA guideline expects them to help the controller, ideally through clear contract clauses. The controller still owns the decisions and the accountability.

Key takeaway

The PDPA now asks for operational readiness, not just policies. Know whether you must appoint a DPO or register, run a DPIA before high-risk projects, and be able to detect and report a breach quickly. Build and rehearse that workflow before an incident happens.

Sources

PDP Dept Act 709, Oct 2026 | PDP Dept breach notice, Feb 2026 | PDP Dept DPO, Aug 2025

---

This article is provided for general information and does not constitute legal advice. Organisations should refer to the Personal Data Protection Act 2010, the 2024 amendment and the Commissioner's guidelines, and consult qualified advisers on their specific obligations.