🇲🇾Malaysia

Malaysia's privacy framework is built for commercial transactions

Malaysia's personal data protection regime is anchored by the Personal Data Protection Act 2010, Act 709. The Act is not a general constitutional privacy code and it does not apply to every act of data processing in Malaysia. Its core function is narrower and highly practical: it regulates the processing of personal data in commercial transactions.

That scope matters. The Act applies to persons who process, control, or authorise the processing of personal data in respect of commercial transactions. It applies where the person is established in Malaysia, and also where a person outside Malaysia uses equipment in Malaysia for processing personal data otherwise than merely for transit. A non-Malaysian person caught on that basis must nominate a representative established in Malaysia. The Act does not apply to the Federal Government or State Governments.

The three ideas to understand first

Data user responsibility is the centre of the Act. Malaysia uses the term “data user” for the person who processes personal data or controls or authorises the processing of personal data. A data processor is different: it processes personal data solely on behalf of the data user and not for its own purposes. This distinction matters because the data user remains responsible for the personal data protection principles, including the security of processing performed by processors.

The seven Personal Data Protection Principles are the operating rules. They are the General Principle, Notice and Choice Principle, Disclosure Principle, Security Principle, Retention Principle, Data Integrity Principle and Access Principle. These principles control when data may be processed, what notice must be given, how disclosure is limited, how data must be secured, how long it may be kept, how accuracy must be maintained, and how access and correction rights must work.

Registration and sector codes make Malaysia's framework more structured than a simple notice-and-consent law. Certain classes of data users must register with the Commissioner before processing personal data. Data user forums and registered codes of practice can apply to specific classes of data users, and non-compliance with an applicable code is itself an offence.

How the PDPA works in practice

The Malaysian PDPA begins with consent, but it does not stop there. Under the General Principle, ordinary personal data generally requires consent unless one of the statutory necessity grounds applies, such as contract performance, pre-contractual steps, legal obligation, vital interests, administration of justice, or statutory functions. Sensitive personal data has a higher threshold and must be processed under the specific conditions in section 40.

Notice is a separate compliance duty. A data user must give a written notice explaining that personal data is being processed, the purposes of collection and further processing, the source of the data where available, the data subject's access and correction rights, the classes of third parties to whom data may be disclosed, available choices for limiting processing, whether supply is obligatory or voluntary, and the consequences of failing to provide required data. The notice must be in both the national and English languages.

Malaysia also has specific individual control rights. Data subjects can request access, request correction, withdraw consent, object to processing likely to cause substantial damage or distress, and require processing for direct marketing to stop. These are not branding statements. They require operational workflows, written notices, response timelines and records.

What organisations should prioritise

Start with scope. Confirm whether the processing is in respect of a commercial transaction, whether the organisation is established in Malaysia, whether Malaysian equipment is being used, and whether the organisation falls within a class of data users that must register. An organisation outside Malaysia can still be caught if it uses equipment in Malaysia for processing personal data and the activity is not merely transit.

Then map the seven principles to actual systems. Consent language alone is insufficient. The organisation must know the lawful purpose for processing, whether the processing is necessary and not excessive, what written notice was given, which third-party classes are disclosed to, how processors are secured, when data is deleted, how accuracy is maintained, and how access and correction requests are handled.

Finally, review cross-border transfers and unlawful data collection risks. Section 129 restricts transfers of personal data outside Malaysia unless the destination is specified by the Minister or a statutory exception applies. Section 130 creates offences for knowingly or recklessly collecting or disclosing personal data held by a data user without consent, and for selling personal data collected in breach of the Act.