Malaysia’s Data Protection Act takes shape: What businesses need to know

As Malaysia positions itself at the forefront of regional digital services, its laws still play catch up to global information security requirements. While the country was a pioneer of data privacy regulations with the enactment of the Personal Data Protection Act (PDPA) in 2013, the rapid pace of regulations rollout, like the Global Data Protection Regulations (GDPR) in Europe afterwards, has left Malaysia in the lurch at the start of this decade. Key issues of its laws relative to the global standard include its lack of breach notification requirements, limited rights for data subjects and weak accountability measures for organisations. Realising this, the government amended the PDPA in 2024, with material changes in force effective from 1 June 2025.

Starting in June 2025, organisations in Malaysia that process a large volume of personal data or handle sensitive personal information must appoint a Data Protection Officer. This officer, who must be a competent Malaysian resident, will oversee the organisation’s compliance with the PDPA and manage internal policies, audits and staff training on data handling practices. This move brings Malaysia in line with jurisdictions such as the European Union, Singapore and the United Kingdom. In all these jurisdictions, the role of the DPO has become the crux on which data privacy frameworks are established, implemented and enforced. The Malaysian government envisions that this requirement will demonstrate its commitment to adhering to global best practices while ensuring organisations are more accountable for their data practices.

Additionally, another impactful change in the PDPA is the mandatory breach notification regime. This regime requires organisations to notify the Personal Data Protection Department (JPDP) if they detect a harmful breach involving 1000 or more individuals. Simultaneously, they must also inform affected individuals within 7 days if the breach poses a risk of damage, fraud, identity theft or other harms. This is a significant shift from the previous regime, where breach disclosures were voluntary and confidential. Organisations are obliged to maintain detailed incident response protocols, which include documentation of internal investigations and response timelines. Failure to comply with any of these requirements will result in fines up to RM 250,000 and/or two years imprisonment. This move signifies a tougher stance on data breaches that has long been needed in Malaysia, considering the rise in sensitive data breaches over the past few years.

Taking a leaf from the GDPR, the PDPA amendment also introduces rights to data portability. This legal requirement affords individuals the right to request their data in a structured, commonly used and machine-readable format. A key provision of this right is that it only applies when the processing is based on consent or contractual necessity and is carried out via automated means. This provision, structured in this way, is a cornerstone of the open data environment that the government envisions in its digital services landscape, as firms from different industries, such as telco, insurance or healthcare, can now transfer data between service providers seamlessly. However, there is a realisation that this environment may take some time to manifest. In the meantime, businesses are expected to build processes that can accommodate data transfer requests while the technical standards and formats are still being developed.

The government also took to repealing outdated provisions in the PDPA, replacing them with mechanisms that are more in line with global data security standards. One such repealed provision is the old ‘whitelist’ system for cross-border data transfer that only permitted data transfers to approved countries. In its place, organisations must now rely on alternative transfer mechanisms such as data subject consent, contractual safeguards and transfer impact assessments (TIA). To complement this, data processors will also now be held legally liable under the Security Principle for failing to implement adequate technical and organisational safeguards. Penalties for violations have been significantly increased, with some offences carrying fines up to RM 1 million and 3 years imprisonment.

Taking all of this into consideration, businesses handling large volumes of personal data, such as telco, healthcare and insurance, should comply immediately. Beyond appointing a qualified DPO, firms should update their data breach response plans and conduct a gap analysis of their cross-border data flows, if any. They should also develop internal procedures for data portability requests while providing employees with the necessary training on updated privacy obligations. The latest information from the JPDP indicates that onsite inspections and audits will be significantly ramped up in the second half of 2025, making this process an immediate priority for the organisations involved. These changes gain even more serious attention considering JPDP has signalled that more sector-specific reforms will take place by year-end, including Data Protection Impact Assessments (DPIA), automated decision making and profiling and use of artificial intelligence in data processing.

With such a monumental change in Malaysia’s data privacy regulation landscape, the Malaysian government has proved its serious intent to create a digital environment on par with its peers on the global stage. Its apparent prioritisation of building consumer trust is a welcome change as its digital economy continues to evolve in line with the government’s aspirations. The data privacy compliance landscape in the country has been reinforced with clearer provisions, updated amendments and stricter penalties. This is aligned with the long-term goal of nudging Malaysian firms to undergo a paradigm shift that entails them treating data privacy not just as a compliance requirement, but a strategic priority embedded within the mission of the organisation. While concerns on the human resources necessary to realise this vision are warranted, Malaysian firms stand at a crossroads, whether to try to align with global standards or risk falling behind as data privacy rules continue to be more sophisticated.