Data protection & privacy law in Malaysia (2026)

Legal framework

Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727); enforced by the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi, JPDP) under the Ministry of Digital.

Key points: data & privacy in Malaysia

1. 01Comprehensive statute

   The PDPA 2010 regulates processing of personal data in commercial transactions across seven Personal Data Protection Principles (General, Notice & Choice, Disclosure, Security, Retention, Data Integrity, Access). Note it historically does not apply to federal/state government and, for personal data processed wholly outside Malaysia, only where further processed in Malaysia.

   pdp.gov.my dlapiperdataprotection.com

2. 02Supervisory authority

   The Personal Data Protection Commissioner heads the Department of Personal Data Protection (Jabatan Perlindungan Data Peribadi, JPDP) under the Ministry of Digital, issuing guidelines, circulars and enforcing compliance.

   pdp.gov.my pdp.gov.my

3. 032024 Amendment Act (phased 2025 commencement)

   Act A1727 replaced 'data user' with 'data controller', extended the Security Principle directly to data processors, excluded deceased persons from 'personal data', and added a 'personal data breach' definition. Provisions took effect 1 Jan, 1 Apr and 1 Jun 2025.

   pdp.gov.my insightplus.bakermckenzie.com

4. 04Mandatory breach notification

   Effective 1 June 2025, controllers must notify the Commissioner as soon as practicable and within 72 hours of a breach, and notify affected data subjects within 7 days of notifying the Commissioner where the breach causes or is likely to cause significant harm (per Commissioner Circular No. 1/2025 and the DBN Guidelines).

   pdp.gov.my privacymatters.dlapiper.com

5. 05Data Protection Officer & data portability

   From 1 June 2025, a DPO must be appointed where processing exceeds 20,000 data subjects (or 10,000 for sensitive/financial data) or involves regular systematic monitoring; appointment must be notified to the Commissioner within 21 days. A new data portability right lets individuals request transmission of their data to another controller, subject to technical feasibility.

   oneasia.legal dataprotectionreport.com

6. 06Sensitive data, cross-border transfers & penalties

   Biometric data is now classified as sensitive personal data. The Cross-Border Personal Data Transfer Guidelines (issued 29 April 2025) set out legal bases for transfers outside Malaysia. Maximum fines for breaching the data-protection principles rose from RM300,000 to RM1,000,000, and maximum imprisonment from 2 to 3 years.

   mayerbrown.com privacyworld.blog

Timeline of decisions

1. 1 Jun 2025Law · official
   PDPA Amendment Act 2024, Third Tranche in Force: Breach Notification, DPO Mandate & Data Portability

   The final tranche of the Personal Data Protection (Amendment) Act 2024 activates its most operationally demanding obligations: mandatory data breach notification to the Commissioner and affected individuals, compulsory Data Protection Officer appointment (with 21-day notification to the Commissioner), and a right to data portability. Penalties now reach MYR 1 million and/or three years' imprisonment.

   Personal Data Protection Department (PDPD)

2. 29 Apr 2025Guidance
   Cross-Border Personal Data Transfer Guidelines Issued by PDPC

   The Personal Data Protection Commissioner published guidelines replacing the previous country-whitelist regime with a risk-based framework; data controllers must conduct a Transfer Impact Assessment (TIA, valid three years) and may rely on Binding Corporate Rules, Standard Contractual Clauses, or approved certification schemes to justify transfers.

   CMS Law-Now (citing official PDPC Guidelines)

3. 25 Feb 2025Guidance · official
   PDPC Publishes DPO Appointment and Data Breach Notification Guidelines

   The PDPD published two operational guidelines, specifying DPO qualifications and appointment procedures, and requiring a breach register retained for at least two years, providing the compliance roadmap ahead of the 1 June 2025 implementation date.

   Personal Data Protection Department (PDPD)

4. 17 Oct 2024Law · official
   Personal Data Protection (Amendment) Act 2024 Gazetted as Act A1727

   Following Royal Assent on 9 October 2024, the Amendment Act is published in the Federal Gazette as Act A1727, formally enacting GDPR-influenced reforms including mandatory DPOs, breach notification, data portability, and risk-based cross-border transfer rules.

   Personal Data Protection Department (PDPD) – Federal Gazette Act A1727

5. 1 Oct 2024Law · official
   Personal Data Protection (Amendment) Act 2024 Enacted

   Passed by both houses of Parliament in July 2024 and enacted in October 2024, the amendments to the PDPA 2010 (Act A1727) introduced mandatory data-breach notification, mandatory Data Protection Officers, data portability rights, and explicit coverage of biometric data, directly tightening the legal environment for AI systems processing personal data.

   Attorney General's Chambers Malaysia

6. 21 Sept 2023Incident
   Data Breach Reports Hit All-Time High, Fourfold Increase in 2023

   The Personal Data Protection Department reported 130 breach cases in just the first half of 2023, versus only 30 for all of 2022; the Digital Minister disclosed that average fines since 2017 were a mere MYR 24,000 per company, directly fuelling the case for the 2024 amendment's penalty hike.

   Malay Mail

7. 26 Dec 2022Incident
   Alleged Breach Exposing ~13 Million Malaysians Triggers Government Investigation

   Threat-intelligence firm ThreatMon identified records linked to Maybank, Astro, and the Election Commission on dark-web forums; the Communications and Digital Minister ordered the PDPD and CyberSecurity Malaysia to investigate, exposing the critical gap caused by the absence of any mandatory breach-notification law.

   BankInfoSecurity

8. 17 May 2022Incident
   Records of 22.5 Million Malaysians Allegedly Offered for Sale on Dark Web

   A 160 GB database purportedly sourced from government MyIdentity APIs, covering the entire adult population, was listed online for USD 10,000; the Home Ministry denied the NRD as the source but the incident intensified public pressure on the government to strengthen data-protection law.

   Malay Mail

9. 15 Nov 2013Law · official
   Personal Data Protection Act 2010 (Act 709) Comes into Force

   Three years after enactment, the PDPA 2010 takes legal effect, making Malaysia the first ASEAN country with comprehensive data-protection legislation, establishing seven data-protection principles, a registration regime for 13 commercial sectors, and the office of the Personal Data Protection Commissioner.

   Personal Data Protection Department (PDPD)

10. 1 Nov 2013Law · official
    Personal Data Protection Act 2010 Commences, Security Principle Binding on Private Sector

    Three years after enactment, the PDPA 2010 commenced in November 2013, making the Security Principle, requiring data controllers to take practical steps to protect personal data from loss, misuse, modification, and unauthorised access, legally enforceable. This was the first time cybersecurity obligations under statute applied broadly to private commercial entities in Malaysia.

    Personal Data Protection Department Malaysia

11. 2 Jun 2010Law · official
    Personal Data Protection Act 2010 (Act 709) Enacted by Parliament

    Malaysia enacts its first comprehensive personal data protection statute, creating the PDPA framework to govern commercial-sector processing, though it notably excludes government bodies from its scope and applies only within commercial transactions, leaving significant coverage gaps that persist until the 2024 amendment.

    Invest Malaysia (Official Government Portal)

12. 1 Apr 1999Law · official
    Communications and Multimedia Act 1998 (Act 588) Enters into Force

    Part of Malaysia's landmark five-statute 'Cyber Laws' package, the CMA establishes the Malaysian Communications and Multimedia Commission (MCMC) and introduces the earliest statutory network security provisions, functioning as the de facto pre-PDPA framework for communications-related data.

    Malaysian Communications and Multimedia Commission (MCMC)

Sources

1. 1.pdp.gov.my/ppdpv1/en/akta/personal-data-protection-amendment-act-2024/
2. 2.pdp.gov.my/ppdpv1/wp-content/uploads/2024/11/Act-A1727.pdf
3. 3.pdp.gov.my/ppdpv1/en/akta/personal-data-protection-guidelines-on-data-breach-not
4. 4.pdp.gov.my/ppdpv1/en/akta/circular-of-personal-data-protection-commissioner-no-1
5. 5.pdp.gov.my/ppdpv1/en/guidelines-and-circular-on-personal-data-protection-appoint
6. 6.insightplus.bakermckenzie.com/bm/data-technology/malaysia-personal-data-protection-amendment-act-20
7. 7.mayerbrown.com/en/insights/publications/2025/07/from-legislative-reform-to-practical
8. 8.privacymatters.dlapiper.com/2025/03/malaysia-guidelines-issued-on-data-breach-notification-and-da
9. 9.oneasia.legal/en/6322
10. 10.dlapiperdataprotection.com/index.html?c=MY&t=law
11. 11.dataprotectionreport.com/2025/01/new-horizons-in-data-protection-malaysias-personal-data-prote
12. 12.privacyworld.blog/2024/08/malaysia-pushes-out-groundbreaking-amendment-to-personal-data