Akta Perlindungan Data Peribadi 2010
Applies to: Federal (whole of Malaysia); commercial transactions only; not Federal and State Governments · Official text ↗
- The PDPA covers personal data processed in commercial transactions: shops, banks, clinics, employers, online platforms. It does not bind the Federal and State Governments (s 3), and it does not cover purely personal or family use (s 45(1)).
- Businesses must follow seven principles: General (consent), Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access (ss 5 to 12).
- Generally you must consent before a business processes your data (s 6), and you must be given a written notice in Bahasa Melayu and English (s 7).
- Since 1 April 2025: 'data users' are called 'data controllers', biometric data is sensitive data, processors must also keep data secure, and the maximum penalty for breaching the principles rose to RM1 million and/or 3 years.
- Since 1 June 2025: controllers must appoint a Data Protection Officer (DPO) in many cases, report serious data breaches to the Commissioner (within 72 hours under the guideline), and give you a right to data portability.
- Complaints go to the Personal Data Protection Commissioner (JPDP).
What this law covers
The Personal Data Protection Act 2010 (PDPA, Akta 709) regulates the processing (pemprosesan) of personal data (data peribadi): collecting, recording, holding, using, disclosing or deleting information that identifies a living person, directly or indirectly, such as a name, IC number, phone number, address, photo or bank details (s 4).
It applies only to personal data processed in respect of commercial transactions (s 2), meaning transactions of a commercial nature, whether under contract or not, including the supply of goods or services, agency, investments, financing, banking and insurance (s 4). Credit reporting agencies are regulated separately.
Sensitive personal data (data peribadi sensitif) means information about your physical or mental health, political opinions, religious or similar beliefs, the commission or alleged commission of an offence and, since 2025, biometric data such as fingerprints and facial scans. It needs your explicit consent unless an exception applies (s 40).
Who it applies to and what is exempt
- Applies to: businesses and persons established in Malaysia, and foreign businesses using equipment in Malaysia to process data (s 2(2)). The business that decides how data is used is the data controller (formerly 'data user'); a business processing data on its behalf, such as a cloud or payroll provider, is a data processor.
- Not covered: the Federal and State Governments (s 3(1)); data processed outside Malaysia unless meant for further processing here (s 3(2)); and data about people who have died (since 2025).
- Personal use: an individual's personal, family and household affairs, including recreation, are fully exempt (s 45(1)). Your family WhatsApp group is not a PDPA matter.
- Partial exemptions (s 45(2)) cover crime prevention and investigation, tax collection, some health data, statistics and research, court orders, regulatory functions, and journalistic, literary or artistic purposes where publication is in the public interest.
The seven principles
| Principle | In plain English |
|---|---|
| General (s 6) | Get consent before processing, unless processing is necessary for a contract with the person, a legal obligation, their vital interests, the administration of justice or a legal function. Collect only what you need for a lawful purpose directly related to your business. |
| Notice and Choice (s 7) | Give a written notice telling people what data you collect, why, its source, who you share it with, whether supplying it is compulsory, and how they can access, correct or limit it. The notice must be in both Bahasa Melayu and English (s 7(3)). |
| Disclosure (s 8) | Do not disclose data, without consent, for a different purpose or to anyone outside the classes of third parties named in the notice. |
| Security (s 9) | Take practical steps to protect data from loss, misuse, unauthorised access or disclosure. Since 2025 processors are bound directly too. |
| Retention (s 10) | Do not keep data longer than needed; delete or destroy it when no longer required. |
| Data Integrity (s 11) | Keep data accurate, complete, not misleading and up to date. |
| Access (s 12) | Let people access and correct their data. |
Breaching any principle is an offence (s 5(2)).
Your rights
- Access your data: the controller must respond to a data access request within 21 days (ss 30, 31).
- Correct inaccurate data (s 34).
- Withdraw consent by written notice; the controller must then stop processing (s 38).
- Stop processing likely to cause you substantial damage or distress (s 42).
- Stop direct marketing at any time by written notice (s 43).
- Data portability (from 1 June 2025): ask for your data to be transmitted to another controller, subject to technical feasibility and data-format compatibility.
- Complain in writing to the Personal Data Protection Commissioner (s 104), who can investigate and issue an enforcement notice (ss 105, 108).
The 2024 amendments (in force 2025)
The Personal Data Protection (Amendment) Act 2024 (Act A1727) received Royal Assent on 9 October 2024 and came into force in three phases:
| Date | Main changes |
|---|---|
| 1 January 2025 | Technical changes, including electronic service of documents. |
| 1 April 2025 | 'Data user' becomes 'data controller'; biometric data added to sensitive personal data; personal data of deceased persons excluded; Security Principle extended to data processors; maximum penalty for breaching the principles raised from RM300,000 and/or 2 years to RM1,000,000 and/or 3 years; the cross-border 'whitelist' replaced by a test of whether the destination has substantially similar law or adequate protection. |
| 1 June 2025 | Mandatory Data Protection Officer; mandatory data breach notification; new data portability right. |
Data breach notification. Under the Commissioner's Guideline on Data Breach Notification (February 2025), a controller must notify the Commissioner of a breach that causes or is likely to cause significant harm (or affects more than 1,000 people) as soon as practicable and within 72 hours, and notify affected individuals without unnecessary delay and within 7 days of notifying the Commissioner.
Data Protection Officer. Under the DPO guideline, a DPO is required where the controller processes data of more than 20,000 people, sensitive data of more than 10,000 people, or regularly and systematically monitors personal data.
Penalties and other offences
- Breaching the seven principles: up to RM1,000,000 fine and/or 3 years (s 5(2), as amended).
- Unlawfully collecting or disclosing data held by a business without its consent, or selling or offering to sell such data: up to RM500,000 and/or 3 years (s 130). This targets people who leak or sell customer databases.
- Directors and officers of a company can be personally liable for company offences (s 133).
Where to go: the Personal Data Protection Department (Jabatan Perlindungan Data Peribadi, JPDP), website pdp.gov.my. For scams and online harassment involving your data, also see the Communications and Multimedia Act 1998.
Laws cited on this page
| Act 588 | Communications and Multimedia Act 1998 · Akta Komunikasi dan Multimedia 1998 | Official text |
| Act 709 | Personal Data Protection Act 2010 · Akta Perlindungan Data Peribadi 2010 | Official text |
Listed automatically from the federal Acts named on this page. All laws of Malaysia →
Key sections
| Provision | What it says, in plain words |
|---|---|
| s 2 | Applies to processing of personal data in respect of commercial transactions. |
| s 3 | Does not apply to the Federal and State Governments, or to data processed only outside Malaysia. |
| s 4 | Definitions: personal data, sensitive personal data (now incl. biometric), commercial transactions. |
| s 5 | The seven principles; breach is an offence (now up to RM1 million and/or 3 years). |
| s 6 | General Principle: consent, with exceptions for contract, legal obligation, vital interests and others. |
| s 7 | Notice and Choice: written notice in Bahasa Melayu and English. |
| s 8 | Disclosure only for the notified purpose and to notified classes of third parties, unless consent is given. |
| ss 9 to 12 | Security, Retention, Data Integrity and Access Principles. |
| ss 30, 31 | Data access request; respond within 21 days. |
| s 38 | Withdrawal of consent by written notice. |
| s 40 | Sensitive personal data needs explicit consent unless an exception applies. |
| s 43 | Right to stop direct marketing. |
| s 45 | Exemptions: personal and household use; partial exemptions for crime, tax, research, journalism and others. |
| s 104 | Complaint to the Commissioner. |
| s 130 | Unlawful collection, disclosure or sale of personal data; up to RM500,000 and/or 3 years. |
Worked examples
Facts. Aminah runs a boutique. During a fitting she asks Mrs Lee whether she may photograph her in a new baju kurung for the shop's Instagram. Mrs Lee signs a short consent form, in Bahasa Melayu and English, that explains the photo will be used on the shop's social media for marketing and can be removed on request.
The law. A photo that identifies Mrs Lee is personal data processed in a commercial transaction. Aminah has her consent (s 6), has given notice of the purpose and how to withdraw (s 7, in both languages), and is disclosing it only for the notified purpose (s 8).
Outcome. This is compliant. If Mrs Lee later withdraws consent in writing, Aminah must stop using the photo (s 38) and should take it down and delete copies she no longer needs (s 10).
Facts. A phone shop secretly films customers at the counter and posts clips on TikTok, showing faces and IC cards being handed over, captioned to mock indecisive buyers.
The law. The clips are personal data, and the IC images may reveal more. Posting them for promotion without consent breaches the General Principle (s 6), the Notice and Choice Principle (s 7) and the Disclosure Principle (s 8); failing to protect IC data breaches the Security Principle (s 9). Mocking captions may also raise defamation or Communications and Multimedia Act issues.
Outcome. A customer can demand the clip be removed and complain to the Commissioner (s 104). The shop risks an enforcement notice and prosecution; the maximum is now RM1 million and/or 3 years (s 5(2)).
Facts. Ravi, a clerk at an insurance agency, copies 5,000 customer records and sells them to a telemarketing firm.
The law. Knowingly collecting or disclosing personal data held by a data controller without its consent, and selling it, is an offence under s 130 (up to RM500,000 and/or 3 years). The agency may also have breached the Security Principle (s 9) if its controls were inadequate. If the leak is likely to cause significant harm or affects over 1,000 people, the agency must notify the Commissioner.
Outcome. Ravi can be prosecuted. Under the breach guideline the agency must notify the Commissioner within 72 hours and affected customers within 7 days after that.
Facts. Mr Tan keeps receiving SMS promotions from a gym he joined two years ago.
The law. Section 43 lets a data subject require a data controller, by written notice, to stop processing his data for direct marketing.
Outcome. Mr Tan sends a written notice (an email is practical) asking the gym to stop. If it continues, he can complain to the Commissioner (s 104).
Examples are simplified illustrations with invented names; real cases turn on their own facts.
Questions & answers
Does the PDPA apply to government departments?
No. Section 3(1) says the Act does not apply to the Federal Government and State Governments. Government agencies are subject to other laws and policies. Private companies, including those working for the government, are covered when they process data in commercial transactions.
Can a shop photocopy my IC?
The PDPA does not ban it outright, but the shop must have a lawful purpose directly related to its business, collect only what is necessary, tell you why in a written notice, and keep the copy secure and delete it when no longer needed (ss 6, 7, 9, 10). You can ask why it is needed.
How do I find out what data a company holds about me?
Make a written data access request (s 30). The company must respond within 21 days (s 31). It can refuse only on the grounds listed in s 32, and must tell you why (s 33).
What should a business do after a data breach?
Contain it, assess the harm, and if it causes or is likely to cause significant harm (or affects more than 1,000 people) notify the Commissioner within 72 hours under the Commissioner's guideline, then notify affected individuals within 7 days of that. Keep a record of the breach.
Does my small business need a Data Protection Officer?
Under the DPO guideline, a DPO is required if you process personal data of more than 20,000 people, sensitive personal data of more than 10,000 people, or carry out regular and systematic monitoring. Many small shops fall below these thresholds, but the seven principles still apply.
Is posting a photo of someone on my personal Facebook covered?
If it is purely for personal, family or household purposes, the PDPA does not apply (s 45(1)). It may still raise issues under other laws, such as defamation, harassment or the Communications and Multimedia Act. If you post for a business, the PDPA applies.
Where do I complain?
Write to the Personal Data Protection Commissioner through the Personal Data Protection Department (JPDP), pdp.gov.my. The Commissioner can investigate (s 105) and issue an enforcement notice (s 108). Breaches can also be prosecuted.
All questions & answers → · Ask your own →
Sources
- Personal Data Protection Act 2010 (Act 709), section text (pre-2025 LOM reprint)
- Data Protection Report: Personal Data Protection (Amendment) Act 2024, commencement phases
- Christopher & Lee Ong: gazette notice P.U.(B) 522/2024 appointing commencement dates
- CMS: Guideline on Data Breach Notification (72 hours / 7 days)
- Securiti: DPO appointment and breach notification guidelines (20,000 / 10,000 thresholds)
- Personal Data Protection Department (JPDP)
- Laws of Malaysia (official portal)
Related
Consumer rightsCommunications and Multimedia Act 1998Defamation Act 1957Employment law: your rights at workConsumer Protection Act 1999