Under the PDPA, subject to certain exceptions, data users are generally required to obtain a data subject’s consent for the processing (which includes collection and disclosure) of his or her personal data. Where consent is required from a data subject under the age of eighteen, the data user must obtain consent from the parent, guardian or person who has parental responsibility for the data subject. The consent obtained from a data subject must be in a form that such consent can be recorded and maintained properly by the data user.

Pursuant to PC01/2020, the Commissioner has sought feedback on its proposal to amend the General Principle provision to add clarity to the data subject's consent, whether it should be in a specific provision and the impact of having a default consent. However, there is no amendment to the General Principle provision under the Amending Act.

Malaysian law contains additional data protection obligations, including, for example, a requirement to notify data subjects regarding the purpose for which their personal data are collected and a requirement to maintain a list of any personal data disclosures to third parties.

The Standards set out the Commission’s minimum requirements for processing personal data. The Standards include the following:

• Security Standard For Personal Data Processed Electronically
• Security Standard For Personal Data Processed Non-Electronically
• Retention Standard For Personal Data Processed Electronically And Non-Electronically
• Data Integrity Standard For Personal Data Processed Electronically And Non-Electronically

However, the Commissioner has issued the Public Consultation Paper No. 04/2024: Personal Data Protection Standards (“PCP No. 04/2024”) on October 01, 2024 to seek feedback from the public on the revision of the above minimum requirements. The proposed revisions under the PCP No. 04/2024 include:

1. Replacing “black and white” rules (i.e. prescriptive and specific instructions or measures that data controllers must comply with) with requirements that are outcome based;
2. Removing the differentiation between personal data processed electronically or physically and provide the security standards which applies to personal data generally; and
3. The role of certification schemes to demonstrate compliance with the Standards.

The revised Standards are expected to be issued by early 2025, likely before April 2025, as the amendments to the Security Principle under the Amending Act are set to come into force on April 01, 2025.