Data protection laws in Malaysia
Malaysia's first comprehensive personal data protection legislation, the Personal Data Protection Act 2010 (PDPA), was passed by the Malaysian Parliament on June 2, 2010 and came into force on November 15, 2013.
As part of an ongoing review of the PDPA, the Personal Data Protection Commissioner of the Ministry of Communications and Multimedia Malaysia has issued Public Consultation Paper No. 01/2020 – Review of Personal Data Protection Act 2010 (PC01/2020) dated February 14, 2020 to seek the views and comments of the public on 22 issues set out in PC01/2020, some of which are set out below.
The Personal Data Protection Department (PDP Department) has indicated that, out of the 22 issues, 5 issues have been shortlisted as the key proposed amendments to the PDPA. The amendments to the PDPA, namely the Personal Data Protection (Amendment) Act 2024 (“Amending Act”), were first tabled as a bill in the Malaysian Parliament in July 2024 and subsequently passed by both the Dewan Rakyat (House of Representatives) and the Dewan Negara (Senate) of the Malaysian Parliament on July 16 and 31, 2024 respectively. Such bill has received the Royal Assent and was gazetted as law on October 17, 2024.
On December 19, 2024, the Minister of Digital appointed three dates on which the provisions of the Amending Act would come into force. While the provisions which do not introduce any new obligations onto data users / data controllers (i.e. Section 7, 11, 13, and 14 of the Amending Act) came into force on January 01, 2025, the provisions introducing new requirements such as the appointment of a data protection officer, data breach notification and right of data portability (i.e. Section 6 and 9 of the Amending Act) will come into force on June 01, 2025. The remaining amendments under the Amending Act will come into force on April 01, 2025.
Additionally, the Digital Minister, Gobind Singh Deo, announced that seven (7) guidelines are planned to be issued and / or developed under the PDPA, which are:
- Notification of Data Breach Guidelines;
- Data Protection Officers Guidelines;
- Data Portability Guidelines;
- Cross Border Data Transfer Guidelines;
- Data Protection Impact Assessment Guidelines;
- Privacy by Design Guidelines; and
- Automated Decision-Making Guidelines.
To date, the PDP Department has issued five (5) Public Consultation Papers to gather public opinion and feedback – four (4) pertain to the guidelines listed as (i), (ii), (iii) and (iv) above, while one addresses the revision of the Personal Data Protection Standard 2015 (“Standards”) which was published and came into force on December 23, 2015. Notably, the Commissioner of PDP Department has announced that these four guidelines and the revised standards are expected to be released by early 2025, with the remaining three guidelines anticipated to be released in the third quarter of 2025.
