Currently, Malaysian law does not require that data users / data controllers appoint a data protection officer (“DPO”). However, under the Amending Act, the data controller or data processor is required to appoint one or more DPOs who shall be accountable to the data controller or data processor for the compliance with the PDPA. Such appointment will not discharge the data controller or data processor from all their duties and functions under the PDPA. This requirement will come into force on June 01, 2025.

The Public Consultation Paper No. 02/2024: The Appointment of Data Protection Officer (“PCP No. 02/2024”) issued by the PDP Department on August 19, 2024, proposes that the mandatory DPO appointment requirement applies only to data controllers or data processors that carry out data processing activities on a “large scale”. Multiple factors will be taken into account in determining whether the data processing activities are deemed to be large scale:

1. the number of data subjects concerned; 
2. the volume of data and / or the range of different data items being processed;
3. the nature of the data being processed;
4. the risk posed to the data subject as a result of the data processing activity carried out by the data controller / data processor;
5. the duration, or permanence, of the data processing activity; and / or
6. the geographical extent of the data processing activity. 

To prevent the DPO role from becoming redundant, it is also proposed that the DPO be allowed to carry out additional job functions beyond their data-specific roles as a DPO. Additionally, it is also essential to note that the PCP No. 02/2024 proposes that a single DPO is allowed to serve multiple entities within the same group of companies for the data controller or data processor.

The DPO guidelines to be issued under the PCP No. 02/2024 are expected to be released by early next year.