Under the PDPA, the Commissioner is empowered to implement and enforce the personal data protection laws and to monitor and supervise compliance with the provisions of the PDPA. Under the Personal Data Protection Regulations 2013, the Commissioner has the power to inspect the systems used in personal data processing and the data controller is required, at all reasonable times, to make the systems available for inspection by the Commissioner or any inspection officer. The Commissioner or the inspection officers may require the production of the following during inspection:

• The record of the consent from a data subject maintained in respect of the processing of that data subject's personal data by the data controller;
• The record of required written notices issued by the data controller to the data subject;
• The list of personal data disclosures to third parties;
• The security policy developed and implemented by the data controller;
• The record of compliance with data retention requirements;
• The record of compliance with data integrity requirements; and
• Such other related information which the Commissioner or any inspection officer deems necessary.

Violations of the PDPA and certain provisions of the Personal Data Protection Regulations 2013 are punishable with criminal liability. The prescribed penalties include fines, imprisonment or both. Directors, CEOs, managers or other similar officers will have joint and several liability for non-compliance by the body corporate, subject to a due diligence defense.

There is no express right under the PDPA allowing aggrieved data subjects to pursue a civil claim against data controllers for breaches of the PDPA.

However, under PCP 01/2020, the Commissioner has proposed to introduce a specific provision stating the right of a data subject to commence civil litigation against a data controller.