Under the PDPA, a data user / data controller may not transfer personal data to jurisdictions outside of Malaysia unless that jurisdiction has been specified by the Minister. However, this provision together with the whitelist regime are removed under the Amending Act.

Pursuant to the Amending Act, the data users / data controllers may transfer any personal data of a data subject out of Malaysia to a country that has substantially similar laws or where the country ensures equivalent levels of protection. These amendments will come into force on April 01, 2025.

Even if these requirements are not satisfied, the cross-border transfer is permissible if it falls within the exceptions to this restriction under the PDPA, including the following:

• The data subject has given his or her consent to the transfer;
• The transfer is necessary for the performance of a contract between the data subject and the data user;
• The data user has taken all reasonable steps and exercised all due diligence to ensure that the personal data will not be processed in a manner that would contravene the PDPA; and
• The transfer is necessary to protect the data subject’s vital interests.

Additionally, on October 01, 2024, the Commissioner issued the Public Consultation Paper No. 05/2024: Cross Border Personal Data Transfer Guidelines (“PCP No. 05/2024”) to gather public views and feedback on key aspects to be addressed in the proposed guidelines. It is essential to note that the PCP No.05/2024, among others, proposes that the data users /  data controllers, who wish to transfer the data out of Malaysia on the ground that the destination has laws that are substantially similar to PDPA or has equivalent levels of protection, must conduct a Transfer Impact Assessment (TIA). The PCP No. 05/2024 also proposes the adoption of cross border transfer mechanisms such as Binding Corporate Rules (BCRs) and Standard Contractual Clauses (SCCs).

The Cross Border Personal Data Transfer Guidelines are expected to be issued by early 2025, likely before April, as the amendments to the provisions on cross-border data transfer under the Amending Act will come into force on April 01, 2025.