Data protection
The Personal Data Protection Act 2010 regulates commercial transactions. Amendments passed in 2024 introduced mandatory data breach notification, a requirement to appoint a data protection officer, a right to data portability, and increased penalties, with provisions coming into force in stages from 2025.
Key points
| Rights | Access, correction, withdrawal of consent, and portability under the 2024 amendments |
|---|---|
| Breach notification | Mandatory to the Commissioner and, where significant, to individuals |
| Data protection officer | Required for prescribed categories of data users |
| Cross-border transfers | Permitted where the destination provides comparable protection |
| Sensitive data | Health and related data require explicit consent |
| Scope | Commercial transactions; federal and state governments are excluded, a long-criticised gap |
| Regulator | Personal Data Protection Commissioner |
| 2024 amendment | Introduced breach notification, a data protection officer duty and portability |
| Government excluded | The Act does not bind federal or state governments |
| Registration | Certain classes of data user must register |
| Criminal penalties | Contraventions are offences rather than administrative fines |
In practice
- Check which provisions were in force at the time of your incident — the amendment came in stages.
- Complain to the Department in writing with dates and copies.
Cost and coverage
Access requests may attract a prescribed fee; complaints to the Commissioner are free.
Recent changes
The 2024 amendments brought Malaysia closer to regional standards, though the exclusion of the public sector remains a significant limitation.
Where to go
- Department of Personal Data Protection (JPDP).
- Malaysian Communications and Multimedia Commission for online content issues.
- National Consumer Complaints Centre for commercial disputes.
Worth knowing
Because government bodies are outside the Act, complaints about public sector data handling need a different route — usually the relevant ministry or the Ombudsman. Because contraventions are criminal offences rather than administrative breaches, enforcement depends on prosecution, which is slower than a regulatory fine.
The general article: Data protection · Compare with another country
Privacy
The Personal Data Protection Act 2010 governs personal data processed in commercial transactions. The 2024 amendment, phased into force from 2025, introduced mandatory breach notification, a data protection officer requirement, a data portability right and heavier penalties. The Act expressly does not apply to the Federal and State Governments.
Key points
| Statute | Personal Data Protection Act 2010, amended in 2024 |
|---|---|
| Government | Expressly excluded from the Act |
| Breach notification | Introduced by the 2024 amendment |
| Data protection officer | Required for certain data controllers |
| Regulator | Personal Data Protection Department, under the relevant ministry |
| Online content | Communications and Multimedia Act 1998 for abusive content |
| Courts divided | Some decisions recognise a limited privacy right; others reject it |
| Breach of confidence | The safer cause of action |
| Sector rules | Banking and telecom secrecy provisions supplement the Act |
In practice
- Plead breach of confidence alongside any privacy claim: the courts are not consistent on privacy alone.
Recent changes
The 2024 amendment is the most significant change since 2010 and the obligations have come into force in stages: check which provisions applied at the time of your incident.
Where to go
- Jabatan Perlindungan Data Peribadi.
- Malaysian Communications and Multimedia Commission.
- Legal aid bureaus and the Bar Council legal aid centres.
Worth knowing
Because the government is excluded, a complaint about a public body cannot be brought under the Act: it has to go through administrative or judicial review instead. Because the government is excluded from the Act, complaints about public bodies must be framed as judicial review or breach of confidence.
Image rights
Section 233 of the Communications and Multimedia Act 1998 criminalises the improper use of network facilities, including offensive and menacing content, and is the provision most often used for non-consensual intimate imagery. The Online Safety Act 2024, operative from 2025, imposes duties on major platforms to remove harmful content, including intimate image abuse.
Key points
| Statute | Communications and Multimedia Act 1998, section 233 |
|---|---|
| Online Safety Act 2024 | Platform duties to act on harmful content, operative from 2025 |
| Regulator | Malaysian Communications and Multimedia Commission |
| Penal Code | Criminal intimidation and extortion where threats are made |
| Blocking | MCMC can direct blocking of unlawful content |
| Data protection | PDPA applies to identifiable images in commercial contexts |
| Extortion | Demanding money to withhold an image is a separate and more serious offence |
| Online Safety Act | Imposes removal duties on major platforms |
In practice
- Report extortion separately: it is treated more seriously than the content offence.
Recent changes
The Online Safety Act 2024 created the first statutory duty of care for platforms operating in Malaysia.
Where to go
- MCMC complaint portal and hotline.
- Royal Malaysia Police, Cyber Crime Division.
- Women's Aid Organisation and All Women's Action Society.
Worth knowing
Section 233 is broad and has also been used against ordinary speech: it is a powerful tool for victims, and a contested one in public debate. Where money is demanded, the case is extortion as well as an image offence. Saying so changes which police unit handles it.
The general article: Image rights · Compare with another country
Copyright
The Copyright Act 1987, with a voluntary notification system that provides prima facie evidence of ownership.
The Copyright Act 1987 protects works for the author's life plus fifty years. Malaysia has no registration system as such, but it operates a voluntary notification scheme: filing a notification with the Intellectual Property Corporation produces a certified extract that is prima facie evidence of ownership, which is valuable in litigation and in enforcement.
Malaysia's Copyright Act 1987 protects works for the author's life plus fifty years, and a voluntary notification system with the Intellectual Property Corporation provides prima facie evidence of ownership — a practical advantage in a dispute. The Act contains a notice-and-takedown mechanism for online infringement, and criminal enforcement against piracy is comparatively active.
Key points
| Statute | Copyright Act 1987, amended several times |
|---|---|
| Term | Life plus 50 years |
| Voluntary notification | Certified extract serves as prima facie evidence of ownership |
| Fair dealing | Research, private study, criticism, review, reporting |
| Enforcement | Ministry enforcement division can act on complaints, plus specialised IP courts |
| Collecting societies | Licensed bodies for music and reproduction rights |
| Enforcement division | Ministry officers can act on complaints directly |
| Copyright Tribunal | Handles licensing disputes |
In practice
- File a voluntary notification: it shifts the evidential burden in any later dispute.
Where to go
- Intellectual Property Corporation of Malaysia (MyIPO).
- Enforcement Division, Ministry of Domestic Trade.
- IP courts in Kuala Lumpur.
Worth knowing
The voluntary notification costs little and shifts the evidential burden in any later dispute: for anyone producing commercial work it is worth doing. The notification is inexpensive and converts a contested ownership question into a presumption in your favour.
Frequently asked questions
What is copyright voluntary notification?
A filing with the Intellectual Property Corporation of Malaysia recording the work, the author and the date. It is not required for protection but the certificate is admissible as prima facie evidence of ownership, which shortens disputes considerably. The fee is modest.
The general article: Copyright · Compare with another country
Identity theft
Penal Code cheating and personation offences, with a national scam response centre reachable on 997.
Identity fraud is prosecuted under Penal Code provisions on cheating and personation and under the Computer Crimes Act 1997. The National Scam Response Centre, reachable on 997, coordinates banks and police to freeze funds in the first hours. The Central Credit Reference Information System held by the central bank lets you see borrowings in your name.
Malaysian law covers identity misuse through the Penal Code offences of cheating and cheating by personation, supported by the Computer Crimes Act where a system is accessed. The operational response runs through the National Scam Response Centre on 997, which coordinates banks, telecoms and police in the first minutes, and through the police commercial crime department for the investigation itself.
Key points
| Penal Code | Cheating by personation, forgery |
|---|---|
| Computer Crimes Act 1997 | Unauthorised access |
| Hotline | National Scam Response Centre, 997 |
| CCRIS | Central bank credit report, showing loans in your name |
| Data protection | PDPA 2010, amended in 2024, for the underlying data breach |
| Documents | JPN for MyKad issues |
| 997 | National Scam Response Centre, operating around the clock |
| Kill switch | Some banks allow an immediate freeze of all digital access |
In practice
- Call 997 straight away if money has moved.
- Lodge a police report and keep the report number.
- Request your CCRIS report from the central bank to identify loans taken in your name.
- Report the loss of a MyKad to JPN and to the police.
- Ask your bank about the kill switch feature: it freezes all digital access at once.
Where to go
- National Scam Response Centre, 997.
- Bank Negara Malaysia BNMLINK for CCRIS.
- Royal Malaysia Police commercial crime division.
Worth knowing
The CCRIS report is free and shows every regulated borrowing in your name: it is the quickest way to discover loans you never took out. The CCRIS report is free and complete. Requesting it is the fastest way to discover loans taken out in your name.
Frequently asked questions
What is 997?
The National Scam Response Centre hotline, which puts banks, telecommunications operators and police on the same call so that accounts can be frozen and numbers blocked quickly. It is intended for the moment money has moved; a formal police report follows at a station.
The general article: Identity theft · Compare with another country
General sources
- MyGovernment — official government portal