The legal framework
The Personal Data Protection Act 2010 regulates commercial transactions. Amendments passed in 2024 introduced mandatory data breach notification, a requirement to appoint a data protection officer, a right to data portability, and increased penalties, with provisions coming into force in stages from 2025.
Key points
| Rights | Access, correction, withdrawal of consent, and portability under the 2024 amendments |
|---|---|
| Breach notification | Mandatory to the Commissioner and, where significant, to individuals |
| Data protection officer | Required for prescribed categories of data users |
| Cross-border transfers | Permitted where the destination provides comparable protection |
| Sensitive data | Health and related data require explicit consent |
| Scope | Commercial transactions; federal and state governments are excluded, a long-criticised gap |
| Regulator | Personal Data Protection Commissioner |
| 2024 amendment | Introduced breach notification, a data protection officer duty and portability |
| Government excluded | The Act does not bind federal or state governments |
| Registration | Certain classes of data user must register |
| Criminal penalties | Contraventions are offences rather than administrative fines |
In practice
- Write to the organisation first, citing the relevant statutory right; keep proof of the date.
- Set out clearly what you want: a copy of your data, deletion, or an end to marketing.
- If there is no adequate reply within the statutory period, complain to the regulator — it is free.
- For dating, health and fertility apps, ask specifically about third-party sharing and overseas transfers.
- Check which provisions were in force at the time of your incident — the amendment came in stages.
- Complain to the Department in writing with dates and copies.
Cost and coverage
Access requests may attract a prescribed fee; complaints to the Commissioner are free.
Recent changes
The 2024 amendments brought Malaysia closer to regional standards, though the exclusion of the public sector remains a significant limitation.
Where to go
- Department of Personal Data Protection (JPDP).
- Malaysian Communications and Multimedia Commission for online content issues.
- National Consumer Complaints Centre for commercial disputes.
Worth knowing
Because government bodies are outside the Act, complaints about public sector data handling need a different route — usually the relevant ministry or the Ombudsman. Because contraventions are criminal offences rather than administrative breaches, enforcement depends on prosecution, which is slower than a regulatory fine.
Official sources and links
- MyGovernment — official government portal