The legal framework
The Personal Data Protection Act 2010 governs personal data processed in commercial transactions. The 2024 amendment, phased into force from 2025, introduced mandatory breach notification, a data protection officer requirement, a data portability right and heavier penalties. The Act expressly does not apply to the Federal and State Governments.
Key points
| Statute | Personal Data Protection Act 2010, amended in 2024 |
|---|---|
| Government | Expressly excluded from the Act |
| Breach notification | Introduced by the 2024 amendment |
| Data protection officer | Required for certain data controllers |
| Regulator | Personal Data Protection Department, under the relevant ministry |
| Online content | Communications and Multimedia Act 1998 for abusive content |
| Courts divided | Some decisions recognise a limited privacy right; others reject it |
| Breach of confidence | The safer cause of action |
| Sector rules | Banking and telecom secrecy provisions supplement the Act |
In practice
- Send a written access request first: it forces the other side to disclose what it holds and creates a paper trail.
- Screenshot everything, with the date and the URL visible, before asking for removal.
- Complain to the regulator — it is free — and keep the reference number.
- Court action is the last step, and the limitation periods are short: take advice early.
- Plead breach of confidence alongside any privacy claim: the courts are not consistent on privacy alone.
Recent changes
The 2024 amendment is the most significant change since 2010 and the obligations have come into force in stages: check which provisions applied at the time of your incident.
Where to go
- Jabatan Perlindungan Data Peribadi.
- Malaysian Communications and Multimedia Commission.
- Legal aid bureaus and the Bar Council legal aid centres.
Worth knowing
Because the government is excluded, a complaint about a public body cannot be brought under the Act: it has to go through administrative or judicial review instead. Because the government is excluded from the Act, complaints about public bodies must be framed as judicial review or breach of confidence.
Official sources and links
- MyGovernment — official government portal