Malaysia

Section 2 of the Personal Data Protection Act 2010 applies the Act to a person established in Malaysia who processes personal data, and to a person not established in Malaysia who uses equipment in Malaysia for processing otherwise than for the purpose of transit through Malaysia. Section 2(3) requires the second category to nominate a representative established in Malaysia. This is the old European 'use of equipment' test, not the modern 'targeting' test used by the EU General Data Protection Regulation, so the extraterritorial reach is materially narrower than most trackers assume. Two further limits matter more than the reach itself: section 3 excludes the Federal Government and the State Governments entirely, and section 4 confines the Act to processing 'in respect of commercial transactions', defined to cover supply or exchange of goods or services, agency, investment, financing, banking and insurance.

The amended section 129 is a two-limb test. Limb one: the destination country has a law that is substantially similar to the Personal Data Protection Act 2010, or ensures an adequate level of protection at least equivalent to it. Limb two, where that fails: a set of alternative grounds including the data subject's consent, necessity for a contract, legal proceedings, vital interests, and the exporter having taken all reasonable precautions and exercised all due diligence. Sector overrides we could verify: (a) FINANCE (banks, insurers, takaful operators) — Bank Negara Malaysia's Risk Management in Technology policy document of 28 November 2025 requires a financial institution to consult the Bank before first-time adoption of public cloud for critical systems, requires regulator access rights over any record, file or data held at a third party, and requires data at third-party providers to be recoverable in a timely manner; no localisation, but a real approval gate — rating data can leave with paperwork. (b) GOVERNMENT — the privacy law does not apply to the Federal or State Governments at all; public sector hosting runs off the National Cloud Computing Policy approved by Cabinet on 18 June 2025 and the MyGovCloud public sector data centre arrangements; we could not verify the residency terms of those instruments, so we rate this not yet established rather than guess. (c) DESIGNATED CRITICAL INFRASTRUCTURE — the Cyber Security Act 2024 imposes duties on entities designated as National Critical Information Infrastructure; we found no localisation duty in it, but the designation power is broad. We searched specifically for storage or localisation rules in payments, insurance, securities, health, telecoms, education, gambling and mapping and could not confirm any hard localisation mandate from an official Malaysian source as at 18 August 2026. Several of those regulators' websites blocked automated access, so this is an unproven negative, not a proven absence.

Model: no government list, no government approval, self-assessment by the exporter. The old whitelist mechanism in section 129(1) was cut by the 2024 amendment and the Minister has published no successor list that we could find. The regulator's consultation paper 05/2024 (consultation ran 1 to 18 October 2024) proposed the supporting machinery: transfer impact assessments where you rely on the adequacy limb, recognition of binding corporate rules without pre-approval where they contain prescribed minimum content, two families of standard contractual clauses (a Malaysian minimum-clause set and international model clauses such as the ASEAN and EU templates), recognition of certifications such as APEC Cross-Border Privacy Rules alongside a binding agreement, and record-keeping to evidence compliance. Treat all of that as proposal, not law: the consultation closed in October 2024 and we found no final guideline on the regulator's own site as at 18 August 2026. A separate consultation, paper 4/2025 opened on 25 August 2025, proposes amendments to the Personal Data Protection Regulations 2013, which is where the binding detail is expected to land.

Rating: the regulator is waking up, not dormant and not active. Evidence for staffed and functioning: gazette notice P.U. (B) 341 appointed Shariffah Rashidah binti Syed Othman as Personal Data Protection Commissioner with effect from 3 September 2025; the department issued the Data Breach Notification guideline and circular and the Data Protection Officer appointment guideline, both dated 25 February 2025; it operates a live breach reporting portal and a data controller registration system; it opened public consultation 4/2025 on 25 August 2025. Evidence against an active enforcement record: the department's own 'Senarai Kes Kompaun' page, refreshed on 18 February 2025, lists compounds of RM10,000 each against two companies, both from 2018, both for failing to hold a registration certificate. We found no published fine or prosecution under the new 2024 duties. Other regulators that matter in this space and are unambiguously operational: Bank Negara Malaysia for banks, insurers and takaful operators; the National Cyber Security Agency for designated critical infrastructure and for licensing cyber security service providers; the Malaysian Communications and Multimedia Commission for communications services; and the National Digital Department for public sector digital policy.

Ceiling: the Retention Principle in section 10 of the Personal Data Protection Act 2010 states that personal data processed for any purpose shall not be kept longer than is necessary for the fulfilment of that purpose. The Personal Data Protection Standard 2015, issued by the Commissioner on 23 December 2015 under regulations 6, 7 and 8 of the Personal Data Protection Regulations 2013, adds hard numbers: dispose of personal data collection forms used in commercial transactions within a period not exceeding fourteen days; prepare a personal data disposal schedule for inactive data with a twenty-four month period; and keep a proper record of disposals, produced to the Commissioner on demand. Floor: the Standard itself resolves the conflict in favour of the floor — data users are to keep personal data no longer than necessary 'unless there are requirements by other legal provisions'. So a tax, company law, anti-money-laundering or sectoral record-keeping duty overrides the deletion duty. We were not able to verify the specific Malaysian statutory retention periods (commonly cited as seven years for tax and company records and six years for anti-money-laundering records) against a government source during this run; see the unconfirmed list.

Clock one, privacy: the Data Breach Notification circular and guideline issued by the Personal Data Protection Commissioner on 25 February 2025 under section 12B of Act 709 require notification to the Commissioner as soon as practicable and no later than seventy-two hours from the occurrence of the breach, with staged submission permitted but completed no later than thirty days after the first notification. Where the breach causes or is likely to cause significant harm, affected data subjects must be told without unnecessary delay and not later than seven days after the notification to the Commissioner. 'Significant harm' is framed to include physical harm, financial loss, exposure of sensitive personal data, risk of identity fraud, or a breach affecting more than one thousand data subjects. Clock two, cyber security: an entity designated as National Critical Information Infrastructure under the Cyber Security Act 2024 must notify cyber security incidents under the Cyber Security (Notification of Cyber Security Incident) Regulations 2024; we could not retrieve the regulation text from a government source during this run and therefore do not state the hour count — see the unconfirmed list. Clock three, financial: banks, insurers and takaful operators additionally report technology and operational incidents to Bank Negara Malaysia under the Risk Management in Technology and Operational Risk Reporting policy documents. The overlap is the operational trap: one incident, three regulators, three different formats.

Trap 1 — the government carve-out. Section 3 of Act 709 states plainly that the Act does not apply to the Federal Government and the State Governments. Public sector data handling is governed by policy, not by this statute, and individuals have no route to the privacy regulator against a ministry. Trap 2 — 'commercial transactions' only. Section 4 confines the Act to processing in respect of commercial transactions. Processing outside a commercial context sits outside the Act, which is a very different design from the European model and catches people who assume equivalence. Trap 3 — criminal, not administrative. The 2024 amendment raised the penalty for contravening the personal data protection principles from 300,000 ringgit or two years to one million ringgit (about 235,000 US dollars) or three years imprisonment, or both. Failure to notify a data breach carries 250,000 ringgit (about 59,000 US dollars) or two years. These are prosecutions, and they can attach to individuals. Trap 4 — the data protection officer has personal qualifying conditions. The February 2025 guideline requires appointment where you process the personal data of more than twenty thousand data subjects, or sensitive personal data including financial data of more than ten thousand data subjects, or you carry out regular and systematic monitoring. The officer must either be resident in Malaysia, meaning physically present at least one hundred and eighty days in a calendar year, or be easily contactable by any means, and must be proficient in both the national language and English. You must register the appointment through the Personal Data Protection System within twenty-one days. Trap 5 — the micro-deadlines in the 2015 Standard. Personal data collection forms used in commercial transactions must be disposed of within fourteen days; you need a documented disposal schedule for data inactive for twenty-four months; and removable media may not be used to store personal data without written approval from the organisation's top management. These are the kind of rules an audit finds instantly and a compliance programme built to a European template never mentions.

Landing in the next twelve months, on current evidence: (1) amended Personal Data Protection Regulations 2013, following public consultation paper 4/2025 opened 25 August 2025 — expected to carry the operative detail on transfers, data protection officers and breach handling; no commencement date announced. (2) A final cross-border personal data transfer guideline, following consultation paper 05/2024 which ran from 1 to 18 October 2024; twenty-two months later nothing final has been published on the regulator's site, so treat any standard clauses, binding corporate rules or certification route as unavailable today. (3) Implementation of the National Cloud Computing Policy approved by Cabinet on 18 June 2025. (4) The Data Sharing Act, passed by the Dewan Rakyat on 12 December 2024 and listed among the National Digital Department's instruments, covering data sharing between public sector agencies; we could not verify its act number or commencement date. DORMANT SWITCHES — powers already held that can change the picture without consultation: (a) The Minister sets the commencement dates for the 2024 amendment by gazette notice and may appoint different dates for different provisions, so any not-yet-commenced provision can be switched on overnight. (b) The Commissioner can issue binding standards directly under the 2013 regulations — that is exactly how the detailed 2015 Standard, with its fourteen-day and twenty-four-month rules, came into being. (c) The Minister can prescribe which classes of data controller must register, converting a registration duty into a licensing gate for a whole industry. (d) Under the Cyber Security Act 2024, in force since 26 August 2024, the government can designate further sectors and entities as National Critical Information Infrastructure, pulling private companies into audit, risk assessment and incident reporting duties.