Malaysia

Section 2 of the Personal Data Protection Act 2010 applies the Act to a person set up in Malaysia who handles personal data. It also applies to a person not set up in Malaysia who uses equipment in Malaysia to handle personal data, other than to pass it through the country. Section 2(3) makes that second group name a representative set up in Malaysia. This is the old European 'use of equipment' test. It is not the modern 'targeting' test used by the European Union General Data Protection Regulation. So the Act reaches foreign companies far less widely than most trackers assume. Two further limits matter more than the reach itself. Section 3 excludes the Federal Government and the State Governments entirely. Section 4 limits the Act to data handled 'in respect of commercial transactions'. That is defined to cover supply or exchange of goods or services, agency, investment, financing, banking and insurance.

The amended section 129 is a two-part test. Part one: the destination country has a law that is substantially similar to the Personal Data Protection Act 2010, or protects the data at least as well as that Act. Part two, where part one fails: you fall back on other grounds. Those include the person's consent, need for a contract, legal proceedings, vital interests, and having taken all reasonable precautions and exercised all due diligence. Industry overrides we could verify: (a) FINANCE (banks, insurers, takaful operators). Bank Negara Malaysia's Risk Management in Technology policy document of 28 November 2025 makes a financial institution consult the Bank before it first puts critical systems on a public cloud. The Bank must have access rights over any record, file or data held at a third party. Data at third-party providers must be recoverable in good time. There is no rule that data must stay in Malaysia, but there is a real approval gate. Rating data can leave only if conditions are met (b) GOVERNMENT. The privacy law does not apply to the Federal or State Governments at all. Public sector hosting runs off the National Cloud Computing Policy, approved by Cabinet on 18 June 2025, and the MyGovCloud public sector data centre arrangements. We could not verify whether those require data to stay in Malaysia, so we rate this unknown rather than guess. (c) DESIGNATED CRITICAL INFRASTRUCTURE. The Cyber Security Act 2024 puts duties on organisations designated as National Critical Information Infrastructure. We found no rule there that data must stay in Malaysia, but the power to designate is broad. We searched specifically for storage-location rules in payments, insurance, securities, health, telecoms, education, gambling and mapping. We could not confirm any from an official Malaysian source as at 18 August 2026. Several of those regulators' websites blocked automated access. So treat this as unconfirmed, not as proof that no rule exists.

The model is: no government list, no government approval, you assess it yourself. The old approved-country list in section 129(1) was cut by the 2024 amendment, and we could find no replacement list from the Minister. The regulator's consultation paper 05/2024 ran from 1 to 18 October 2024 and proposed the supporting machinery. It suggested transfer impact assessments where you rely on the protection test. It suggested recognising group-wide rules without pre-approval, where they contain set minimum content. It suggested two families of standard contract clauses: a Malaysian minimum-clause set, and international model clauses such as the Association of Southeast Asian Nations and European Union templates. It suggested recognising certifications such as the Asia-Pacific Economic Cooperation Cross-Border Privacy Rules, alongside a binding agreement. And it suggested record-keeping to show you complied. Treat all of that as a proposal, not as law. The consultation closed in October 2024 and we found no final guideline on the regulator's own site as at 18 August 2026. A separate consultation, paper 4/2025, opened on 25 August 2025. It proposes changes to the Personal Data Protection Regulations 2013, which is where the binding detail is expected to land.

Rating: a regulator just getting started Not dormant, and not active. Evidence that it is staffed and working: gazette notice P.U. (B) 341 appointed Shariffah Rashidah binti Syed Othman as Personal Data Protection Commissioner with effect from 3 September 2025. The department issued the Data Breach Notification guideline and circular, and the Data Protection Officer appointment guideline, both dated 25 February 2025. It runs a live breach reporting portal and a registration system for organisations that handle personal data. It opened public consultation 4/2025 on 25 August 2025. Evidence against an active enforcement record: the department's own 'Senarai Kes Kompaun' page, refreshed on 18 February 2025, lists compounds of RM10,000 each against two companies. Both are from 2018, and both were for failing to hold a registration certificate. We found no published fine or prosecution under the new 2024 duties. Other regulators that matter here and are clearly working: Bank Negara Malaysia for banks, insurers and takaful operators; the National Cyber Security Agency for designated critical infrastructure and for licensing cyber security service providers; the Malaysian Communications and Multimedia Commission for communications services; and the National Digital Department for public sector digital policy.

WHAT YOU MUST DELETE. The Retention Principle in section 10 of the Personal Data Protection Act 2010 says personal data must not be kept longer than you need it for the purpose. The Personal Data Protection Standard 2015 adds hard numbers. The Commissioner issued it on 23 December 2015 under regulations 6, 7 and 8 of the Personal Data Protection Regulations 2013. It says: destroy personal data collection forms used in commercial deals within fourteen days; prepare a disposal schedule for inactive data on a twenty-four month cycle; and keep a proper record of disposals, to be produced to the Commissioner on demand. WHAT YOU MUST KEEP. The Standard itself resolves the clash in favour of keeping. You keep personal data no longer than necessary, unless another law requires you to keep it. So a tax, company law, anti-money-laundering or industry record-keeping duty overrides the duty to delete. We could not verify the specific Malaysian retention periods against a government source. Those are commonly cited as seven years for tax and company records, and six years for anti-money-laundering records. See the unconfirmed list, and check them yourself before you set a schedule.

Clock one, privacy. The Data Breach Notification circular and guideline were issued by the Personal Data Protection Commissioner on 25 February 2025 under section 12B of Act 709. You must tell the Commissioner as soon as practicable, and no later than seventy-two hours from the breach. You may report in stages, but you must finish no later than thirty days after the first report. Where the breach causes, or is likely to cause, significant harm, you must tell the affected people without unnecessary delay. That must happen no later than seven days after you notified the Commissioner. 'Significant harm' covers physical harm, financial loss, exposure of sensitive personal data, risk of identity fraud, or a breach affecting more than one thousand people. Clock two, cyber security. If you are designated as National Critical Information Infrastructure under the Cyber Security Act 2024, you must report cyber security incidents under the Cyber Security (Notification of Cyber Security Incident) Regulations 2024. We could not get the text of those regulations from a government source, so we do not state the hour count here. See the unconfirmed list. Clock three, financial. Banks, insurers and takaful operators also report technology and operational incidents to Bank Negara Malaysia, under the Risk Management in Technology and Operational Risk Reporting policy documents. The practical trap is the overlap: one incident, three regulators, three different formats.

Trap 1 - the government is excluded. Section 3 of Act 709 says plainly that the Act does not apply to the Federal Government and the State Governments. Public sector data handling runs on policy, not on this law. You have no route to the privacy regulator against a ministry. Trap 2 - 'commercial transactions' only. Section 4 limits the Act to data handled in respect of commercial transactions. Anything outside a commercial context sits outside the Act. That is a very different design from the European model, and it catches people who assume the two are the same. Trap 3 - criminal, not administrative. The 2024 amendment raised the penalty for breaching the personal data protection principles. It went from 300,000 ringgit or two years, to one million ringgit (about 235,000 US dollars) or three years in prison, or both. Failing to report a data breach carries 250,000 ringgit (about 59,000 US dollars) or two years. These are prosecutions, and they can attach to individuals. Trap 4 - the data protection officer has personal qualifying conditions. The February 2025 guideline makes you appoint one where you handle the personal data of more than twenty thousand people. The same applies where you handle sensitive personal data, including financial data, of more than ten thousand people, or where you carry out regular and systematic monitoring. The officer must either live in Malaysia, meaning physically present at least one hundred and eighty days in a calendar year, or be easily contactable by any means. The officer must also be able to work in both the national language and English. You must register the appointment through the Personal Data Protection System within twenty-one days. Trap 5 - the small deadlines in the 2015 Standard. Destroy personal data collection forms used in commercial deals within fourteen days. Keep a written disposal schedule for data that has been inactive for twenty-four months. And do not use removable media to store personal data without written approval from your top management. An audit finds these instantly, and a compliance programme built to a European template never mentions them.

Landing in the next twelve months, on current evidence. 1. Amended Personal Data Protection Regulations 2013, following public consultation paper 4/2025, opened 25 August 2025. These are expected to carry the working detail on transfers, data protection officers and breach handling. No start date has been announced. 2. A final cross-border personal data transfer guideline, following consultation paper 05/2024, which ran from 1 to 18 October 2024. Twenty-two months later nothing final has been published on the regulator's site. So treat standard clauses, group-wide rules and certification routes as unavailable today. 3. Rollout of the National Cloud Computing Policy, approved by Cabinet on 18 June 2025. 4. The Data Sharing Act, passed by the Dewan Rakyat on 12 December 2024 and listed among the National Digital Department's laws. It covers data sharing between public sector agencies. We could not verify its act number or start date. POWERS ALREADY HELD that can change the answer without consultation. (a) The Minister sets the start dates for the 2024 amendment by gazette notice, and can pick different dates for different parts. So any part that has not yet started can be switched on overnight. (b) The Commissioner can issue binding standards directly under the 2013 regulations. That is exactly how the detailed 2015 Standard came about, with its fourteen-day and twenty-four-month rules. (c) The Minister can decide which classes of organisation must register. That turns a registration duty into a licensing gate for a whole industry. (d) Under the Cyber Security Act 2024, in force since 26 August 2024, the government can designate further sectors and organisations as National Critical Information Infrastructure. That pulls private companies into audit, risk assessment and incident reporting duties.