On 24 December 2024, Malaysia’s Minister of Digital stipulated the dates on which the provisions of the Malaysian Personal Data Protection (Amendment) Act 2024 (Amendment Act) will come into force. The Amendment Act will take effect in three tranches, which we summarise and discuss below with thanks to Malaysian law firm Skrine.
This development marks the first stage in implementing the changes to Malaysia’s data protection landscape brought about by the watershed revisions to Malaysia’s Personal Data Protection Act 2010 (the Malaysian PDPA), which took place in July 2024 following a multi-year review, and aligns the Malaysian approach more closely with international data protection regimes – the key changes to the Malaysian PDPA are discussed in our earlier article.
| Date of Coming into Force | Sections of the Amendment Act |
|---|---|
| 1 January 2025 | 7, 11, 13 and 14 |
| 1 April 2025 | 2, 3, 4, 5, 8, 10 and 12 |
| 1 June 2025 | 6 and 9 |
1 January 2025
The amendments effective from 1 January 2025 do not introduce any new obligations on data controllers and instead relate to ancillary provisions (e.g. rectification of the Malay-language version of the legislative text and relating to service of documents).
1 April 2025
The key amendments effective from 1 April 2025 are as follows:
| Section of the Amendment Act | Key Amendments |
|---|---|
| 2 | Revision of Malaysian PDPA terminology from “data users” to “data controllers”. |
| 3 | Amendment of definitions in the PDPA, including: • recognising “biometric data” as a type of sensitive personal data; • introducing definitions for “personal data breach”; • expanding the definition of “requestor” to encompass individuals making data portability requests; and • narrowing the scope of “personal data” to exclude personal data of deceased individuals. |
| 4 & 5 | • Extending the security principle to data processors, including direct imposition of penalties on data processors for breach; and • Increased penalties for breach of personal data protection principles to a fine up to RM1,000,000 and / or up to three years imprisonment. |
| 12 | Removal of the whitelist regime for cross-border transfers, permitting personal data to be transferred from Malaysia to countries with substantially similar laws or ensuring equivalent levels of protection. |
1 June 2025
The key amendments effective from 1 June 2025 are as follows:
| Section of the Amendment Act | Key Amendments |
|---|---|
| 6 | Introduces requirements for data controllers to: • appoint a data protection officer; and • notify both the Personal Data Protection Commissioner (Commissioner)and relevant data subjects of personal data breaches. |
| 9 | Introduces a new right of data portability for data subjects, subject to the “technical feasibility and compatibility of the data format”. |
Guidelines
Malaysia’s Digital Minister announced in January 2024 that the Commissioner will develop seven guidelines, which will supplement the revised Malaysian PDPA. The guidelines will address:
- data breach notifications;
- data protection officers;
- data portability;
- cross-border data transfers;
- data protection impact assessment;
- privacy by design; and
- profiling and automated decision-making.
It is expected that the Commissioner will publish the relevant guidelines before the various substantive amendments discussed above become effective. As of 31 December 2024, five public consultation papers have been published.
Key Takeaways
As the Amendment Act comes into effect, businesses should begin preparing for the additional compliance obligations that will arise. Amongst other things, businesses should begin considering appropriate candidates for the role of Data Protection Officers, reviewing the categories of personal data in their possession and control, ensuring that their data protection programme adequately considers the possibility of personal data breaches and incorporates data breach incident response protocols, considering their cross-border personal data transfer mechanisms, and updating their internal protocols and handbooks to ensure compliance with the new requirements.
Please feel free to reach out to us if you have any questions.