The PDPA amendments: what changed for Malaysian businesses
The Personal Data Protection (Amendment) Act 2024 is the biggest change to Malaysia's PDPA since 2010. It came into force in three steps during 2025 and is now fully in effect: most businesses that hold customer or employee data now need a data protection officer, must report breaches within 72 hours, and face penalties of up to RM1 million.
Here is what changed, when, and what to do. General information, not legal advice.
When each change took effect
- 1 January 2025 — minor and administrative provisions.
- 1 April 2025 — "data user" becomes "data controller"; biometric data becomes sensitive personal data; data processors are directly bound by the security principle; the cross-border whitelist is removed; penalties rise.
- 1 June 2025 — data protection officers, breach notification and data portability.
1. Data protection officer (DPO)
Data controllers and data processors must appoint a DPO. Under the Commissioner's guideline, the requirement applies where you process personal data of more than 20,000 people, sensitive personal data of more than 10,000 people, or carry out regular and systematic monitoring. The appointment is registered with the Commissioner within 21 days.
2. Breach notification within 72 hours
If a personal data breach happens, the data controller must notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours. Where the breach is likely to cause significant harm — financial loss, identity fraud, exposure of sensitive data and the like — the affected people must also be told without unnecessary delay, and within 7 days of notifying the Commissioner. Processors report breaches to their controller.
3. Processors are now directly responsible for security
Since April 2025, the security principle applies to data processors as well as controllers. If you run software, hosting, payroll or call-centre services for other companies, you can be penalised directly — "the customer configured it" is no longer a defence. Controllers should have a written agreement with each processor.
4. Data portability
People may ask for their personal data to be transmitted to another data controller, where it is technically feasible and the data formats are compatible. Know where each person's data sits and how you would export it.
5. Cross-border transfers
The old whitelist of approved countries is gone. You may transfer personal data abroad where the conditions in section 129 are met — for example where the destination has a law substantially similar to the PDPA or ensures an adequate level of protection — or under the other grounds the Act lists.
6. Higher penalties and biometric data
Breaching the personal data protection principles can now lead to a fine of up to RM1 million, imprisonment of up to three years, or both. Biometric data — fingerprints, face scans — is sensitive personal data and needs explicit consent.
A one-page action list
- Decide whether you need a DPO; if so, appoint and register them within 21 days.
- Write a breach procedure: who decides, who notifies the Commissioner within 72 hours, who tells affected people.
- List your processors and put a data processing agreement in place with each.
- Map where personal data is stored, including tools hosted overseas.
- Update your privacy notice (BM and English) for portability and transfers.
- Review consent for biometric and other sensitive data.
- Check your website and systems for the technical basics — HTTPS, security headers, access control, logging.
Start with your website
AuditCore checks Malaysian websites and codebases against the PDPA and other regulatory profiles. The free website check takes 10 seconds and needs no account. Run the free check, or see the 10-point website PDPA check.
Questions
When did the PDPA amendments take effect?
In three phases: 1 January 2025 (minor provisions), 1 April 2025 (processors, biometric data, cross-border transfers, higher penalties) and 1 June 2025 (data protection officers, breach notification, data portability).
Do I need a data protection officer?
Under the Commissioner's guideline, yes if you process personal data of more than 20,000 people, sensitive personal data of more than 10,000 people, or carry out regular and systematic monitoring. Register the appointment within 21 days.
How long do I have to report a data breach?
Notify the Commissioner as soon as practicable and within 72 hours. If significant harm is likely, notify affected people too, within 7 days of notifying the Commissioner.
What is the maximum PDPA penalty now?
Up to RM1 million, up to three years' imprisonment, or both, for breaching the personal data protection principles.
Check your website against the PDPA in 10 seconds.
Free website check