Is my website PDPA compliant? A 10-point check
If your website collects names, phone numbers, email addresses or IC numbers from Malaysians, the Personal Data Protection Act 2010 (PDPA) applies to it. Since the 2024 amendments, a breach of the Act's principles can cost up to RM1 million and/or three years' imprisonment.
Most website gaps are simple to fix once you see them. Here are the ten things to check. This is general information, not legal advice.
1. A privacy notice in Bahasa Malaysia and English
The PDPA requires a written notice telling people what you collect, why, who you share it with, and how to contact you — and it must be in both the national language and English (section 7). A footer link to an English-only page does not meet it.
2. Consent before you collect
Personal data may generally be processed only with the person's consent (section 6). A form should say what happens to the details before the person submits them — and the tick box should not be ticked for them.
3. Trackers and analytics
Malaysia has no cookie-specific rule, but analytics, advertising pixels and chat widgets can collect personal data. Load only what you need, say so in your notice, and prefer tools that do not collect personal data at all. Check what your pages load before anyone has agreed to anything.
4. Sensitive data needs explicit consent
Health information, biometric data (sensitive since April 2025), religious beliefs and similar categories need explicit consent (section 40). Clinics, HR platforms and insurers should check every form that asks for them.
5. A working route for access and correction requests
People can ask for a copy of their data and for corrections. You must respond within 21 days (sections 30–31). Publish a contact that actually works — and test it.
6. Do not keep data forever
Personal data must not be kept longer than its purpose needs (section 10). Old enquiry forms, abandoned carts and job applications are the usual offenders. Set a retention period and delete on schedule.
7. Know where your data goes
Website builders, email marketing tools, CRMs and chat widgets often store data overseas. Since 2025 the old whitelist is gone: transfers abroad are allowed where conditions in section 129 are met, such as the destination having similar protection. List your tools and where each keeps data.
8. Basic security
The security principle (section 9) requires practical steps to protect personal data — and since April 2025 it binds your data processors too. For a website that means HTTPS everywhere, security headers, up-to-date software, protected admin pages and email authentication (SPF, DKIM, DMARC).
9. Forms that ask for IC numbers
Ask for an IC number only if you truly need it, never send it by plain email, and limit who can see it. An IC number in an unprotected spreadsheet is one of the most common and damaging findings.
10. Be ready for a breach
Since June 2025, a data controller must notify the Commissioner of a personal data breach within 72 hours, and the affected people without delay (and within 7 days of notifying the Commissioner) where significant harm is likely (section 12B and the Commissioner's guideline). Know who decides, who notifies and how you would know.
Check your website in 10 seconds
AuditCore's free website check scans your public site for the technical points above — HTTPS, security headers, privacy notice, email security and more — and gives you a grade with the top findings. No account and no card. Run the free check.
Questions
Does the PDPA apply to my website?
Yes, if your business collects personal data from people in Malaysia in commercial transactions — for example through contact forms, sign-ups, online orders or chat. The federal and state governments are outside the Act.
Must my privacy notice be in Bahasa Malaysia?
Yes. Section 7 of the PDPA requires the notice in both the national language and English.
What is the penalty for breaching the PDPA?
Since 1 April 2025, breaching the personal data protection principles can lead to a fine of up to RM1 million, imprisonment of up to three years, or both.
How fast must I report a data breach?
Notify the Personal Data Protection Commissioner within 72 hours, and the affected people without delay — within 7 days of notifying the Commissioner — where the breach is likely to cause significant harm.
See your website's PDPA grade in 10 seconds.
Free website check