Meet Malaysia PDPA obligations with controls mapped once

The Malaysia PDPA is the Personal Data Protection Act 2010 (Act 709), Malaysia's main data protection law. It regulates the processing of personal data in commercial transactions through seven principles: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access. It is enforced by the Personal Data Protection Commissioner and was significantly updated by the Personal Data Protection (Amendment) Act 2024.

Any data controller that processes personal data in respect of commercial transactions in Malaysia must comply, including foreign organisations that use equipment in Malaysia to process data. Since 1 April 2025, data processors are also directly bound by the Security Principle. Federal and state governments are outside its scope, and certain classes of data controllers must also register with the Commissioner.

The Personal Data Protection (Amendment) Act 2024 renamed data users as data controllers, extended the Security Principle to data processors, raised penalties, added biometric data to sensitive personal data, replaced the cross-border transfer whitelist approach, and introduced data protection officers, mandatory breach notification and a right to data portability. The changes came into force in stages between 1 January and 1 June 2025.

Breaching a Personal Data Protection Principle can lead to a fine of up to RM1,000,000, imprisonment of up to three years, or both, following the 2024 amendments, which raised the earlier limits. Other offences under the Act, such as processing without required registration or failing to comply with an enforcement notice, carry their own separate penalties.

Yes. Since 1 June 2025, data controllers must notify the Personal Data Protection Commissioner of a personal data breach as soon as practicable, and the Commissioner's guideline sets a 72 hour window. Where the breach causes or is likely to cause significant harm, affected data subjects must also be notified without unnecessary delay.

Yes, if the Commissioner's thresholds apply. Section 12A, in force since 1 June 2025, requires data controllers and data processors to appoint one or more data protection officers and notify the Commissioner. The Commissioner's DPO guideline explains when appointment is mandatory, for example based on the volume of data subjects or processing of sensitive data.

The Malaysia PDPA shares many ideas with GDPR, such as notice, consent, security, retention, access rights, breach notification and DPOs, but it applies only to commercial transactions and uses its own seven principles. ISO 27001 is a voluntary security standard, and its controls help evidence the PDPA Security Principle, so mapping them together avoids duplicate work.

Yes. OneClickComply supports the Malaysia PDPA today. Its obligations sit alongside controls you run for ISO 27001, GDPR or SOC 2, with evidence collected once and reused. Automated evidence collection, AutoComplete policies and continuous monitoring support the work. OneClickComply does not certify compliance or replace legal advice.