Data protection & privacy laws in Malaysia (2026)

The final tranche of the Personal Data Protection (Amendment) Act 2024 activates its most operationally demanding obligations: mandatory data breach notification to the Commissioner and affected individuals, compulsory Data Protection Officer appointment (with 21-day notification to the Commissioner), and a right to data portability. Penalties now reach MYR 1 million and/or three years' imprisonment.

The Personal Data Protection Commissioner published guidelines replacing the previous country-whitelist regime with a risk-based framework; data controllers must conduct a Transfer Impact Assessment (TIA, valid three years) and may rely on Binding Corporate Rules, Standard Contractual Clauses, or approved certification schemes to justify transfers.

The PDPD published two operational guidelines — specifying DPO qualifications and appointment procedures, and requiring a breach register retained for at least two years — providing the compliance roadmap ahead of the 1 June 2025 implementation date.

Following Royal Assent on 9 October 2024, the Amendment Act is published in the Federal Gazette as Act A1727, formally enacting GDPR-influenced reforms including mandatory DPOs, breach notification, data portability, and risk-based cross-border transfer rules.

Malaysia's first standalone cybersecurity statute, gazetted 26 June 2024, establishes mandatory incident-reporting and risk-assessment obligations for National Critical Information Infrastructure operators and a licensing regime for cybersecurity service providers — creating parallel security obligations that complement PDPA breach-notification duties.

The Personal Data Protection Department reported 130 breach cases in just the first half of 2023, versus only 30 for all of 2022; the Digital Minister disclosed that average fines since 2017 were a mere MYR 24,000 per company, directly fuelling the case for the 2024 amendment's penalty hike.

Threat-intelligence firm ThreatMon identified records linked to Maybank, Astro, and the Election Commission on dark-web forums; the Communications and Digital Minister ordered the PDPD and CyberSecurity Malaysia to investigate, exposing the critical gap caused by the absence of any mandatory breach-notification law.

A 160 GB database purportedly sourced from government MyIdentity APIs — covering the entire adult population — was listed online for USD 10,000; the Home Ministry denied the NRD as the source but the incident intensified public pressure on the government to strengthen data-protection law.

Three years after enactment, the PDPA 2010 takes legal effect — making Malaysia the first ASEAN country with comprehensive data-protection legislation — establishing seven data-protection principles, a registration regime for 13 commercial sectors, and the office of the Personal Data Protection Commissioner.

Malaysia enacts its first comprehensive personal data protection statute, creating the PDPA framework to govern commercial-sector processing — though it notably excludes government bodies from its scope and applies only within commercial transactions, leaving significant coverage gaps that persist until the 2024 amendment.

Part of Malaysia's landmark five-statute 'Cyber Laws' package, the CMA establishes the Malaysian Communications and Multimedia Commission (MCMC) and introduces the earliest statutory network security provisions — functioning as the de facto pre-PDPA framework for communications-related data.