Processes personal data, in Malaysia

Act 709 (Malaysia) ss.5(2), 12B(3) · Read the law's page

• An app processing the personal data of an individual in Malaysia must be prepared to answer to the Personal Data Protection Commissioner for a Data Protection Principle violation (an offence carrying up to 3 years imprisonment) or a breach-notification failure (an offence carrying up to 2 years imprisonment); Malaysia's enforcement is Commissioner-driven, and the Act creates no statutory civil cause of action for the data subject.

Act 709 (Malaysia), as amended by the Personal Data Protection (Amendment) Act 2024, Act A1727 · Read the law's page

• An app that collects, uses, or discloses the personal data of an individual in Malaysia must obtain consent, subject to the contract, legal-obligation, or vital-interest exceptions, and processing sensitive personal data needs the data subject's explicit consent under the Act's stricter standard.

Personal Data Protection Act 2010 (Act 709), s. 40 · Read the law's page

• An app that processes sensitive personal data of an individual in Malaysia, meaning information on physical or mental health, political opinions, religious or similar beliefs or an offence committed or alleged, must have the individual's explicit consent or another condition listed in section 40, and a breach is an offence carrying a fine up to RM200,000, imprisonment up to 2 years, or both.

Personal Data Protection Act 2010 (Act 709), s. 43 · Read the law's page

• An app that processes an individual's personal data in Malaysia for direct marketing must stop, or not begin, that processing when the individual gives written notice requiring it, as the Commissioner may require.

Personal Data Protection Act 2010 (Act 709), ss. 30 and 31 · Read the law's page

• An app holding the personal data of an individual in Malaysia must, on the individual's written data access request and payment of the prescribed fee, tell the individual whether it processes their personal data and give a copy, within 21 days of receipt, or within a further 14 days where it has told the requestor in writing that it cannot meet the first period.

Personal Data Protection Act 2010 (Act 709), ss. 34 and 35 · Read the law's page

• An app holding the personal data of an individual in Malaysia must, on the individual's written data correction request, correct personal data that is inaccurate, incomplete, misleading or not up-to-date and give the individual a copy of the corrected data, within 21 days of receipt, or within a further 14 days where it has told the requestor in writing that it cannot meet the first period.

Personal Data Protection Act 2010 (Act 709), ss. 38 and 42 · Read the law's page

• An app processing the personal data of an individual in Malaysia must cease the processing when the individual withdraws consent by written notice.
• An app must, on an individual's written notice that its processing of their personal data is causing or is likely to cause substantial and unwarranted damage or distress, cease or not begin the processing the notice specifies, unless the individual has consented or the processing is necessary for a contract, a legal obligation or the individual's vital interests, and must answer the notice in writing within 21 days of receipt.

Credit Reporting Agencies Act 2010 (Act 710), ss. 11, 22, 24, 26, 30, 31, 39, 61 and 62 · Read the law's page

• Do not carry on a credit reporting business in Malaysia unless you are a company registered as a credit reporting agency with a certificate of registration from the Registrar of Credit Reporting Agencies; carrying on the business unregistered is an offence carrying a fine up to RM1,000,000, imprisonment up to 3 years, or both.
• If you are a credit reporting agency, collect a customer's credit information only for a specific and lawful purpose directly related to your activity, only what is necessary for that purpose and no more than is adequate, and disclose it only with the customer's consent, to prevent or detect crime or for investigations, or where a law or court order requires or authorizes it.when it serves a financial business
• If you are a credit reporting agency, protect the credit information you hold from loss, misuse, unauthorized or accidental access or disclosure, alteration or destruction, impose access authentication controls, and keep an access log of every access for not less than two years.when it serves a financial business
• If you are a credit reporting agency, answer a customer's access request and correction request within 21 days of receiving each, and do not transfer a customer's credit information to a place outside Malaysia unless the Minister has specified that place by gazette notification or a listed exception applies.when it serves a financial business

Act 709 (Malaysia) s.129, as amended by Act A1727 s.12, in force 1 April 2025 · Read the law's page

• An app transferring the personal data of an individual in Malaysia, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside Malaysia must self-assess that the recipient's jurisdiction has a substantially similar law or an adequate level of protection before the transfer.

Act 709 (Malaysia) s.4, as amended by Act A1727 s.3, in force 1 April 2025 · Read the law's page

• An app that collects or processes a faceprint, voiceprint, or other biometric identifier from an individual in Malaysia, including one derived from technical processing of a photo, video, or audio recording, must obtain the data subject's explicit consent under Act 709's sensitive personal data standard.

Act 709 (Malaysia) s.43A, as inserted by Act A1727 s.9, in force 1 June 2025 · Read the law's page

• An app holding the personal data of an individual in Malaysia must, on a written electronic request, transmit that data to another data controller the individual chooses, where the data formats are technically compatible.

Act 709 (Malaysia) ss.12A-12B, as inserted by Act A1727 s.6, in force 1 June 2025 · Read the law's page

• An app that controls or processes the personal data of individuals in Malaysia must appoint a Data Protection Officer where, under the Commissioner's guideline, its processing involves personal data of more than 20,000 data subjects, sensitive personal data of more than 10,000 data subjects, or activities that require regular and systematic monitoring of personal data.
• A data controller who reasonably believes a personal data breach has occurred must notify the Commissioner as soon as practicable, which the Commissioner's guideline puts at no later than 72 hours from the occurrence of the breach, and must notify affected data subjects without unnecessary delay where the breach causes or is likely to cause significant harm.