MalaysiaCredit Reporting Agencies Act, registration and conduct of credit reporting agencies
Credit Reporting Agencies Act 2010 (Act 710), ss. 11, 22, 24, 26, 30, 31, 39, 61 and 62
In force since .
A data brokers rule binding private bodies.
- Instrument type
- an act of a legislature
- Obligation class
- Licensing, Consent, Security, Data subject rights, Transfer, Governance
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- Do not carry on a credit reporting business in Malaysia unless you are a company registered as a credit reporting agency with a certificate of registration from the Registrar of Credit Reporting Agencies; carrying on the business unregistered is an offence carrying a fine up to RM1,000,000, imprisonment up to 3 years, or both.
- If you are a credit reporting agency, collect a customer's credit information only for a specific and lawful purpose directly related to your activity, only what is necessary for that purpose and no more than is adequate, and disclose it only with the customer's consent, to prevent or detect crime or for investigations, or where a law or court order requires or authorizes it.
- If you are a credit reporting agency, protect the credit information you hold from loss, misuse, unauthorized or accidental access or disclosure, alteration or destruction, impose access authentication controls, and keep an access log of every access for not less than two years.
- If you are a credit reporting agency, answer a customer's access request and correction request within 21 days of receiving each, and do not transfer a customer's credit information to a place outside Malaysia unless the Minister has specified that place by gazette notification or a listed exception applies.
These lines are LexLint's reading of the law's text.
Who enforces it
Enforcement body
Registrar of Credit Reporting Agencies
Settledness
- As of
What record it asks for
What the log must hold
Event time, Actor identity, Affected person reference, Access record
Log retention
The access log contains records of all accesses made for a period of not less than two years preceding the date of the access.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 2
Logging duty
A credit reporting agency maintains an access log recording the time and date of each access, the identity of the subscriber or other person who accessed the credit information, the purpose of the access, and the specific person and customer concerned, and keeps records of all accesses for not less than two years.
- Kind
- Explicit
- As of
- Provision
- Act 710, s. 26(3)(h), (6) and (7)
- Trigger
- personal_data_processing
What this law does
Section 11 of Act 710 requires a credit reporting business to be a company registered as a credit reporting agency with a certificate of registration from the Registrar. Carrying on a credit reporting business without registration is an offence carrying a fine up to RM1,000,000, imprisonment up to 3 years, or both.
Section 22 of Act 710 bars a credit reporting agency from collecting credit information about a customer unless the collection is for a specific and lawful purpose, is necessary for that purpose, and is adequate but not excessive. A credit reporting agency's collection and use of credit information does not require the consent of the customer concerned.
Section 24 of Act 710 bars a credit reporting agency from disclosing credit information unless the customer has consented, the disclosure is necessary to prevent or detect crime or for investigations, or a law or court order requires or authorizes it. A credit reporting agency that contravenes section 24 commits an offence carrying a fine up to RM500,000, imprisonment up to 2 years, or both.
Section 26 of Act 710 requires a credit reporting agency to take practical steps to protect credit information from loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction. A credit reporting agency must maintain an access log of the accesses made to the credit information it holds. A credit reporting agency must ensure that the access log contains records of all accesses made for a period of not less than two years preceding the date of the access.
A credit reporting agency must respond to an access request about a customer's credit information not later than 21 days from the date of receipt. A credit reporting agency that receives a correction request must tell the requestor what action it took not later than 21 days from the date of receipt.
Section 61 of Act 710 bars a credit reporting agency from transferring a customer's credit information to a place outside Malaysia unless the Minister has specified that place by gazette notification, subject to the exceptions in subsection (3). A person who sells credit information commits an offence if the person collected it in contravention of section 62(1). An offence under section 62 of Act 710 carries a fine up to RM500,000, imprisonment up to 2 years, or both.
The Registrar of Credit Reporting Agencies may serve an enforcement notice on a credit reporting agency that is contravening Act 710.
When LexLint raises it
When your app profile says your app provides financial services or processes personal data.
Back to the example · Lint your app
Page updated .