MalaysiaPersonal Data Protection Act, comprehensive regime and lawful bases
Act 709 (Malaysia), as amended by the Personal Data Protection (Amendment) Act 2024, Act A1727
In force since .
A comprehensive regime rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment
- Audit expectation
- on_request
- Who audits it
- Regulator
What it requires
- An app that collects, uses, or discloses the personal data of an individual in Malaysia must obtain consent, subject to the contract, legal-obligation, or vital-interest exceptions, and processing sensitive personal data needs the data subject's explicit consent under the Act's stricter standard.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Is the consent that section 6(1)(a) requires for personal data other than sensitive personal data something less than the "explicit consent" that section 40(1)(a) requires for sensitive personal data, so that consent implied from a user's continued use of an app can satisfy section 6(1)(a)?
What it makes you log
Logging duty
Section 44(1) requires a data controller (the Act's "data user" until Act A1727 renamed the term) to keep and maintain a record of any application, notice, request or other information relating to personal data that has been or is being processed, and section 44(2) lets the Commissioner determine the manner and form of the record. The record holds requests, notices and information about the processing, which are not event-log fields, so the contents list is empty. Section 44 sets no retention period and names no person who may demand the record. Section 101 lets the Commissioner inspect a personal data system when it chooses, which gives an audit expectation of on request by the regulator. The territorial hook is the establishment test in section 2(2)(a); the limb in section 2(2)(b) turns on equipment used in Malaysia and is not a hook value, so it is left out. The consolidated text pinned is the edition before Act A1727 and the renaming.
- Kind
- Explicit
- As of
- Provision
- Section 44 (record to be kept by the data controller), with section 101 (inspection of a personal data system)
- Trigger
- personal_data_processing
What this law does
Act 709's lawful basis is a bifurcated consent model: ordinary personal data needs the data subject's consent, subject to contract, legal-obligation, and vital-interest exceptions (s.6), while sensitive personal data needs explicit consent under s.40's stricter conditions.
Contravening any of the seven Data Protection Principles is itself an offence, carrying a fine up to RM1,000,000, imprisonment up to 3 years, or both (s.5(2)), the maxima that Act A1727 s.4(b)(ii) raised from RM300,000 and 2 years. Section 4 of Act A1727 came into operation on . Act A1727 relabels data user as data controller throughout and, for the first time, imposes direct statutory duties on data processors, who were previously reached only through contract with the data user.
Section 1(2) leaves the base Act's own commencement to a Ministerial gazette notification rather than stating a date in the Act's own text; the Department of Personal Data Protection's own published determination fixes that date at , the general commencement date, distinct from the 2024 amendment's own staged commencement dates.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .