MalaysiaPersonal Data Protection Act, cross-border transfer
Act 709 (Malaysia) s.129, as amended by Act A1727 s.12, in force
In force since .
A cross border transfer rule binding private bodies.
- Audit expectation
- none
What it requires
- An app transferring the personal data of an individual in Malaysia, including a faceprint, voiceprint, or other biometric identifier, to a recipient outside Malaysia must self-assess that the recipient's jurisdiction has a substantially similar law or an adequate level of protection before the transfer.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Commissioner of Malaysia (Department of Personal Data Protection) (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.DE-P2Data processing ecosystem parties (e.g., service providers, customers, partners, product manufacturers, application developers) are identified, prioritized, and assessed using a privacy risk assessment process.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/08/GP_CBPDT_EN-1.pdf
- Guidance body
- Personal Data Protection Commissioner of Malaysia (Department of Personal Data Protection)
- Open questions
- Is the law of a receiving place "substantially similar" to Act 709 when it has no data protection officer requirement or no data breach notification requirement?
What it makes you log
Logging duty
Section 129 as amended by Act A1727 section 12 lets a data controller transfer personal data to a place outside Malaysia on stated conditions, with the amendment deleting the Minister's whitelist. The amending text states no record, log or audit duty, and names no one who may inspect anything. The section has no scope clause of its own, so there is no territorial hook.
- Kind
- None
- As of
What this law does
The original s.129 barred transferring personal data outside Malaysia except to a place the Minister specified by gazette notification as having a substantially similar law or an adequate level of protection; in practice this whitelist mechanism was never gazetted, making the provision largely inoperative.
Act A1727 s.12 restructures s.129, replacing the Minister's gazetting power with the data controller's own self-assessment against the substantially similar law or adequate level of protection standard, and drops the alternative or that serves the same purposes as this Act language, narrowing the standard. There is no data-localization mandate.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .