MalaysiaPersonal Data Protection Act, biometric data definition and sensitive category
Act 709 (Malaysia) s.4, as amended by Act A1727 s.3, in force
In force since .
A biometric privacy rule binding private bodies.
- Excludes recording-derived identifiers
- No
- Audit expectation
- none
What it requires
- An app that collects or processes a faceprint, voiceprint, or other biometric identifier from an individual in Malaysia, including one derived from technical processing of a photo, video, or audio recording, must obtain the data subject's explicit consent under Act 709's sensitive personal data standard.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Is a faceprint or voiceprint derived from a photograph or recording "personal data resulting from technical processing" of a person's physical, physiological or behavioural characteristics?
What it makes you log
Logging duty
Section 4 as amended by Act A1727 section 3 adds the definitions of biometric data and personal data breach and makes biometric data sensitive personal data. A definition creates no duty, so the section states no logging or record-keeping duty, and it names no audit and no one who may inspect anything. The section has no scope clause, so there is no territorial hook.
- Kind
- None
- As of
What this law does
Act A1727 s.3 inserted a dedicated biometric data definition into s.4 (any personal data resulting from technical processing relating to a person's physical, physiological, or behavioural characteristics) and added biometric data to the sensitive personal data list immediately after the offence-related category.
Both a faceprint and a voiceprint fall squarely within physical, physiological, or behavioural characteristics resulting from technical processing, which is exactly how a voice or face embedding is produced. Both are now, in force, sensitive personal data under s.4, requiring explicit consent under s.40's stricter processing conditions. No biometric-specific retention or destruction duty distinct from the Act's general data-minimisation and accuracy principles was found.
When LexLint raises it
When your app profile says your app processes biometric data or processes personal data.
Back to the example · Lint your app
Page updated .