Personal Data Protection Act, biometric data definition and sensitive category

Act 709 (Malaysia) s.4, as amended by Act A1727 s.3, in force 2025-04-01

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 April 2025.

A biometric privacy rule binding private bodies.

As of 29 August 2026.

What it requires

An app that collects or processes a faceprint, voiceprint, or other biometric identifier from an individual in Malaysia, including one derived from technical processing of a photo, video, or audio recording, must obtain the data subject's explicit consent under Act 709's sensitive personal data standard.

What it reaches

Excludes recording-derived identifiersNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Act A1727 s.3 inserted a dedicated biometric data definition into s.4 (any personal data resulting from technical processing relating to a person's physical, physiological, or behavioural characteristics) and added biometric data to the sensitive personal data list immediately after the offence-related category.

Both a faceprint and a voiceprint fall squarely within physical, physiological, or behavioural characteristics resulting from technical processing, which is exactly how a voice or face embedding is produced. Both are now, in force, sensitive personal data under s.4, requiring explicit consent under s.40's stricter processing conditions. No biometric-specific retention or destruction duty distinct from the Act's general data-minimisation and accuracy principles was found.

When LexLint raises it

processes_biometrics
processes_voice
trains_models
crawls_web

Read the law

official Act A1727 amendment text, Department of Personal Data Protection (pdp.gov.my)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app