MalaysiaPersonal Data Protection Act, processing of sensitive personal data
Personal Data Protection Act 2010 (Act 709), s. 40
In force since .
A sensitive categories rule binding private bodies.
- Audit expectation
- none
What it requires
- An app that processes sensitive personal data of an individual in Malaysia, meaning information on physical or mental health, political opinions, religious or similar beliefs or an offence committed or alleged, must have the individual's explicit consent or another condition listed in section 40, and a breach is an offence carrying a fine up to RM200,000, imprisonment up to 2 years, or both.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
What it makes you log
Logging duty
Section 40 restricts the processing of sensitive personal data to listed conditions and penalises a breach in subsection (3). It imposes no duty to keep a log or record and names no audit or inspection. The section has no scope clause, so there is no territorial hook. The consolidated text pinned is the edition before Act A1727 and the renaming of data user.
- Kind
- None
- As of
What this law does
Section 40 of Act 709 bars a data user from processing sensitive personal data of a data subject except on a listed condition. The first listed condition is the data subject's explicit consent. Contravening section 40(1) is an offence carrying a fine up to RM200,000, imprisonment up to 2 years, or both. Act A1727 s.2 substitutes data controller for data user throughout Act 709.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .