Personal Data Protection Act, data portability

Act 709 (Malaysia) s.43A, as inserted by Act A1727 s.9, in force 2025-06-01

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 June 2025.

A data subject rights rule binding private bodies.

As of 29 August 2026.

What it requires

An app holding the personal data of an individual in Malaysia must, on a written electronic request, transmit that data to another data controller the individual chooses, where the data formats are technically compatible.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Act A1727 s.9 added s.43A, giving a data subject the right to request the data controller transmit their personal data to another data controller of the subject's choice by written electronic notice, subject to technical feasibility and compatibility of the data format. The controller must complete the transmission within the period as may be prescribed, with no fixed statutory deadline; the specific period is left to subsidiary regulation not read.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web

Read the law

official Act A1727 amendment text, Department of Personal Data Protection (pdp.gov.my)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app