MalaysiaPersonal Data Protection Act, data portability
Act 709 (Malaysia) s.43A, as inserted by Act A1727 s.9, in force
In force since .
A data subject rights rule binding private bodies.
- Audit expectation
- none
What it requires
- An app holding the personal data of an individual in Malaysia must, on a written electronic request, transmit that data to another data controller the individual chooses, where the data formats are technically compatible.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DM-P2Data elements can be accessed for transmission or disclosure.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
The Commissioner’s consultation paper on the right to data portability (Public Consultation Paper No. 03/2024) is a draft, not a final guideline.
- As of
- Open questions
- Within what period must a data controller complete a transmission under section 43A(3) of Act 709, which refers to "the period as may be prescribed"?
What it makes you log
Logging duty
New section 43A gives a data subject the right to ask a data controller in writing, by electronic means, to transmit the personal data to another controller, subject to technical feasibility, and to complete the transmission within a prescribed period. It imposes no duty to keep a log or record and names no audit or inspection. The section has no scope clause, so there is no territorial hook.
- Kind
- None
- As of
What this law does
Act A1727 s.9 added s.43A, giving a data subject the right to request the data controller transmit their personal data to another data controller of the subject's choice by written electronic notice, subject to technical feasibility and compatibility of the data format. The controller must complete the transmission within the period as may be prescribed, with no fixed statutory deadline; the specific period is left to subsidiary regulation not read.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .