MalaysiaPersonal Data Protection Act, data protection officer and breach notification
Act 709 (Malaysia) ss.12A-12B, as inserted by Act A1727 s.6, in force
In force since .
A breach notification rule binding private bodies.
- Audit expectation
- none
What it requires
- An app that controls or processes the personal data of individuals in Malaysia must appoint a Data Protection Officer where, under the Commissioner's guideline, its processing involves personal data of more than 20,000 data subjects, sensitive personal data of more than 10,000 data subjects, or activities that require regular and systematic monitoring of personal data.
- A data controller who reasonably believes a personal data breach has occurred must notify the Commissioner as soon as practicable, which the Commissioner's guideline puts at no later than 72 hours from the occurrence of the breach, and must notify affected data subjects without unnecessary delay where the breach causes or is likely to cause significant harm.
These lines are LexLint's reading of the law's text. Also read by: Personal Data Protection Commissioner of Malaysia (Department of Personal Data Protection) (guidance, recorded ).
Who enforces it
Settledness
The Commissioner's separate Guideline on the Appointment of Data Protection Officer (version 1.0, issued ) construes section 12A.
- As of
- Guidance link
- https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/08/GP_DBN_ENG.pdf
- Guidance body
- Personal Data Protection Commissioner of Malaysia (Department of Personal Data Protection)
- Open questions
- Does an app that profiles its users' searches and purchases carry out "regular and systematic monitoring" of personal data, so that it must appoint a data protection officer?
What it makes you log
Logging duty
Section 12A requires a data controller to appoint a data protection officer and notify the Commissioner of the appointment, and section 12B requires it to notify the Commissioner of a personal data breach as soon as practicable and the data subject where significant harm is likely. Notifying a breach is not keeping a record of it, and neither section tells the controller to document breaches or keep a register, so no record duty is stated. The Commissioner's breach notification guideline, which the row cites in its summary, is outside the sections coded. Neither section names an audit. There is no scope clause in the sections, so no territorial hook.
- Kind
- None
- As of
What this law does
Act A1727 s.6 inserts new Division 1A into Part II, requiring both the data controller and data processor to appoint a Data Protection Officer (s.12A) and, at s.12B, requiring the data controller to notify the Commissioner as soon as practicable on reasonable belief that a personal data breach occurred; where the breach causes or is likely to cause significant harm to the data subject, the controller must also notify the data subject without unnecessary delay.
No fixed numeric deadline is set in the statute itself; timing and form are left to the Commissioner's own prescribed manner. Paragraph 6.1 of the Commissioner's Data Breach Notification Guideline states that the notification shall be made as soon as practicable and no later than seventy-two (72) hours from the occurrence of the personal data breach.
Paragraph 4.2 of the Commissioner's Guideline on the Appointment of Data Protection Officer requires a data controller or data processor to appoint one if its processing involves personal data exceeding 20,000 data subjects or sensitive personal data, including financial information data, exceeding 10,000 data subjects. Paragraph 4.2 of that guideline also requires appointment where the processing involves activities that require regular and systematic monitoring of personal data.
Non-compliance with the Commissioner-notification duty is itself an offence, carrying a fine up to RM250,000, imprisonment up to 2 years, or both. Before this amendment, Act 709 had no statutory breach-notification duty at all.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .