MalaysiaPersonal Data Protection Act, data access request
Personal Data Protection Act 2010 (Act 709), ss. 30 and 31
In force since .
A data subject rights rule binding private bodies.
- Audit expectation
- none
What it requires
- An app holding the personal data of an individual in Malaysia must, on the individual's written data access request and payment of the prescribed fee, tell the individual whether it processes their personal data and give a copy, within 21 days of receipt, or within a further 14 days where it has told the requestor in writing that it cannot meet the first period.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
What it makes you log
Logging duty
Sections 30 and 31 give a data access right and fix the 21 day period for answering it. They impose no duty to keep a log or record and name no audit or inspection. The sections have no scope clause, so there is no territorial hook. The consolidated text pinned is the edition before Act A1727 and the renaming of data user.
- Kind
- None
- As of
What this law does
Section 30 of Act 709 lets a requestor, on payment of a prescribed fee, make a written data access request to a data user. A requestor may also have a copy of the personal data communicated in an intelligible form. A data user must comply with a data access request within 21 days of receiving it. A data user unable to comply within that period must tell the requestor so in writing before it expires. A data user must comply in whole within 14 days after the 21 day period expires.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .