MalaysiaPersonal Data Protection Act, withdrawal of consent and right to stop processing
Personal Data Protection Act 2010 (Act 709), ss. 38 and 42
In force since .
A data subject rights rule binding private bodies.
- Audit expectation
- none
What it requires
- An app processing the personal data of an individual in Malaysia must cease the processing when the individual withdraws consent by written notice.
- An app must, on an individual's written notice that its processing of their personal data is causing or is likely to cause substantial and unwarranted damage or distress, cease or not begin the processing the notice specifies, unless the individual has consented or the processing is necessary for a contract, a legal obligation or the individual's vital interests, and must answer the notice in writing within 21 days of receipt.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
What it makes you log
Logging duty
The provisions give a data subject a right and fix what the data user must do in answer. They impose no duty to keep a log or record and name no audit or inspection. The provisions have no scope clause, so there is no territorial hook. The consolidated text pinned is the edition before Act A1727 and the renaming of data user.
- Kind
- None
- As of
What this law does
Section 38 of Act 709 lets a data subject withdraw consent to the processing of personal data by notice in writing. A data user that receives the withdrawal notice must cease the processing of the personal data. A data user who contravenes the duty to cease commits an offence carrying a fine up to RM100,000, imprisonment up to 1 year, or both.
Section 42 of Act 709 lets a data subject, by written notice, require a data user to cease the processing of or processing for a specified purpose or in a specified manner. The section 42 notice applies where the processing is causing or is likely to cause substantial damage or substantial distress to the data subject or to another person. The section 42 notice does not apply where the data subject has given consent. A data user must answer a data subject notice under section 42 in writing not later than 21 days after receiving it.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .