MalaysiaPersonal Data Protection Act, enforcement
Act 709 (Malaysia) ss.5(2), 12B(3)
In force since , effective .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- An app processing the personal data of an individual in Malaysia must be prepared to answer to the Personal Data Protection Commissioner for a Data Protection Principle violation or a breach-notification failure, each carrying criminal exposure of up to 2 years imprisonment; Malaysia's enforcement is Commissioner-driven, with no private right of action found in the sections read.
These lines are LexLint's reading of the law's text.
Who enforces it
Settledness
- As of
- Open questions
- Does a data controller that fails to notify the data subject under section 12B(2) of Act 709 commit an offence, when section 12B(3) penalises only a controller who "contravenes subsection (1)"?
What it makes you log
Logging duty
Section 5(2), as amended by Act A1727 section 4, makes a breach of the Personal Data Protection Principles an offence (up to one million ringgit or three years, or both) and extends it to a data processor in breach of the security principle, and section 12B(3) makes a failure to notify a breach an offence (up to 250,000 ringgit or two years). These are penalty provisions: they impose no duty to keep a log or record and name no audit or inspection. They have no scope clause, so there is no territorial hook.
- Kind
- None
- As of
What this law does
The Personal Data Protection Commissioner is the supervisory authority.
Enforcement is criminal and administrative: contravening any Data Protection Principle is an offence under s.5(2), which carries a fine up to RM1,000,000, imprisonment up to 3 years, or both since Act A1727 s.4 raised the base Act's original RM300,000 and 2 year maximum, effective , and the new s.12B(3) breach-notification offence, in force since , carries a fine up to RM250,000, imprisonment up to 2 years, or both.
No private right of action provision was located in the sections read; enforcement is Commissioner-driven and criminal, not a statutory civil cause of action for the data subject, though the search was not exhaustive across the full base Act text.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .