Malaysia

Act A1727 s.3 inserted a dedicated biometric data definition into s.4 (any personal data resulting from technical processing relating to a person's physical, physiological, or behavioural characteristics) and added biometric data to the sensitive personal data list immediately after the offence-related category.

Both a faceprint and a voiceprint fall squarely within physical, physiological, or behavioural characteristics resulting from technical processing, which is exactly how a voice or face embedding is produced. Both are now, in force, sensitive personal data under s.4, requiring explicit consent under s.40's stricter processing conditions. No biometric-specific retention or destruction duty distinct from the Act's general data-minimisation and accuracy principles was found.

Act A1727 s.6 inserts new Division 1A into Part II, requiring both the data controller and data processor to appoint a Data Protection Officer (s.12A) and, at s.12B, requiring the data controller to notify the Commissioner as soon as practicable on reasonable belief that a personal data breach occurred; where the breach causes or is likely to cause significant harm to the data subject, the controller must also notify the data subject without unnecessary delay.

No fixed numeric deadline is set in the statute itself; timing and form are left to the Commissioner's own prescribed manner. Paragraph 6.1 of the Commissioner's Data Breach Notification Guideline states that the notification shall be made as soon as practicable and no later than seventy-two (72) hours from the occurrence of the personal data breach.

Paragraph 4.2 of the Commissioner's Guideline on the Appointment of Data Protection Officer requires a data controller or data processor to appoint one if its processing involves personal data exceeding 20,000 data subjects or sensitive personal data, including financial information data, exceeding 10,000 data subjects. Paragraph 4.2 of that guideline also requires appointment where the processing involves activities that require regular and systematic monitoring of personal data.

Non-compliance with the Commissioner-notification duty is itself an offence, carrying a fine up to RM250,000, imprisonment up to 2 years, or both. Before this amendment, Act 709 had no statutory breach-notification duty at all.

Act 709's lawful basis is a bifurcated consent model: ordinary personal data needs the data subject's consent, subject to contract, legal-obligation, and vital-interest exceptions (s.6), while sensitive personal data needs explicit consent under s.40's stricter conditions.

Contravening any of the seven Data Protection Principles is itself an offence, carrying a fine up to RM1,000,000, imprisonment up to 3 years, or both (s.5(2)), the maxima that Act A1727 s.4(b)(ii) raised from RM300,000 and 2 years. Section 4 of Act A1727 came into operation on 1 April 2025. Act A1727 relabels data user as data controller throughout and, for the first time, imposes direct statutory duties on data processors, who were previously reached only through contract with the data user.

Section 1(2) leaves the base Act's own commencement to a Ministerial gazette notification rather than stating a date in the Act's own text; the Department of Personal Data Protection's own published determination fixes that date at 15 November 2013, the general commencement date, distinct from the 2024 amendment's own staged commencement dates.

The original s.129 barred transferring personal data outside Malaysia except to a place the Minister specified by gazette notification as having a substantially similar law or an adequate level of protection; in practice this whitelist mechanism was never gazetted, making the provision largely inoperative.

Act A1727 s.12 restructures s.129, replacing the Minister's gazetting power with the data controller's own self-assessment against the substantially similar law or adequate level of protection standard, and drops the alternative or that serves the same purposes as this Act language, narrowing the standard. There is no data-localization mandate.

Section 30 of Act 709 lets a requestor, on payment of a prescribed fee, make a written data access request to a data user. A requestor may also have a copy of the personal data communicated in an intelligible form. A data user must comply with a data access request within 21 days of receiving it. A data user unable to comply within that period must tell the requestor so in writing before it expires. A data user must comply in whole within 14 days after the 21 day period expires.

Act A1727 s.9 added s.43A, giving a data subject the right to request the data controller transmit their personal data to another data controller of the subject's choice by written electronic notice, subject to technical feasibility and compatibility of the data format. The controller must complete the transmission within the period as may be prescribed, with no fixed statutory deadline; the specific period is left to subsidiary regulation not read.

The Personal Data Protection Commissioner is the supervisory authority.

Enforcement is criminal and administrative: contravening any Data Protection Principle is an offence under s.5(2), which carries a fine up to RM1,000,000, imprisonment up to 3 years, or both since Act A1727 s.4 raised the base Act's original RM300,000 and 2 year maximum, effective 1 April 2025, and the new s.12B(3) breach-notification offence, in force since 1 June 2025, carries a fine up to RM250,000, imprisonment up to 2 years, or both.

No private right of action provision was located in the sections read; enforcement is Commissioner-driven and criminal, not a statutory civil cause of action for the data subject, though the search was not exhaustive across the full base Act text.

Section 40 of Act 709 bars a data user from processing sensitive personal data of a data subject except on a listed condition. The first listed condition is the data subject's explicit consent. Contravening section 40(1) is an offence carrying a fine up to RM200,000, imprisonment up to 2 years, or both. Act A1727 s.2 substitutes data controller for data user throughout Act 709.

Section 3 makes it an offence to cause a computer to perform a function with intent to secure access to a program or data held in any computer, where that access is unauthorised and the person knows at the time that it is unauthorised; the intent need not be directed at any particular program, data, or computer.

Section 2(5) defines access as unauthorised only where the person is not entitled to control access of that kind and does not have consent from, or exceeds a right or consent given by, a person who is so entitled.

Because the offence turns on whether the access itself is unauthorised rather than on the manner of access, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision, though no reported Malaysian decision addresses the point either way.

Sections 4 and 5 separately punish, at higher penalties, unauthorised access committed with intent to commit or facilitate a further offence, and unauthorised modification of the contents of a computer.

Section 13(2)(a) excuses, from the exclusive rights in section 13(1), any act done by way of fair dealing for the purposes of research, private study, criticism, review, or the reporting of news or current events, provided the title and authorship of the work are acknowledged, except that no acknowledgment is required for news or current events reported by sound recording, film, or broadcast.

Section 13(2A), inserted by the Copyright (Amendment) Act 2012 (Act A1420, in force 1 March 2012), directs that whether a dealing is fair turns on the purpose and character of the dealing including whether it is commercial or non-profit educational, the nature of the work, the amount and substantiality of the portion used, and the effect on the potential market for the work. Section 7(2A) excludes any idea, procedure, method of operation, or mathematical concept from copyright protection.

Section 7(3)(a) requires only that sufficient effort be expended to make a work original in character, with no separate exclusion of the news of the day or mere facts of the kind some other jurisdictions' copyright statutes carry.

Malaysia has no text-and-data-mining exception and no sui generis database right; reproducing or extracting a substantial part of a copyright work to train a model, or extracting a substantial part of a database's contents, therefore rests only on the general fair dealing ground above, where it can be characterised as research, and is not otherwise excused.

Paragraph S 11.2 requires a financial institution to develop a Cyber Risk Framework that articulates its governance for managing cyber risks, its cyber resilience objectives and its risk tolerance. Paragraph S 11.5 requires a financial institution to adopt the control measures outlined in Appendix 5 to enhance its resilience to cyber-attacks. Paragraph S 11.6 requires a financial institution to conduct a realistic Red Team simulation attack on its infrastructure at least once every three years.

Paragraph S 11.9 requires a financial institution to establish a Security Operations Center supported by competent resources, with monitoring that covers all critical systems including the supporting infrastructure. Paragraph S 11.13 requires a financial institution to establish and implement a comprehensive Cyber Incident Response Plan.

Paragraph S 11.16 requires a financial institution to conduct an annual cyber drill exercise to test the effectiveness of that plan and to report the result to the board in a timely manner.

Paragraph S 11.4 requires a financial institution designated as a National Critical Information Infrastructure entity under the Cyber Security Act 2024 to ensure compliance with the requirements applicable to such entities, including additional directives and standards issued by the National Cyber Security Agency.

Appendix 12 to the policy document constitutes the Code of Practice for national critical information infrastructure entities designated by the Bank under the banking and finance sector.

The policy document applies to licensed banks, licensed investment banks, licensed Islamic banks, licensed insurers, licensed takaful operators, prescribed development financial institutions, approved issuers of electronic money, operators of a designated payment system, registered merchant acquirers and intermediary remittance institutions.

The requirements in the policy document are specified pursuant to sections 47(1), 47(2)(d) and 143(2) of the Financial Services Act 2013, and to the corresponding sections of the Islamic Financial Services Act 2013, the Development Financial Institutions Act 2002 and the Money Services Business Act 2011. Paragraph 5.2 provides that non-compliance with a standard may result in enforcement action. Paragraph 4.1 states that the policy document comes into effect on 28 November 2025.

Section 17(1) allows a national critical information infrastructure sector lead to designate a Government Entity or person as a national critical information infrastructure entity if it is satisfied that the entity owns or operates a national critical information infrastructure. Section 21(1) requires an NCII entity to implement the measures, standards and processes specified in the code of practice to ensure the cyber security of the infrastructure it owns or operates.

Section 21(5) makes a contravention of section 21(1) an offence with a fine not exceeding five hundred thousand ringgit or imprisonment for a term not exceeding ten years or both. Section 22(1) requires an NCII entity, within the period prescribed, to conduct a cyber security risk assessment and to cause an audit to be carried out by an auditor the Chief Executive approves, and section 22(2) requires it to submit the report to the Chief Executive within thirty days after completion.

Section 22(7) makes a contravention of section 22(1) or (2) an offence with a fine not exceeding two hundred thousand ringgit or imprisonment for a term not exceeding three years or both. Section 20(1) requires an NCII entity to comply with a request of its sector lead to provide information about the infrastructure it owns or operates.

Section 20(3) requires an NCII entity to notify its sector lead of a material change to the design, configuration, security or operation of the infrastructure within thirty days from the date the change was completed. Section 24(3) allows the Chief Executive to give directions to an NCII entity for a cyber security exercise, and section 24(4) makes a failure to comply an offence with a fine not exceeding one hundred thousand ringgit.

Section 25(1) requires a national critical information infrastructure sector lead to prepare a code of practice, to be endorsed by the Chief Executive, containing measures, standards and processes to ensure the cyber security of the infrastructure in its sector. Section 13(1) allows the Chief Executive to issue a directive considered necessary to ensure compliance with the Act.

Section 2 binds the Federal Government and State Governments, and renders neither liable to prosecution for an offence under the Act. The Prime Minister appointed 26 August 2024 as the date on which the Act comes into operation. The Act received Royal Assent on 18 June 2024 and was published in the Gazette on 26 June 2024.

Paragraph S 11.18 requires a financial institution to notify the Bank of cyber incidents in adherence to the Bank's policy documents on Operational Risk Reporting, Business Continuity Management and Merchant Acquiring Services, and any other relevant policy documents the Bank specifies.

Paragraph S 11.19 requires a financial institution to share cyber threat intelligence information with the industry on a timely basis, subject to the applicable data protection laws, and to allocate resources to take part in industry-wide initiatives.

The policy document applies to licensed banks, licensed investment banks, licensed Islamic banks, licensed insurers, licensed takaful operators, prescribed development financial institutions, approved issuers of electronic money, operators of a designated payment system, registered merchant acquirers and intermediary remittance institutions.

The requirements in the policy document are specified pursuant to sections 47(1), 47(2)(d) and 143(2) of the Financial Services Act 2013, and to the corresponding sections of the Islamic Financial Services Act 2013, the Development Financial Institutions Act 2002 and the Money Services Business Act 2011. Paragraph 5.2 provides that non-compliance with a standard may result in enforcement action. Paragraph 4.1 states that the policy document comes into effect on 28 November 2025.

Section 23(1) requires an NCII entity that learns that a cyber security incident has or might have occurred in respect of the infrastructure it owns or operates to notify the Chief Executive and its sector lead within the period and in the manner prescribed. Section 23(2) makes a contravention of section 23 an offence with a fine not exceeding five hundred thousand ringgit or imprisonment for a term not exceeding ten years or both.

Section 4 defines a cyber security incident as an act or activity carried out on or through a computer or computer system, without lawful authority, that jeopardizes or adversely affects the cyber security of that computer or computer system or another one.

Section 4 defines a national critical information infrastructure as a computer or computer system whose disruption or destruction would have a detrimental impact on the delivery of a service essential to the security, defence, foreign relations, economy, public health, public safety or public order of Malaysia. Section 4 defines an NCII entity as any Government Entity or person designated as a national critical information infrastructure entity under section 17 or 18.

Section 2 binds the Federal Government and State Governments, and renders neither liable to prosecution for an offence under the Act. The Prime Minister appointed 26 August 2024 as the date on which the Act comes into operation.

Section 18 of the Online Safety Act 2025 requires a licensed applications service provider or licensed content applications service provider to implement measures, specified in a code issued by the Commission, to ensure the safe use of its services by a child user, defined as a person under the age of eighteen years; subsection 18(3) requires that, for a service that is, in the provider's opinion, likely to be accessed by child users, those measures include safe design and operation to prevent a child's access to suspected harmful content, limit an identified adult's ability to communicate with an identified child, limit features that increase or sustain a child's use of the service, prevent an identified adult from viewing an identified child's personal information, and control personalised recommendation systems suitable for child users.

The Child Protection Code, issued by the Commission under section 80 read with section 18 and taking effect 1 June 2026, applies these duties to any applications service enabling communication between users and any content applications service, and adds content-moderation duties (detecting and removing harmful content, accessible reporting channels for child users, steps against repeated exposure to reported or removed content), a duty to make available parental control features, a duty to set privacy and safety settings to the highest level by default for child users and limit an unconnected adult's direct communication with a child user, and duties over search and recommendation systems.

Those duties include activating safe search by default. Separately, algorithmic recommendation does not display or promote harmful content to child users.

The Child Protection Code, issued by the Malaysian Communications and Multimedia Commission under section 80 of the Online Safety Act 2025 read with section 18, requires a licensed applications service provider or licensed content applications service provider offering a social media service likely to be accessed by child users to implement effective age verification measures so that only users whose ages have been identified as sixteen years or above may register for the service or access a feature of the service appropriate for their age.

The Code requires verification against records issued by the Government of Malaysia (National Registration Identity Card, passport, birth certificate, or another government-recognised document) or an equivalent record issued or recognised by a competent authority in another jurisdiction, and requires that any personal data collected for age verification be adequate, relevant, and limited to what is necessary, and not kept longer than necessary for that process, consistently with the Personal Data Protection Act 2010. The Code was published on 22 May 2026 and took effect on 1 June 2026.

Section 13(2)(a) excuses from the exclusive rights in section 13(1) any reproduction, communication to the public, or other controlled act done by way of fair dealing for the purposes of research, private study, criticism, review, or the reporting of news or current events, provided the title and authorship of the work are acknowledged, except that no acknowledgment is required for news or current events reported by sound recording, film, or broadcast.

Section 13(2A), added by the Copyright (Amendment) Act 2012 (Act A1420, in force 1 March 2012), directs that fairness turns on the purpose and character of the dealing (including whether it is commercial), the nature of the work, the amount and substantiality of the portion used, and the effect on the potential market for the work; the exception is not capped at a headline-length or short-extract threshold in the statute's own text, and no reported Malaysian decision applying it to a systematic news aggregator's reproduction of headlines and snippets, as distinct from a traditional press review, was located.

The Act carries no separate exclusion of the news of the day or of mere facts, and Malaysia has no press-publisher neighbouring right, compelled platform-to-publisher bargaining regime, recognised hot-news or misappropriation doctrine, or located case law on hyperlinking or framed display.