Malaysia

Act A1727 s.3 inserted a dedicated biometric data definition into s.4 (any personal data resulting from technical processing relating to a person's physical, physiological, or behavioural characteristics) and added biometric data to the sensitive personal data list immediately after the offence-related category.

Both a faceprint and a voiceprint fall squarely within physical, physiological, or behavioural characteristics resulting from technical processing, which is exactly how a voice or face embedding is produced. Both are now, in force, sensitive personal data under s.4, requiring explicit consent under s.40's stricter processing conditions. No biometric-specific retention or destruction duty distinct from the Act's general data-minimisation and accuracy principles was found.

Act A1727 s.6 inserts new Division 1A into Part II, requiring both the data controller and data processor to appoint a Data Protection Officer (s.12A) and, at s.12B, requiring the data controller to notify the Commissioner as soon as practicable on reasonable belief that a personal data breach occurred; where the breach causes or is likely to cause significant harm to the data subject, the controller must also notify the data subject without unnecessary delay.

No fixed numeric deadline is set in the statute itself; timing and form are left to the Commissioner's own prescribed manner. Non-compliance with the Commissioner-notification duty is itself an offence, carrying a fine up to RM250,000, imprisonment up to 2 years, or both. Before this amendment, Act 709 had no statutory breach-notification duty at all.

Act 709's lawful basis is a bifurcated consent model: ordinary personal data needs the data subject's consent, subject to contract, legal-obligation, and vital-interest exceptions (s.6), while sensitive personal data needs explicit consent under s.40's stricter conditions. Contravening any of the seven Data Protection Principles is itself an offence, carrying a fine up to RM300,000, imprisonment up to 2 years, or both (s.5(2)).

Act A1727 relabels data user as data controller throughout and, for the first time, imposes direct statutory duties on data processors, who were previously reached only through contract with the data user.

Section 1(2) leaves the base Act's own commencement to a Ministerial gazette notification rather than stating a date in the Act's own text; the Department of Personal Data Protection's own published determination fixes that date at 15 November 2013, and that is recorded here as the general commencement date, distinct from the 2024 amendment's own staged commencement dates, recorded separately.

The original s.129 barred transferring personal data outside Malaysia except to a place the Minister specified by gazette notification as having a substantially similar law or an adequate level of protection; in practice this whitelist mechanism was never gazetted, making the provision largely inoperative.

Act A1727 s.12 restructures s.129, replacing the Minister's gazetting power with the data controller's own self-assessment against the substantially similar law or adequate level of protection standard, and drops the alternative or that serves the same purposes as this Act language, narrowing the standard. There is no data-localization mandate.

Act A1727 s.9 added s.43A, giving a data subject the right to request the data controller transmit their personal data to another data controller of the subject's choice by written electronic notice, subject to technical feasibility and compatibility of the data format. The controller must complete the transmission within the period as may be prescribed, with no fixed statutory deadline; the specific period is left to subsidiary regulation not read.

The Personal Data Protection Commissioner is the supervisory authority. Enforcement is criminal and administrative: contravening any Data Protection Principle is an offence under the base Act's s.5(2) (fine up to RM300,000, imprisonment up to 2 years, or both), which came into force with the rest of the base Act on 15 November 2013, and the new s.12B(3) breach-notification offence, in force since 1 June 2025, carries a fine up to RM250,000, imprisonment up to 2 years, or both.

No private right of action provision was located in the sections read; enforcement is Commissioner-driven and criminal, not a statutory civil cause of action for the data subject, though the search was not exhaustive across the full base Act text.

Section 3 makes it an offence to cause a computer to perform a function with intent to secure access to a program or data held in any computer, where that access is unauthorised and the person knows at the time that it is unauthorised; the intent need not be directed at any particular program, data, or computer.

Section 2(5) defines access as unauthorised only where the person is not entitled to control access of that kind and does not have consent from, or exceeds a right or consent given by, a person who is so entitled.

Because the offence turns on whether the access itself is unauthorised rather than on the manner of access, reading a public, unauthenticated page without defeating any access control falls outside a plain reading of the provision, though no reported Malaysian decision addresses the point either way.

Sections 4 and 5 separately punish, at higher penalties, unauthorised access committed with intent to commit or facilitate a further offence, and unauthorised modification of the contents of a computer.

Section 13(2)(a) excuses, from the exclusive rights in section 13(1), any act done by way of fair dealing for the purposes of research, private study, criticism, review, or the reporting of news or current events, provided the title and authorship of the work are acknowledged, except that no acknowledgment is required for news or current events reported by sound recording, film, or broadcast.

Section 13(2A), inserted by the Copyright (Amendment) Act 2012 (Act A1420, in force 1 March 2012), directs that whether a dealing is fair turns on the purpose and character of the dealing including whether it is commercial or non-profit educational, the nature of the work, the amount and substantiality of the portion used, and the effect on the potential market for the work. Section 7(2A) excludes any idea, procedure, method of operation, or mathematical concept from copyright protection.

Section 7(3)(a) requires only that sufficient effort be expended to make a work original in character, with no separate exclusion of the news of the day or mere facts of the kind some other jurisdictions' copyright statutes carry.

Malaysia has no text-and-data-mining exception and no sui generis database right; reproducing or extracting a substantial part of a copyright work to train a model, or extracting a substantial part of a database's contents, therefore rests only on the general fair dealing ground above, where it can be characterised as research, and is not otherwise excused.

Section 18 of the Online Safety Act 2025 requires a licensed applications service provider or licensed content applications service provider to implement measures, specified in a code issued by the Commission, to ensure the safe use of its services by a child user, defined as a person under the age of eighteen years; subsection 18(3) requires that, for a service that is, in the provider's opinion, likely to be accessed by child users, those measures include safe design and operation to prevent a child's access to suspected harmful content, limit an identified adult's ability to communicate with an identified child, limit features that increase or sustain a child's use of the service, prevent an identified adult from viewing an identified child's personal information, and control personalised recommendation systems suitable for child users.

The Child Protection Code, issued by the Commission under section 80 read with section 18 and taking effect 1 June 2026, applies these duties to any applications service enabling communication between users and any content applications service, and adds content-moderation duties (detecting and removing harmful content, accessible reporting channels for child users, steps against repeated exposure to reported or removed content), a duty to make available parental control features, a duty to set privacy and safety settings to the highest level by default for child users and limit an unconnected adult's direct communication with a child user, and duties over search and recommendation systems.

Those duties include activating safe search by default. Separately, algorithmic recommendation does not display or promote harmful content to child users.

The Child Protection Code, issued by the Malaysian Communications and Multimedia Commission under section 80 of the Online Safety Act 2025 read with section 18, requires a licensed applications service provider or licensed content applications service provider offering a social media service likely to be accessed by child users to implement effective age verification measures so that only users whose ages have been identified as sixteen years or above may register for the service or access a feature of the service appropriate for their age.

The Code requires verification against records issued by the Government of Malaysia (National Registration Identity Card, passport, birth certificate, or another government-recognised document) or an equivalent record issued or recognised by a competent authority in another jurisdiction, and requires that any personal data collected for age verification be adequate, relevant, and limited to what is necessary, and not kept longer than necessary for that process, consistently with the Personal Data Protection Act 2010. The Code was published on 22 May 2026 and took effect on 1 June 2026.

Section 13(2)(a) excuses from the exclusive rights in section 13(1) any reproduction, communication to the public, or other controlled act done by way of fair dealing for the purposes of research, private study, criticism, review, or the reporting of news or current events, provided the title and authorship of the work are acknowledged, except that no acknowledgment is required for news or current events reported by sound recording, film, or broadcast.

Section 13(2A), added by the Copyright (Amendment) Act 2012 (Act A1420, in force 1 March 2012), directs that fairness turns on the purpose and character of the dealing (including whether it is commercial), the nature of the work, the amount and substantiality of the portion used, and the effect on the potential market for the work; the exception is not capped at a headline-length or short-extract threshold in the statute's own text, and no reported Malaysian decision applying it to a systematic news aggregator's reproduction of headlines and snippets, as distinct from a traditional press review, was located.

The Act carries no separate exclusion of the news of the day or of mere facts, and Malaysia has no press-publisher neighbouring right, compelled platform-to-publisher bargaining regime, recognised hot-news or misappropriation doctrine, or located case law on hyperlinking or framed display.