Malaysia PDPA
Personal Data Protection Act 2010 (Act 709), Malaysia — JPDP (Jabatan Perlindungan Data Peribadi, Malaysia)
Also known as: PDPA 2010, Act 709, Malaysia PDPA, Akta Perlindungan Data Peribadi
Official site Official change log Subscribe to Malaysia PDPA (RSS)
At a glance
- Current version
- Act 709 as amended by Act A1727 (final stage in force 1 June 2025)
- Published 1 June 2025. source
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Anyone who processes, or controls the processing of, personal data in respect of commercial transactions, if established in Malaysia or using equipment in Malaysia; the Federal and State Governments are excluded. source
- How it is assessed
- Controllers and processors appoint data protection officers, and controllers notify personal data breaches to the Commissioner, within 72 hours under the Commissioner's circular. source
- Authority
- An Act of the Malaysian Parliament administered by the Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi), under the Minister of Digital. source source
- Enforced by
- Breaching the data protection principles is a criminal offence punishable by up to RM1,000,000 or three years' imprisonment, and failing to notify a breach by up to RM250,000. source
- Last change
Malaysia's data protection statute, built on seven principles and a registration regime that makes certain classes of data user register with the Commissioner before processing at all. It carries a data protection officer duty, mandatory breach notification and direct obligations on data processors, and most of the operative detail sits in subsidiary regulations and sector codes of practice rather than in the Act itself.
Recent changes
-
Info
PDP publishes updated list of compounds under Personal Data Protection Act 2010
The Personal Data Protection Commission (PDP) Malaysia has released an updated list of compounds under the Personal Data Protection Act 2010 (Act 709). The list shows …
-
Medium
Personal Data Protection Act 2010 (Reprint) 2026 published
The Personal Data Protection Act 2010 (Act 709) has been republished in the 2026 reprint format in English language. This is the current version of the …
-
Medium
Akta 709 undergoes reprint
The Personal Data Protection Act 2010 (Akta 709) has undergone a reprint (cetakan semula) in 2026. This reprint is the latest official version of the act …
-
Info
PDP opens public consultation on AI framework and personal data protection
The Personal Data Protection Commissioner (PDP) has issued the first public consultation paper for 2026 discussing the framework for artificial intelligence and its implications for personal …
-
Info
PDP opens public consultation on personal data protection framework for AI
The Personal Data Protection Commission (PDP) of Malaysia opens public consultation regarding a framework governing personal data protection in the context of artificial intelligence systems. This …
-
Info
PDP opens public consultation on personal data protection framework and AI
Malaysia's Personal Data Protection Authority (PDP) has opened a public consultation on reimagining the personal data protection framework to address challenges and opportunities posed by artificial …
-
Medium
Personal Data Protection Act 2010 reprinted with amendment changes
The Personal Data Protection Act 2010 has been republished in the form of a 2026 reprint. This version consolidates all amendments that have been made to …
-
Medium
Personal Data Protection Act 2010 republished in latest reprint
The Personal Data Protection Act 2010 (Act 709) has been republished as the latest reprint in 2026. This republication consolidates data protection legislation in Malaysia in …
-
Info
PDP opens public consultation on AI framework and personal data protection
The Malaysian Personal Data Protection Commissioner (PDP) is opening a public consultation on AI framework and personal data protection. The consultation aims to gather input from …
-
Info
PDP launches public consultation on personal data protection framework
PDP has published Public Consultation Paper No. 1/2026 regarding the personal data protection framework. The document invites stakeholder feedback on regulatory approaches and data protection standards. …
-
Info
Peraturan Perlindungan Data Peribadi 2013 dipublisasikan
Peraturan Perlindungan Data Peribadi 2013 telah dipublisasikan oleh PDP Malaysia. Peraturan ini menetapkan rangka kerja komprehensif untuk perlindungan data peribadi di Malaysia. Organisasi yang mengendalikan data …
Key dates
No upcoming dates- Data protection officer, data breach notification and data portability duties take effect
- Processor security duty, higher penalties and new cross-border transfer rule take effect
- First provisions of the Personal Data Protection (Amendment) Act 2024 take effect
- Personal Data Protection (Amendment) Act 2024 (Act A1727) published in the Gazette
Amendments
-
Act 709 as amended by Act A1727 (final stage in force 1 June 2025) AmendmentCurrent text
Sections 6 and 9 of the Personal Data Protection (Amendment) Act 2024 took effect: data protection officers, data breach notification and data portability. source
More
- Controllers, and processors acting for them, must appoint one or more data protection officers and notify the Commissioner of the appointment (section 12A).
- Controllers must notify the Commissioner of a personal data breach as soon as practicable, and affected data subjects without undue delay where significant harm is likely (section 12B).
- Data subjects may ask a controller to transmit their personal data to another controller (section 43A).
-
Act A1727, second stage (1 April 2025) Amendment
Sections 2, 3, 4, 5, 8, 10 and 12 of Act A1727 took effect, renaming data users as data controllers and rewriting the cross-border transfer rule. source
More
- Biometric data became sensitive personal data, and deceased persons were excluded from the definition of data subject.
- Data processors must comply with the Security Principle, and the maximum penalty for breaching the data protection principles rose to RM1,000,000 or three years' imprisonment.
- The Minister's whitelist for transfers abroad was removed; a controller may transfer personal data to a place with substantially similar law or an adequate level of protection, or on one of the listed grounds (section 129).
-
Act A1727, first stage (1 January 2025) Amendment
Sections 7, 11, 13 and 14 of Act A1727 took effect, including service of documents by electronic means and savings for existing orders, guidelines and codes of practice. source
-
Personal Data Protection Act 2010 (Act 709) Major version
The Act received Royal Assent on 2 June 2010 and was published in the Gazette on 10 June 2010. source
Who it applies to
The Act covers commercial processing of personal data by anyone established in Malaysia or using equipment there, but not the Federal and State Governments.
- Commercial transactions
- It applies to anyone who processes, or has control over or authorises the processing of, personal data in respect of commercial transactions (section 2(1)). source
- Establishment
- The person must be established in Malaysia, or use equipment in Malaysia for processing other than for transit; the latter must nominate a representative established in Malaysia (section 2(2) and (3)). source
- Excluded
- The Act does not apply to the Federal Government and State Governments, or to data processed outside Malaysia unless intended for further processing in Malaysia (section 3). source
How compliance is assessed
Controllers and processors appoint data protection officers, and controllers notify personal data breaches to the Commissioner, within 72 hours under the Commissioner's circular.
- Data protection officer
- A data controller, and a processor processing on its behalf, must appoint one or more data protection officers, and the controller must notify the Commissioner (section 12A). source
- Breach notification
- Commissioner's Circular No. 2/2025 requires the controller to give the Commissioner the breach details within 72 hours of the personal data breach, and to inform affected data subjects within seven days after that notification where significant harm is likely. source
Enforcement and penalties
Breaching the data protection principles is a criminal offence punishable by up to RM1,000,000 or three years' imprisonment, and failing to notify a breach by up to RM250,000.
Up to RM1,000,000 or 3 years
Section 5(2), for contravening the Personal Data Protection Principles. source
Up to RM250,000 or 2 years
Section 12B(3), for failing to notify the Commissioner of a personal data breach. source
- Offences
- Contraventions are offences punishable on conviction; a data processor that breaches the Security Principle is liable to the same penalty as a controller (section 5(1A) and (2)). source
Documents
- Law text Akta Perlindungan Data Peribadi 2010 [Akta 709], cetakan semula 2026
- Law text Akta Perlindungan Data Peribadi (Pindaan) 2024 [Akta A1727]
- Law text P.U. (B) 522 — Appointment of date of coming into operation (bilingual)
- Guidance Pekeliling Pesuruhjaya Bil. 2 Tahun 2025 (Pemberitahuan Pelanggaran Data)
- Guidance Akta dan garis panduan (JPDP)
Frequently asked questions
When did Malaysia's PDPA amendments take effect?
In three stages: 1 January 2025, 1 April 2025 (processor duties, higher penalties, cross-border rule) and 1 June 2025 (data protection officers, breach notification and data portability). source
What is the maximum penalty under Malaysia's PDPA?
Up to RM1,000,000, imprisonment of up to three years, or both, for contravening the Personal Data Protection Principles (section 5(2)). source
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to Malaysia PDPA (RSS)