Personal Data Protection Act (Malaysia)

The Personal Data Protection Act 2010 (PDPA) is Malaysia's primary data protection law, regulating how organisations collect, process and disclose personal data of individuals in commercial transactions. It is administered by the Personal Data Protection Commissioner under the department responsible for digital affairs, and alongside sector rules from Bank Negara Malaysia and the Ministry of Health it forms the backbone of Malaysia's approach to governing AI systems that consume personal data.^[1]

Background

The PDPA came into force on 15 November 2013, built on seven principles: general, notice and consent, disclosure, security, retention, data integrity, and data subject rights (including a restriction on transferring personal data outside Malaysia except to jurisdictions with comparable protection). For its first decade it operated without mandatory breach reporting — a gap that became untenable as Malaysia's digital economy, and the volume of personal data processed by AI systems, expanded sharply through the 2020s.^[1]

The 2024 Amendments

Parliament passed the Personal Data Protection (Amendment) Act 2024, implemented in phases on 1 January 2025, 1 April 2025 and 1 June 2025. The most consequential changes for AI-era compliance took effect in that final phase:^[2]

• Data Protection Officers (DPOs): data controllers and processors meeting the statutory threshold must appoint at least one DPO and notify the Commissioner of the appointment within 21 days.
• Data breach notification: a controller that suffers a breach likely to cause significant harm must notify the Commissioner as soon as practicable and within 72 hours of becoming aware of it, and notify affected individuals without unnecessary delay and within seven days of notifying the Commissioner.
• Data portability and direct obligations on data processors, plus strengthened penalties — the amendment raised maximum fines for serious offences to RM10 million.^[2]

The Commissioner also issued supporting guidelines in 2025 on data breach notification, DPO appointment and cross-border transfers (the CBPDT Guidelines), replacing the old whitelisting approach with an accountability model: the exporting controller must ensure the overseas recipient offers protection comparable to the PDPA, typically by contract.^[3]

Why It Matters for AI

AI systems process personal data at every stage — training corpora, retrieval indexes, prompt logs and model outputs. Three amendments bite directly on AI operations: breach notification applies when an LLM provider or RAG index leaks customer records; DPOs give organisations a named accountable owner for model governance; and the cross-border rules determine where Malaysian personal data may be sent for cloud inference, a routine architectural decision for any team using offshore model APIs.^[4] The PDPA contains no AI-specific chapter — that role is filled by the Malaysia AI Governance Framework and sector guidance — but compliance with the PDPA remains the default legal floor for every deployed model touching user data.

>See Also

• PDPA AI Compliance
• AI Regulation in Malaysia
• Malaysia AI Governance Framework
• GDPR
• AI Guardrails