Part 1: Personal Data Protection (Amendment) Act 2024

To provide a comprehensive understanding of the recent changes, we will be publishing a series of articles on the Personal Data Protection (Amendment) Act 2024. This series will delve into the key amendments, concepts, their implications for businesses and individuals, and practical steps for compliance. Stay tuned for in-depth analyses and insights in the coming months.

Our article on the proposed amendments of the Personal Data Protection Act 2010 can be assessed here.

The Personal Data Protection (Amendment) Act 2024 in Malaysia will be enforced in three phases. The first phase commenced on January 1, 2025, followed by the second phase on April 1, 2025, and the final phase is scheduled for July 1, 2025.

The amendments are expected to align Malaysia data protection laws more closely to international standards. Below are the salient amendments in the Act.

Subject	Personal Data Protection Act 2010	Amendment Act 2024
Terminology for data user	originally referred to as "data user"	changed to "data controller"
Cross border data transfer	Transfers out to whitelisted countries were allowed with the data subject´s consent. There was no list of whitelist countries.	The whitelist regime for cross border data transfer has been removed. Transfers are allowed to countries with similar data protection laws, or adequate protections, excemptions still apply.
Penalties for a breach of personal data protection principles	penalties of up to RM 300,000 and/or imprisonment of 2 years	increased penalties of up to RM 1 million and/or imprisonment of 3 years
Biometric data as sensitive personal data	not addressed	Biometric data are considered sensitie and are defined as data derived from the technical processing of physical, physiological and behavioural characteristics.
Data subject´s right to data portability	no provision for data portability	The right to data portability is granted, subject to technical feasibility and data format compatibility.
Mandatory personal data breach notification	no requirement for breach notification	It is required to notify the Commissioner as well as affected individuals if the breach causes or is likey to cause siginficant harm the individual/s.
Obligations on data processors	no direct obligation on data processors	Data processors must adhere to security requirements and are subject to penalties for breaches.
Mandatory appointment of a Data Protection Officer (DPO)	no requirement	There is a new mandatory requirement to appoint a DPO.

From The Newsletter

Newsflash Malaysia

Contact

Contact Person Picture

Geetha Salva

+603 2276 5580

Send inquiry

How We Can Help

Rödl & Partner in Malaysia