Part 2: Personal Data Protection (Amendment) Act 2024

      

The term ‘data controller’ in the Act replaces ‘data user’. This term refers to those who processes any personal data or has control over or authorises the processing of any personal data.

     

Data processor refers to those who process personal data on behalf of data controller. Data processors are now obliged to take steps to protect personal data from loss, misuse, unauthorised access and other risks.

    

Data controllers and data processors must designate a Data Protection Officer (‘DPO’). It is mandatory to appoint a DPO under the Act. The DPO will be accountable to the data controller and data processor for ensuring the organisation observance to the Personal Data Protection Act.

      

Data controllers must promptly notify the Personal Data Protection Commissioner of any data breach failure  of notification will attract a fine or imprisonment or both.

      

The Act now has included biometric data and it is classified as sensitive personal data which previously was excluded. 

     

Individuals are now able to request for their data to be transferred to another service, this will be subject to the technical feasibility. 

      

Data can be transferred to countries with adequate protection laws. This facilitates the protection of international data transfer. The Whitelist  regime has been removed.

     

There has been an increase of the penalties for breach of personal data protection principles up to RM1million and/ or three years of imprisonment.