Malaysia's Personal Data Protection Act 2010 was amended in 2024, and the changes came into force in stages during 2025. For many startups and SMEs, the amendments turned data protection from something mentioned in a privacy notice into a set of concrete obligations with real deadlines.
This article summarises the changes most relevant to smaller businesses. It is a general overview rather than legal advice, so check the specific requirements that apply to your business.
Data users are now data controllers, and processors are accountable too
The amended Act replaces the term "data user" with "data controller". More importantly, the security principle now applies directly to data processors, meaning the companies that handle personal data on someone else's behalf. If you provide software, hosting, payroll, marketing or other services that involve your clients' customer data, you now carry your own legal responsibility for keeping it secure.
Breach notification has strict timelines
Since 1 June 2025, data controllers must notify the Personal Data Protection Commissioner of a personal data breach no later than 72 hours after becoming aware of it. Where the breach causes or is likely to cause significant harm to the people affected, they must also be notified, without unnecessary delay and no later than seven days after the notification to the Commissioner.
Significant harm includes breaches that could lead to financial loss or identity fraud, those that involve sensitive personal data, and those where the data could be misused for illegal purposes. A breach affecting more than 1,000 people must be reported to the Commissioner even if it does not meet the significant harm test. Controllers must also keep a record of all breaches, including minor ones, for at least two years.
Seventy-two hours is a short window. A business that has never thought about how it would detect, investigate and report a breach will struggle to meet it.
Some organisations must appoint a data protection officer
Data controllers and processors must appoint a data protection officer where they process personal data on a large scale. Under the Commissioner's guidelines, this includes processing the personal data of more than 20,000 people, the sensitive personal data of more than 10,000 people, or activities that involve regular and systematic monitoring. The officer's contact details must be registered with the Commissioner.
Many small businesses will fall below these thresholds, but growing companies can cross them sooner than they expect, particularly consumer apps, platforms and businesses that handle financial or health information.
Penalties are higher
The maximum penalty for breaching the personal data protection principles rose to a fine of up to RM1 million, imprisonment of up to three years, or both. Beyond the legal penalty, a reported breach affects client confidence, which for a smaller business can be the larger cost.
Other changes worth knowing
- Biometric data is now classed as sensitive personal data.
- Individuals have a new right to data portability, where technically feasible.
- The previous whitelist approach to cross-border transfers was replaced. Personal data can be transferred to countries with laws substantially similar to the PDPA, or that provide an equivalent level of protection.
What smaller businesses should do now
- List the personal data you hold, where it is stored and which suppliers can access it.
- Check whether you act as a controller, a processor or both, and update contracts with clients and suppliers accordingly.
- Write a simple breach response plan that names who decides, who investigates and who notifies, so the 72-hour deadline is achievable.
- Start a breach register, even if it is empty.
- Check whether you meet the thresholds for appointing a data protection officer, and record your reasoning if you do not.
- Review your privacy notice so it reflects what you actually collect and why.
None of this requires a large compliance team. It does require someone to take ownership and put the basics in writing before an incident forces the issue. If you would like a second opinion on where your business stands, a fractional data protection officer or a short review can help you prioritise.