Data protection officer Malaysia: who must appoint one and what the DPO does

What a data protection officer is under the PDPA

A data protection officer (DPO) is the person an organisation appoints to advise it on handling personal data lawfully, to monitor its compliance with the Personal Data Protection Act 2010, and to act as the contact point for data subjects and the Personal Data Protection Commissioner.

The legal duty comes from the PDPA amendment 2024. New section 12A says a data controller shall appoint one or more DPOs who are accountable to it for compliance with the Act, and must notify the Commissioner of the appointment. Where a data processor processes data on a controller’s behalf, the processor must appoint its own DPO. Section 12A(4) adds that appointing a DPO does not discharge the controller or processor from any of its own duties. The DPO advises; the organisation remains responsible.

Section 12A came into force on 1 June 2025. The Commissioner’s Guideline on Appointment of Data Protection Officer, issued in February 2025, sets out when the duty applies and what the role should look like.

Who must appoint a DPO: the thresholds

Under the DPO guideline, a controller or processor must appoint a DPO if its processing involves any one of these:

Each trigger stands alone. A company with 15,000 customers is under the first threshold, but if it holds bank account details for 12,000 of them, or runs systematic monitoring such as location tracking or CCTV analytics, it is caught. Count employees, job applicants and contractors as well as customers: they are all data subjects.

Note that “financial information” counts towards the 10,000 threshold even though it is not one of the sensitive data categories in the Act. Sensitive personal data under the Act covers physical or mental health, political opinions, religious or similar beliefs, the commission or alleged commission of offences, and, since April 2025, biometric data.

Below the thresholds, appointing a DPO is not mandatory, but someone still has to run PDPA compliance. Many organisations name a privacy lead anyway.

Who can be the DPO: skills, language and residency

The guideline sets no minimum professional qualification, but expects the DPO to have a sound level of skills and expertise matched to the complexity, scale and sensitivity of the processing. In practice that means:

• knowledge of the PDPA and data protection practice in Malaysia;
• understanding of the organisation’s business and how it processes personal data;
• understanding of information technology and data security;
• integrity and high professional ethics, and the ability to build a data protection culture.

The DPO must be proficient in Bahasa Melayu and English, and must be resident in Malaysia (physically present for at least 180 days in a calendar year) or easily contactable by any means.

The role must be independent enough to work. The guideline expects the DPO to have direct access to senior management, and protects a DPO from dismissal for performing DPO duties in good faith. That protection does not cover misconduct, negligence or breaches of the law. Avoid giving the role to someone whose other job creates a conflict, such as the person who decides how marketing data is used, without safeguards.

In-house vs outsourced DPO

The DPO can be an existing employee or provided through an outsourced service under a service contract. If the contract is with a firm, it should name an individual as the person in charge. One individual may act as DPO for more than one organisation, for example across a group, if they remain easily accessible to each.

Whichever you choose, the organisation remains accountable. A common model is an in-house DPO supported by external counsel for difficult questions.

Registering and publishing the DPO

Section 12A(3) requires the controller to notify the Commissioner of the appointment in the manner the Commissioner decides. Under the guideline:

1. Register within 21 days of the appointment, with the DPO’s business contact details, through the Department of Personal Data Protection (JPDP) online registration system. JPDP publishes a DPO registration guide and user manual.
2. Update within 14 days if the DPO changes or their business contact details change.
3. Set up a dedicated business email for the DPO role, separate from personal and ordinary work accounts, and monitor it constantly.
4. Publish the contact details on your website and other official media, in your personal data protection notices, and/or in your security policies and guidelines.
5. Keep records of the appointment so you can show compliance. When a DPO leaves, put an interim arrangement in place to watch the DPO mailbox and appoint a replacement within a reasonable time.

DPO responsibilities in practice

The guideline lists the DPO’s core responsibilities: inform and advise the organisation on processing; monitor and assist with compliance; assess the risks of processing operations; support data protection impact assessments; assist with breach notifications to the Commissioner; facilitate communication with data subjects; and act as liaison with the Commissioner.

Turned into a working year, that usually means:

• a data map of what personal data you hold, where it flows and who owns it (Data Mapping and Records);
• privacy notices in BM and English, and a working process for access, correction and portability requests;
• vendor and transfer checks, including transfer impact assessments for data sent abroad;
• impact assessments for new systems, in line with the Commissioner’s 2026 DPIA guideline;
• a breach response plan that meets the 72-hour notice to the Commissioner (see data breach notification), rehearsed at least once a year;
• an awareness programme for staff and a regular report to the board (Culture, Training, Audits and Board Reporting).

Common mistakes when appointing a DPO

• Counting only customers. Staff, former staff, applicants, contractors and visitors captured on CCTV are data subjects too, and often push an organisation over a threshold.
• Naming a DPO on paper only. A title with no time, budget or access to management fails the independence the guideline expects.
• Using a personal mailbox. The guideline expects a dedicated, monitored DPO business email that survives staff changes.
• Forgetting the 14-day update. When the DPO resigns or moves role, the registration goes stale unless someone owns the update.
• Treating the DPO as the accountable party. Under section 12A(4) the organisation keeps its duties. Board and senior management still own the risk.
• Skipping processors. If you run a shared service or process data for clients, check whether you need your own DPO as a processor.

Training for a new DPO

The Data Protection Officer topic on WorkQuest2U follows the job in order: The Data Protection Officer Role (thresholds, outsourcing, independence, registration), the law and principles, building the programme, rights and requests, breaches, special areas such as CCTV and marketing, and a capstone, Your First 90 Days as DPO. The breach module includes a tabletop drill you play through in a 3D scene.

There are two certificates: Data Protection Essentials for privacy champions and support staff, and Data Protection Officer for the person running the programme. These are WorkQuest2U certificates of completion. The Commissioner may set DPO qualification requirements separately, so check the latest guideline.