PDPA amendment 2024: what changed in Malaysia’s Personal Data Protection Act

What the PDPA amendment 2024 is

The Personal Data Protection Act 2010 (Act 709) is Malaysia’s main privacy law for personal data processed in commercial transactions. It was largely unchanged for over a decade. The Personal Data Protection (Amendment) Act 2024, published as Act A1727, received Royal Assent on 9 October 2024 and was gazetted on 17 October 2024.

The amending Act is short: 14 sections. But it changes who is accountable, what has to be reported, and how much a contravention can cost. It also gave the Personal Data Protection Commissioner the basis to issue a set of new guidelines in 2025 and 2026, and those guidelines carry most of the practical detail.

The PDPA still does not apply to the Federal and State Governments, and it still covers only personal data processed in respect of commercial transactions. The amendment also clarifies that a “data subject” does not include a deceased individual.

Commencement phases: when each change started

The Act let the Minister of Digital bring provisions into force on different dates. The appointment order, P.U.(B) 522, dated 19 December 2024 and gazetted on 24 December 2024, set three dates:

All three phases are now in force. If your privacy notices, contracts or policies were last updated before April 2025, they almost certainly use old terms and miss the new duties.

New terms: data controller, biometric data and personal data breach

Throughout the Act, “data user” is replaced with data controller: the person who processes personal data, or controls or authorises its processing. A data processor is still someone, other than the controller’s own employee, who processes the data solely on the controller’s behalf.

Biometric data is now defined as personal data resulting from technical processing relating to the physical, physiological or behavioural characteristics of a person, and it is added to the list of sensitive personal data. Fingerprint attendance systems, face recognition at gates and voice authentication all fall here. Sensitive data generally needs explicit consent or another condition the Act allows, so check that every biometric system has one and that its records are classed correctly.

The Act also defines a personal data breach as any breach, loss or misuse of personal data, or unauthorised access to it. This definition is what triggers the new breach notification duty.

The PDPA and the 2024 Amendments lesson walks through these terms with workplace examples, and the staff-level Personal Data & PDPA lesson covers everyday handling.

Data processor duties and higher penalties

Before the amendment, only the data user answered for a processor’s security failings. Now the Act says that where a processor processes personal data on a controller’s behalf, the processor must comply with the Security Principle in section 9 itself. A processor that fails to do so commits an offence under section 5(2), on the same terms as a controller.

The penalty for contravening the personal data protection principles under section 5(2) rose from a fine of up to RM300,000 and/or 2 years’ imprisonment to a fine of up to RM1 million and/or up to 3 years’ imprisonment.

For controllers, this does not reduce accountability. You still choose, contract with and supervise your processors. What changes is the leverage: processors now carry their own legal exposure, which makes security clauses, audit rights and breach notice terms easier to negotiate. See Processors, Contracts and Transfers for the clauses that matter.

DPO, breach notification and data portability

Section 6 of the amending Act inserted a new Division 1A, “Accountability of personal data”, into the PDPA.

• Data protection officer (section 12A). A data controller must appoint one or more DPOs, accountable to it for compliance with the Act, and notify the Commissioner of the appointment. A processor acting for a controller must appoint its own DPO. The Commissioner’s DPO guideline makes the duty mandatory above set thresholds. Details: Data protection officer in Malaysia.
• Breach notification (section 12B). A controller that has reason to believe a personal data breach has occurred must notify the Commissioner as soon as practicable, and must notify affected data subjects without unnecessary delay where the breach causes or is likely to cause significant harm. Failing to notify the Commissioner is an offence carrying a fine of up to RM250,000 and/or up to 2 years’ imprisonment. The guideline sets a 72-hour outer limit. Details: Data breach notification in Malaysia.
• Data portability (section 43A). A data subject may ask a controller, in writing by electronic means, to transmit their personal data directly to another controller of their choice. The right is subject to technical feasibility and compatibility of the data format, and the controller must complete the transmission within the prescribed period. The Commissioner has issued a guideline on this right; check it for the current timelines.

Cross-border transfer change: the whitelist is gone

Under the old section 129, personal data could only go abroad to places the Minister had specified in the Gazette (the “whitelist”), unless one of the listed exceptions applied. The amendment removes that system.

A data controller may now transfer personal data to any place outside Malaysia that has a law substantially similar to the PDPA, or that ensures an adequate level of protection at least equivalent to it. The listed exceptions remain, such as the data subject’s consent, performance of a contract, legal proceedings, the data subject’s vital interests, and the controller having taken all reasonable precautions and exercised due diligence.

The Commissioner’s Cross Border Personal Data Transfer Guideline (29 April 2025) explains how to rely on these conditions: a transfer impact assessment (TIA) for the first two, with results valid for no more than three years; binding corporate rules, standard contractual clauses or certification as due-diligence mechanisms; and a record of every transfer outside Malaysia.

What to do now: a compliance checklist

1. Update documents. Replace “data user” with “data controller” in privacy notices, policies and contracts, and add the DPO’s business contact details.
2. Reclassify biometric data as sensitive, and confirm the legal basis for each biometric system.
3. Check the DPO thresholds and, if they apply, appoint and register the DPO.
4. Rewrite processor contracts to require security controls, prompt breach notice to you and help with requests.
5. Build a breach response plan with a 72-hour clock, a significant-harm test and a breach register, then rehearse it.
6. Map transfers abroad, pick the condition you rely on for each, run TIAs where needed and keep transfer records.
7. Prepare for portability requests: who receives them, which data is in scope, and what format you can export.
8. Review the 2026 guidelines. On 30 April 2026 the Commissioner issued guidelines on data protection impact assessments, data protection by design, and automated decision-making and profiling. Add them to your programme.
9. Train people. Staff need the basics; the DPO team needs the detail.

The Data Protection Officer topic on WorkQuest2U covers each step in short 3D lessons, including a breach tabletop drill you play through hour by hour.