PDPA (Malaysia)

Personal Data Protection Act 2010 (Malaysia)

In force privacy

WhenIn force since 2013; amended in 2024, with the DPO and breach rules applying from 1 June 2025

Who enforces itPersonal Data Protection Commissioner (JPDP)

Who it applies toData controllers and processors handling personal data in commercial transactions in Malaysia.

Tell the regulatorNotify the Commissioner as soon as practicable and within 72 hours of the breach DPO requiredControllers and processors must appoint a DPO when processing data of over 20,000 subjects, se… RegistrationPrescribed classes of controllers (banking, insurance, health, telecoms, education, real estat… Transfers abroadTransfer allowed if destination law is substantially similar or protection equivalent, or unde… Request deadlineComply with access and correction requests within 21 days, extendable by 14 days with written… Maximum fineUp to RM1,000,000 (about USD 235k) and/or 3 years' imprisonment for breaching the data protect…

Malaysia's data protection law, amended in 2024. Data protection officer appointment and breach notice to the Commissioner within 72 hours apply from 1 June 2025.

67% coveredif you already meet GDPR. 7 requirements to work on.See the gap → 4 of 21requirements scored most demanding, each cited to the law.See all 21 → 149 sectionsindexed by topic, each linked to the official text.Read section by section →

The Association's practitioner brief for this law is on the way; the priority laws come first.

Read the official text

Recent developments

Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.

Sources

Text of the law JPDP · Official text or regulator

Dates and status checked against these sources on 18 October 2026. This page explains the law for practitioners; it is not legal advice.

Data protection authority Personal Data Protection Department (JPDP)

Address: Level 8, Galeria PjH, Jalan P4W, Persiaran Perdana, Precinct 4, 62100 Putrajaya✓
Email: pesuruhjaya@pdp.gov.my ✓
Complaints: aduan@pdp.gov.my ✓
Phone: +60 3 7456 3888 +60 3 8000 8000 +60 3 8861 4200 ✓
Website: pdp.gov.my/ppdpv1
Register: Registration portal✓
Breaches: Report a breach✓

Checked 18 Oct 2026. ✓ confirmed on the authority's own site. Report a change

Local help in Malaysia

Law firms, training centers and other providers in Malaysia can apply to be listed here. We check each one before it shows.

List your organization

102 laws in plain words. Free. Associate Membership is free and open to anyone in this work or moving into it. Join free as Associate

Browse the library

US states 40 Rest of world 37 European Union 12 US federal 12 United Kingdom 1

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the map Follow Regulatory Watch

In force
Coming into force
Sector laws

AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL