Regulations › Rest of world › Malaysia
PDPA (Malaysia)
Personal Data Protection Act 2010 (Malaysia)
WhenIn force since 2013; amended in 2024, with the DPO and breach rules applying from 1 June 2025
Who enforces itPersonal Data Protection Commissioner (JPDP)
Who it applies toData controllers and processors handling personal data in commercial transactions in Malaysia.
Tell the regulatorNotify the Commissioner as soon as practicable and within 72 hours of the breach
DPO requiredControllers and processors must appoint a DPO when processing data of over 20,000 subjects, se…
RegistrationPrescribed classes of controllers (banking, insurance, health, telecoms, education, real estat…
Transfers abroadTransfer allowed if destination law is substantially similar or protection equivalent, or unde…
Request deadlineComply with access and correction requests within 21 days, extendable by 14 days with written…
Maximum fineUp to RM1,000,000 (about USD 235k) and/or 3 years' imprisonment for breaching the data protect…
67%
of Malaysia's 21 requirements are already met by European Union (GDPR). Here is what PDPA (Malaysia) adds, biggest gaps first.
Lawful basisReach and lawful basisBig gap
GDPR1 Six lawful bases, including consent, contract, legal obligation, vital interests, public task and legitimate interests.
PDPA (Malaysia) adds3 Consent is the general rule; non-consent processing only where necessary for contract, legal obligation, vital interests, justice and similar listed grounds.
s.6(1)-(2) · source ↗
RegistrationGovernanceBig gap
GDPR0 No general registration; controllers communicate DPO contact details to the supervisory authority.
PDPA (Malaysia) adds2 Prescribed classes of controllers (banking, insurance, health, telecoms, education, real estate and others) must register and renew certificates with fees.
ss.14-16; Class of Data Users Order · source ↗
Criminal liabilityEnforcementBig gap
GDPR1 Member States set other penalties, including criminal penalties, for infringements not subject to administrative fines.
PDPA (Malaysia) adds3 Most breaches are criminal offences with imprisonment; directors and officers are jointly liable unless they prove due diligence.
ss.5(2), 16(4), 40(3), 133 · source ↗
ConsentReach and lawful basisGap
GDPR2 Consent must be freely given, specific, informed and unambiguous by clear affirmative action, and the controller must be able to demonstrate it.
PDPA (Malaysia) adds3 Consent must be obtained in a form that can be recorded and maintained by the data controller.
PDP Regulations 2013 reg. 3 · source ↗
ChildrenReach and lawful basisGap
GDPR2 Parental consent required for information society services offered to children under 16; Member States may lower the age to no less than 13.
PDPA (Malaysia) adds3 For data subjects under 18, a parent, guardian or person with parental responsibility acts and consents.
s.4 ('relevant person') · source ↗
DPO qualificationsGovernanceGap
GDPR1 DPO chosen for professional qualities, especially expert knowledge of data protection law and practice; no certification required.
PDPA (Malaysia) adds2 No minimum qualification; DPO must be in Malaysia 180 days a year or easily contactable and proficient in Malay and English; register within 21 days.
DPO Guideline paras 5.4, 6.10, 7.1 · source ↗
RetentionGovernanceGap
GDPR1 Storage limitation: keep identifiable data no longer than necessary; erase when no longer needed.
PDPA (Malaysia) adds2 Do not keep data longer than necessary and take reasonable steps to destroy or permanently delete it.
s.10(1)-(2) · source ↗
Already covered by GDPR: Reach abroad, Sensitive data, Rights, Request deadline, Marketing, DPO required, DPIA, Records, Tell the regulator, Tell people, Transfers abroad, Localization, Maximum fine, Private action.
A gap means PDPA (Malaysia) is more demanding than GDPR on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws