Regulations › Rest of world › Malaysia
PDPA (Malaysia)
Personal Data Protection Act 2010 (Malaysia)
WhenIn force since 2013; amended in 2024, with the DPO and breach rules applying from 1 June 2025
Who enforces itPersonal Data Protection Commissioner (JPDP)
Who it applies toData controllers and processors handling personal data in commercial transactions in Malaysia.
Tell the regulatorNotify the Commissioner as soon as practicable and within 72 hours of the breach
DPO requiredControllers and processors must appoint a DPO when processing data of over 20,000 subjects, se…
RegistrationPrescribed classes of controllers (banking, insurance, health, telecoms, education, real estat…
Transfers abroadTransfer allowed if destination law is substantially similar or protection equivalent, or unde…
Request deadlineComply with access and correction requests within 21 days, extendable by 14 days with written…
Maximum fineUp to RM1,000,000 (about USD 235k) and/or 3 years' imprisonment for breaching the data protect…
Data protection authority Personal Data Protection Department (JPDP)
- Address
- Level 8, Galeria PjH, Jalan P4W, Persiaran Perdana, Precinct 4, 62100 Putrajaya✓
- pesuruhjaya@pdp.gov.my ✓
- Complaints
- aduan@pdp.gov.my ✓
- Phone
- +60 3 7456 3888 +60 3 8000 8000 +60 3 8861 4200 ✓
- Website
- pdp.gov.my/ppdpv1
- Register
- Registration portal✓
- Breaches
- Report a breach✓
Checked 18 Oct 2026. ✓ confirmed on the authority's own site. Report a change
Local help in Malaysia
Law firms, training centers and other providers in Malaysia can apply to be listed here. We check each one before it shows.
List your organizationRegulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws