Your personal data and a data breach

Who the Act covers

The Act applies to anyone who processes personal data in respect of commercial transactions, and to anyone who has control over or authorises that processing.

Personal Data Protection Act s 2(1)

The Act does not apply to the Federal Government or the State Governments. It does not apply to personal data processed outside Malaysia unless that data is intended to be further processed in Malaysia.

Personal Data Protection Act s 3(1), (2)

The 2024 amendments rename the data user as the data controller throughout the Act, with some exceptions.

Personal Data Protection (Amendment) Act s 2

The amending Act comes into operation on dates the Minister appoints by notification in the Gazette, and different provisions can start on different dates.

Personal Data Protection (Amendment) Act s 1(2)

Your consent

A data user must not process your personal data, other than sensitive personal data, without your consent, unless the processing is necessary for a contract you are a party to, for steps you asked for before entering a contract, for a legal obligation the data user has other than under a contract, to protect your vital interests, for the administration of justice, or for functions given to someone by law.

Personal Data Protection Act s 6(1), (2)

You can withdraw your consent by notice in writing, and the data user must then stop processing the data.

Personal Data Protection Act s 38(1), (2)

Seeing your data

You are entitled to be told by a data user whether it is processing personal data about you. You can make a data access request in writing, with the prescribed fee, for that information and for a copy of the data.

Personal Data Protection Act s 30(1), (2)

The data user must comply no later than 21 days from receiving the request. If it cannot, it must tell you in writing before then why not, comply as far as it can, and comply in full no later than 14 days after the 21 days end.

Personal Data Protection Act s 31

Correcting your data

If you consider that data you received after an access request is inaccurate, incomplete, misleading or not up to date, or you know that data held about you is, you can make a data correction request in writing.

Personal Data Protection Act s 34(1)

If the data user is satisfied the data needs correcting, it must correct it and give you a corrected copy no later than 21 days from receiving the request, subject to the exceptions in the Act.

Personal Data Protection Act s 35(1)

Stopping direct marketing

You can, at any time, by notice in writing, require a data user to stop, or not to begin, processing your personal data for direct marketing, at the end of a period that is reasonable in the circumstances.

Personal Data Protection Act s 43(1)

If the data user does not comply, you can apply to the Commissioner to require it to comply.

Personal Data Protection Act s 43(2)

After a data breach

A personal data breach means any breach of personal data, loss of personal data, misuse of personal data or unauthorised access of personal data.

Personal Data Protection (Amendment) Act s 3

A data controller that has reason to believe a breach has occurred must notify the Commissioner as soon as practicable, in the manner and form the Commissioner determines. Where the breach causes or is likely to cause significant harm to the person the data is about, the data controller must also notify that person without unnecessary delay.

Personal Data Protection (Amendment) Act s 6 (new s 12B)

A data controller that fails to notify the Commissioner commits an offence, punishable by a fine of up to 250,000 ringgit, imprisonment of up to 2 years, or both.

Personal Data Protection (Amendment) Act s 6 (new s 12B)

A data controller must also appoint one or more data protection officers, accountable to it for complying with the Act.

Personal Data Protection (Amendment) Act s 6 (new s 12A)

Moving your data

Under the Personal Data Protection (Amendment) Act, you can ask a data controller, by notice in writing given electronically, to transmit your personal data directly to another data controller of your choice, subject to technical feasibility and the compatibility of the data format.

Personal Data Protection (Amendment) Act s 9 (new s 43A)