Personal Data Protection Act 2010 · Updated to 15 Sep 2026 · Part VIII · Inspection, Complaint and Investigation
108. Enforcement notice
Feedback & supportWhere, following the completion of an investigation about an act, practice or request specified in the complaint, the
Commissioner is of the opinion that the relevant data controller—
Commissioner
“Commissioner” means the Personal Data Protection Commissioner appointed under section 47;
is contravening a provision of this Act; or
has contravened such a provision in circumstances that make it likely that the contravention will continue or be repeated,
76
then the Commissioner may serve on the relevant data controller an enforcement notice—
stating that he is of that opinion;
specifying the provision of this Act on which he has based that opinion and the reasons why he is of that opinion;
directing the relevant data controller to take such steps as are specified in the enforcement notice to remedy the contravention or, as the case may be, the matters occasioning it within such period as is specified in the enforcement notice; and
directing, where necessary, the relevant data controller to cease processing the personal data pending the remedy of the contravention by the relevant data controller.
In deciding whether to serve an enforcement notice, the
Commissioner shall consider whether the contravention or the matter to which the enforcement notice relates has caused or is likely to cause damage or distress to the data subject of the personal data to which the contravention or matter relates.
data subject
“data subject” means an individual who is the subject of the personal data;
The steps as specified in the enforcement notice to remedy the contravention or matter to which the enforcement notice relates may be framed—
to any extent by reference to any approved code of practice; or
so as to afford the relevant data controller a choice between different ways of remedying the contravention or matter.
The period specified in the enforcement notice under subsection (1) for taking the steps specified in it shall not expire before the end of the period specified in subsection 93(2) within which an appeal against the enforcement notice may be made and, if such an appeal is made, those steps need not be taken pending the determination or withdrawal of the appeal.
Personal Data Protection 77
personal data
“personal data” means any information in respect of commercial transactions, which— (a) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with the intention that it should wholly or partly be processed by means of such equipment; or (c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data user, including any sensitive personal data and expression of opinion about the data subject; but does not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under the Credit Reporting Agencies Act 2010;
Notwithstanding subsection (4), if the Commissioner is of the opinion that by reason of special circumstances the steps specified in the enforcement notice should be taken as a matter of urgency—
he may include a statement to that effect in the enforcement notice together with the reasons why he is of that opinion;
and
where such a statement is so included, subsection (4) shall not apply but the enforcement notice shall not require those steps to be taken before the end of the period of seven days from the date on which the enforcement notice was served.
An appeal may be made to the Appeal Tribunal against an enforcement notice by the relevant data controller in accordance with section 93.
Where the Commissioner—
forms an opinion referred to in subsection (1) in respect of the relevant data controller at any time before the completion of an investigation; and
is also of the opinion that, by reason of special circumstances, an enforcement notice should be served on the relevant data controller as a matter of urgency, he may so serve the enforcement notice notwithstanding that the investigation has not been completed and, in any such case—
the Commissioner shall, without prejudice to any other matters to be included in the enforcement notice, specify in the enforcement notice the reasons as to why he is of the opinion referred to in paragraph (b); and
the other provisions of this Act, including this section, shall be construed accordingly.
A person who fails to comply with an enforcement notice commits an offence and shall, on conviction, be liable to a fine not exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
78