Personal Data Protection Act 2010 · Updated to 15 Sep 2026 · Part X · Miscellaneous
129. Transfer of personal data to places outside Malaysia
Feedback & support(Deleted by Act A1727).
A data controller may transfer any personal data of a data subject to any place outside Malaysia if—
personal data
“personal data” means any information in respect of commercial transactions, which— (a) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with the intention that it should wholly or partly be processed by means of such equipment; or (c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data user, including any sensitive personal data and expression of opinion about the data subject; but does not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under the Credit Reporting Agencies Act 2010;
there is in that place in force any law which is substantially similar to this Act; or
that place ensures an adequate level of protection in relation to the processing of personal data which is at least equivalent to the level of protection afforded by this Act.
Notwithstanding subsection (2), a data controller may transfer any personal data to a place outside Malaysia if—
the data subject has given his consent to the transfer;
the transfer is necessary for the performance of a contract between the data subject and the data controller;
the transfer is necessary for the conclusion or performance of a contract between the data controller and a third party which—
is entered into at the request of the data subject;
or
is in the interests of the data subject;
the transfer is for the purpose of any legal proceedings or for the purpose of obtaining legal advice or for establishing, exercising or defending legal rights;
90
the data controller has reasonable grounds for believing that in all circumstances of the case—
the transfer is for the avoidance or mitigation of adverse action against the data subject;
it is not practicable to obtain the consent in writing of the data subject to that transfer; and
if it was practicable to obtain such consent, the data subject would have given his consent;
the data controller has taken all reasonable precautions and exercised all due diligence to ensure that the personal data will not in that place be processed in any manner which, if that place is Malaysia, would be a contravention of this Act; or
the transfer is necessary in order to protect the vital interests of the data subject.
(Deleted by Act A1727).
(Deleted by Act A1727).
A data controller who contravenes this section commits an offence and shall, on conviction, be liable to a fine not exceeding three hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
For the purposes of this section, “adverse action”, in relation to a data subject, means any action that may adversely affect the data subject’s rights, benefits, privileges, obligations or interests.
data subject
“data subject” means an individual who is the subject of the personal data;