Personal Data Protection Act 2010 · Updated to 15 Sep 2026 · Part X · Miscellaneous
130. Unlawful collecting, etc., of personal data
Feedback & supportA person shall not knowingly or recklessly, without the consent of the data controller—
collect or disclose personal data that is held by the data controller; or
procure the disclosure to another person of personal data that is held by the data controller.
Personal Data Protection 91
Subsection (1) shall not apply to a person who shows—
that the collecting or disclosing of personal data or procuring the disclosure of personal data—
was necessary for the purpose of preventing or detecting a crime or for the purpose of investigations; or
was required or authorized by or under any law or by the order of a court;
that he acted in the reasonable belief that he had in law the right to collect or disclose the personal data or to procure the disclosure of the personal data to the other person;
that he acted in the reasonable belief that he would have had the consent of the data controller if the data controller had known of the collecting or disclosing of personal data or procuring the disclosure of personal data and the circumstances of it; or
that the collecting or disclosing of personal data or procuring the disclosure of personal data was justified as being in the public interest in circumstances as determined by the Minister.
A person who collects or discloses personal data or procures the disclosure of personal data in contravention of subsection (1)
personal data
“personal data” means any information in respect of commercial transactions, which— (a) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with the intention that it should wholly or partly be processed by means of such equipment; or (c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data user, including any sensitive personal data and expression of opinion about the data subject; but does not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under the Credit Reporting Agencies Act 2010;
commits an offence.
A person who sells personal data commits an offence if he has collected the personal data in contravention of subsection (1).
A person who offers to sell personal data commits an offence if—
he has collected the personal data in contravention of subsection (1); or
he subsequently collects the personal data in contravention of subsection (1).
92
For the purposes of subsection (5), an advertisement indicating that personal data is or may be for sale is an offer to sell the personal data.
A person who commits an offence under this section shall, upon conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding three years or to both.