40. Processing of sensitive personal data
Feedback & supportIn plain English
A data user must not process a person's sensitive personal data except under certain conditions. These include the person's explicit consent, or a need tied to employment duties, medical purposes, legal proceedings or protecting vital interests. Breaking this rule is an offence, with a fine not exceeding two hundred thousand ringgit, imprisonment not exceeding two years, or both.
Summary · Drafted with AI, checked against the official text on 30 Sep 2026.