Skip to content
In forceUpdated to 15 Sep 2026Read it in Bahasa Malaysia

40. Processing of sensitive personal data

Feedback & support

In plain English

A data user must not process a person's sensitive personal data except under certain conditions. These include the person's explicit consent, or a need tied to employment duties, medical purposes, legal proceedings or protecting vital interests. Breaking this rule is an offence, with a fine not exceeding two hundred thousand ringgit, imprisonment not exceeding two years, or both.

Summary · Drafted with AI, checked against the official text on 30 Sep 2026.

Report

Part III

Exemption

Part IV

Appointment, Functions and Powers of Commissioner

Part V

Personal Data Protection Fund

Part VI

Personal Data Protection Advisory Committee

Part VII

Appeal Tribunal

Part VIII

Inspection, Complaint and Investigation

Part IX

Enforcement

Part X

Miscellaneous

Part XI

Savings and Transitional Provisions