Personal Data Protection Act 2010 · Updated to 15 Sep 2026 · Part IV · Appointment, Functions and Powers of Commissioner
48. Functions of Commissioner
Feedback & supportThe Commissioner shall have the following functions:
Commissioner
“Commissioner” means the Personal Data Protection Commissioner appointed under section 47;
to advise the Minister on the national policy for personal data protection and all other related matters;
Minister
“Minister” means the Minister charged with the responsibility for the protection of personal data;
to implement and enforce the personal data protection laws, including the formulation of operational policies and procedures;
personal data
“personal data” means any information in respect of commercial transactions, which— (a) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with the intention that it should wholly or partly be processed by means of such equipment; or (c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data user, including any sensitive personal data and expression of opinion about the data subject; but does not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under the Credit Reporting Agencies Act 2010;
to promote and encourage associations or bodies representing data controllers to prepare codes of practice and to disseminate to their members the codes of practice for the purposes of this Act;
this Act
“this Act” includes regulations, orders, notifications and other subsidiary legislation made under this Act;
52
to cooperate with bodies corporate or government agencies for the purpose of performing his functions;
(Deleted by Act A1727);
to undertake or cause to be undertaken research into and monitor developments in the processing of personal data, including technology, in order to take account any effects such developments may have on the privacy of individuals in relation to their personal data;
processing
“processing”, in relation to personal data, means collecting, recording, holding or storing the personal data or carrying out any operation or set of operations on the personal data, including— (a) the organization, adaptation or alteration of personal data; (b) the retrieval, consultation or use of personal data; (c) the disclosure of personal data by transmission, transfer, dissemination or otherwise making available; or (d) the alignment, combination, correction, erasure or destruction of personal data;
to monitor and supervise compliance with the provisions of this Act, including the issuance of circulars, enforcement notices or any other instruments to any person;
to promote awareness and dissemination of information to the public about the operation of this Act;
to liaise and cooperate with persons performing similar personal data protection functions in any place outside
Malaysia in respect of matters of mutual interest, including matters concerning the privacy of individuals in relation to their personal data;
to represent Malaysia through participation in events that relate to personal data protection as authorized by the
Minister, whether within or outside Malaysia; and
to carry out such activities and do such things as are necessary, advantageous and proper for the administration of this Act, or such other purposes consistent with this
Act as may be directed by the Minister.