Section 4
Section 5 of the principal Act is amended—
of Personal Data Protection (Amendment) Act 2024
(a)
by inserting after subsection (1) the following subsection:
“(1a) Where the processing of personal data is carried out by a data processor on behalf of the data controller, the data processor shall comply with the Security Principle as specified in section 9.”; and
Personal Data Protection (Amendment)
(b)
in subsection (2)—
(i)
by inserting after the words “subsection (1)”
the words “or a data processor who contravenes subsection (1a)”; and
(ii)
by substituting for the words “three hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both” the words
“one million ringgit or to imprisonment for a term not exceeding three years or to both”.
Amendment of section 9