Key Takeaways – Malaysia PDPA (Amendment) 2024
Personal Data Protection Act (Amendment) 2024 has been passed in the Malaysian Parliament since July 2024. In brief, the PDPA 2010 [Act 709] applies to personal data in commercial transactions. This includes any commercial transaction involving the supply or exchange of goods or services, agency, investment, financing, banking, and insurance, but excludes credit reporting businesses under the Credit Reporting Agencies Act 2010. One of the key highlights of the amendment is the appointment of the Data Protection Officer (DPO).
Data Controller vs Data Processor
A company which is data controller or data processor, or both requires to appoint DPO based on the guideline of the appointment. Firstly, a “Data Controller” is an individual or organization that processes, controls, or authorizes the processing of personal data. Meanwhile, a “data processor” are those who handle personal data for a data controller but doesn’t use the data for their own purposes and isn’t an employee of the data controller.
A person or entity is a “Data Controller” if they fall into any of the 13 class of data controllers. For instance, the industry of communications, banking and financial institutions, insurance, health, tourism and hospitality etc.
Furthermore, regarding the appointment of DPO – data controllers and/or data processors must appoint one or more DPO in any case where processing involves:
- Personal data exceeding 20,000 data subjects;
- Sensitive personal data, including financial information, exceeding 10,000 data subjects; or
- Activities that require regular and systematic monitoring of personal data.
Timeline for enforcement and transition period of the PDPA Amendment 2024
For better understanding of your business nature whether yours is a data controller or data processor, you may contact Personal Data Protection Commissioner Office or refer to the PDP Act 2010 with the amendment 2024 and Personal Data Protection (Class of Data Controllers) with the amendment order 2016.
Meanwhile, we’re here to assist you to stay in compliance as we offer:
- Gap Assessment: Address existing gaps in data protection to better safeguard sensitive information.
- Data Protection Training & Advisory: Guide organizations on PDPA compliance and implement good data protection practices including DPO training.
