Malaysia's amended PDPA: a 30-day readiness plan for mid-size companies

Malaysia's Personal Data Protection Act 2010 received its most significant update in 2024. The Personal Data Protection (Amendment) Act 2024 was passed that year and its provisions were brought into force in phases during 2025, supported by guidelines from the Personal Data Protection Commissioner. For a mid-size company that has treated the PDPA as a privacy notice and a consent checkbox, the job has changed. None of it requires a large programme, though: with focus, most mid-size organisations can reach a defensible baseline in 30 days. Here is the plan we use.

What changed, in brief

• "Data user" is now "data controller", in line with the GDPR.
• Data controllers that meet thresholds set by the Commissioner must appoint a data protection officer (DPO) and register the appointment.
• Personal data breaches must be notified to the Commissioner, and to affected individuals where the breach is likely to cause significant harm.
• Individuals gain a right to data portability: to ask that their data be transmitted to another controller, where technically feasible and the data format is compatible.
• Data processors are now directly bound by the Security Principle, so your cloud, payroll, CRM and outsourcing vendors carry their own legal duty to protect the data.
• Biometric data is now sensitive personal data, the old whitelist approach to cross-border transfers has been replaced by conditions-based transfers, and maximum penalties have increased substantially.

Week 1: know your data and name your owner

Start with a data inventory, not a policy. List the systems that hold personal data (HR, payroll, CRM, support, marketing, CCTV, finance), the categories of data in each, the number of individuals, where it is hosted and which vendors touch it. A spreadsheet is fine; completeness matters more than tooling.

Use the inventory to test the DPO thresholds. The Commissioner's guideline ties the obligation to scale and risk: in summary, processing the personal data of more than 20,000 individuals, the sensitive personal data (including financial information) of more than 10,000 individuals, or processing that involves regular and systematic monitoring. If you are close to a threshold, appoint anyway. The guideline also expects the DPO to be reachable in Malaysia and proficient in Bahasa Malaysia and English, and the appointment must be registered with the Commissioner within a short window. The DPO can be an employee or an outsourced service, but the role needs time, authority and a direct line to management.

Week 2: build a breach response you can run at 2 a.m.

Breach notification is where most companies are least prepared. The Commissioner's guideline expects notification as soon as practicable and within 72 hours of becoming aware of a breach, with affected individuals told without unnecessary delay where significant harm is likely. Seventy-two hours disappears quickly when nobody knows who decides.

• Write a one-page breach playbook: who triages, who decides whether the breach is notifiable, who drafts the notice and who signs it off.
• Define "significant harm" for your organisation with examples: financial loss, identity fraud, exposure of sensitive data, and breaches at a scale that matters.
• Prepare notification templates for the Commissioner and for individuals, so that under pressure you are editing, not drafting.
• Keep a breach register for every incident, including those you decide not to notify, with the reasoning. Regulators ask for it.
• Run a 60-minute tabletop exercise on a realistic scenario, such as a vendor's misconfigured storage bucket.

Week 3: bring your processors and transfers into line

Processors now carry their own security obligation, but you are still expected to choose and contract them carefully. Review the top ten vendors from your inventory. Each needs a data processing agreement covering security measures, breach notice to you (well inside your own 72 hours, ideally 24), sub-processor approval, return or deletion at exit, and audit rights. Ask for evidence such as an ISO/IEC 27001 certificate or a SOC 2 report, not just questionnaires.

Then map where data leaves Malaysia. The amended Act allows transfers where the destination has a law substantially similar to the PDPA or ensures an adequate level of protection, or where another listed condition applies. Record which basis you rely on for each transfer and keep that record with your inventory.

Week 4: rights, portability and proof

Update your request-handling process to include portability alongside access and correction. Decide which datasets are in scope, the export format you will use (CSV or JSON is usually enough), how you verify identity, and who approves releases. Track every request and its response time in a register.

Finish with evidence. Refresh the privacy notice to reflect the new rights and the DPO contact, brief the staff who handle personal data, and assemble a short compliance pack: inventory, DPO registration, breach playbook and register, processor agreements, transfer records and the rights register. That pack is what a regulator, auditor or enterprise customer will ask to see.

Compliance under the amended PDPA is less about the policy you publish and more about the evidence you can produce on a bad day.

After day 30

Next come privacy impact assessments for high-risk processing, retention schedules that actually delete data, and, if you want certification, ISO/IEC 27701. If you also operate in India, the UAE or Australia, build once to the strictest common standard and map each law's specifics on top. This article is general guidance rather than legal advice; consult counsel for your specifics.