Part 3: Personal Data Protection (Amendment) Act 2024 - Cross Border Personal Data Transfer Guidelines

This is part of our ongoing series on the Personal Data Protection (Amendment) Act 2024. Our earlier articles can be accessed here (Part 1) and here (Part 2).

As mentioned in our article on the key amendments of Personal Data Protection (Amendment) Act 2024 (“PDPA 2024”), the whitelist regime for cross border data transfer provided in Section 129 of the Personal Data Protection Act 2010 (“PDPA”) has been removed, and companies must now meet specific conditions to legally transfer personal data outside of Malaysia.

On 29 April 2025, the Personal Data Protection Commissioner (“Commissioner”) published a Cross Border Personal Data Transfer Guideline (“Guideline”) to provide clarity on these requirements. These changes directly affect companies that operate internationally or transfer data overseas.

Cross Border Personal Data Transfer Guideline

The Guidelines outline the requirements data controllers must meet to rely on the conditions under Section 129 of the PDPA. The requirement is summarized below:

Equivalent data protection laws: Data controller to conduct a Transfer Impact Assessment (TIA) to confirm the destination country has laws substantially similar to the PDPA and to reassess every 3 years.
Adequate level of protection: Data controller to conduct a TIA to evaluate whether the level of protection offered is equivalent to the PDPA and to reassess every 3 years.
Consent from data subject: Inform the data subject of the transfer through a notice and document their consent according to PDPA regulations.
Contractual necessity between data controller and data subject: Demonstrate that the transfer is essential to fulfill a specific contract with the data subject and cannot be achieved by other means.
Contractual necessity between data controller and third party: Demonstrate that the transfer is essential to fulfill a specific contract with the data subject and cannot be achieved by other means and it is tied to a contract requested by or in the interest of the data subject.
Legal Purposes: Transfers may be made in relation to legal proceedings, legal advice, or exercising legal rights.
Reasonable grounds: If obtaining consent is impracticable and the data subject would likely consent, data controller has reasonable grounds to believe that the transfer may proceed to avoid or reduce harm to the data subject.
Taken all reasonable precautions and exercised all due diligence: Implement Binding Corporate Rules, Standard Contractual Clauses, or obtain certifications.
Vital interests of data subject: necessary to protect vital interests of data subject, provided the risk outweighs data protection concerns.

The Guidelines also outline the responsibilities of data controller in handling cross order personal data transfer which includes security of such transfer, the compliance of third party or data processor with the PDPA and record keeping of the transfer.

Actions to be taken

To ensure compliance with the amendment of Section 129 of the PDPA that came into force on 1 April 2025, it is crucial for companies to review their current cross border transfer processes, conduct and document required TIA, update data processing contracts with third parties and ensure record-keeping of all data transfers and consents.

While the PDPA shares similarities with the General Data Protection Regulation (“GDPR”) and may support the application of personal data protection policies and procedures across regions, the PDPA may, on a case-by-case basis, impose different or additional requirements as compared to the GDPR. Therefore, it is advisable for companies to carefully review and assess their compliance approach to ensure alignment with PDPA requirements and avoid potential non-compliance.

From The Newsletter

Newsflash Malaysia

Contact

Contact Person Picture

Geetha Salva

+603 2276 5580

Send inquiry

How We Can Help

Rödl & Partner in Malaysia