New guidelines under Malaysia´s Personal Data Protection Framework

Scope and application

The Guidelines primarily apply to data controllers and data processors. The data controller is responsible for appointing a Data Protection Officer  (DPO) and carrying out a DPIA, while the data processor is expected to provide reasonable and necessary assistance in carrying out the DPIA. Ultimate responsibility for the DPIA and resulting decisions rests with the data controller’s senior management. The ADMP Guideline further clarifies ADMP as a qualitative DPIA trigger. The DPbD Guideline provides non-mandatory best-practice guidance for both data controllers and data processors.

Overview of Guidelines

Data Protection Impact Assessment

A DPIA assesses the impact of a planned processing operation on personal data protection by identifying, analyzing and mitigating related risks. A data controller must carry out a DPIA where it anticipates a high risk to the protection of a data subject’s personal data during its processing operations.

Under the two-tiered approach, a DPIA is required where either the quantitative thresholds are met – more than 20,000 data subjects or sensitive personal data for more than 10,000 data subjects – or qualitative factors – such as potential legal or significant effects, systematic monitoring, innovative technologies, vulnerable individuals or automated decision-making – indicate a high risk.

The Guideline explains how to carry out a DPIA in five steps – Describe, Evaluate, Identify, Consider and Assess – and includes a DPIA template as well as guidance on reporting, risk mitigation, publication and monitoring.

Data Protection by Design

Data Protection by Design (DPbD) integrates appropriate technical and organisational measures into the entire lifecycle of data-processing activities to implement the Personal Data Protection Principles. The non-mandatory Guideline encourages data controllers and data processors to adopt a proactive, risk-based approach tailored to the nature, scope, purpose and context of the processing activity. It identifies four core elements: proactiveness, end-to-end protection, transparency and user-centricity.

Automated Decision-Making and Profiling

The Personal Data Protection Act (PDPA) does not specifically regulate automated decision-making or the use of artificial intelligence (AI). The ADMP Guideline therefore provides guidance to data controllers and data processors on safeguarding personal data when using innovative technologies.

Automated decision-making (ADM) refers to decisions made wholly or partly by automated means without human involvement. Profiling refers to automated processing of personal data to evaluate or predict personal aspects of a data subject. Not all ADM or profiling involves AI; the Guideline focuses on the use of AI in processing personal data involving ADMP.

The DPO has specific responsibilities in overseeing ADMP systems. The use of ADMP constitutes a qualitative factor requiring a DPIA, regardless of the nature or extent of its intended use. The ADMP threshold is met where the outcome of the ADMP process may produce legal effects concerning the data subject or otherwise significantly affect the data subject.

Special attention must be paid to the processing of sensitive personal data. Under Section 40 PDPA, such processing is only permitted where the data subject has given explicit consent or where it is necessary for specified purposes, including employment law compliance, protection of vital interests, medical purposes, legal proceedings or obtaining legal advice.

Practical Implications

• Data controllers should review whether their processing operations meet the quantitative thresholds or trigger any qualitative risk factors requiring a DPIA, including the use of ADMP.
• Where ADMP involves sensitive personal data, data controllers should ensure compliance with Section 40 PDPA.