Part 4: Personal Data Protection (Amendment) Act 2024 - Update on Malaysia´s Data Protection Guidelines

Following the implementation of the Personal Data Protection (Amendment) Act 2024 (“PDPA 2024”), the Personal Data Protection Commissioner (“Commissioner”) has published several public consultation papers for the development of supplementary guidelines to provide greater clarity and certainty on compliance with the new provisions introduced in the PDPA 2024. Our previous articles highlighting the key amendments introduced in the PDPA 2024 can be accessed here (Part 1), here (Part 2) and here (Part 3).

Published Guidelines

On 25 February 2025, the Commissioner issued the following guidelines:

The Implementation of Data Breach Notification Guideline, which sets out:

The scope and threshold of notification to the Commissioner and affected data subjects;
Timeframe for notification;
The manner and form of notifications;
Management of breached personal data; and
The obligations of data controllers, including record-keeping obligations.

The Appointment of Data Protection Officer (“DPO”) Guideline, which sets out:

The threshold for mandatory appointment of DPO;
Expertise, qualifications and residency requirement of DPO;
Key responsibilities of a DPO;
Notification of appointment of DPO; and
Obligations of data controller and data processor.

On 29 April 2025, the Commissioner issued the Cross-Border Data Transfer Guideline, which sets out:

New conditions for cross-border transfer under PDPA 2024;
The adoption of Binding Corporate Rules;
Applicability of Standard Contractual Clauses;
Certification mechanism; and
Record-keeping obligations.

Guidelines Pending Issuance by the Commissioner

The Commissioner closed the public consultation papers on 18 October 2024 for the Revised Personal Data Protection Standard 2015 (“PDP Standard”) 2024 and the development of the following guidelines:

The Right to Data Portability Guideline, which discusses the following:

Compliance requirement with data portability requests;
Types of personal data that are subject to portability;
Timeline for responding to data portability requests;
Limitation period for historical data portability;
Imposition of fees; and
Transmission methods for personal data.

Cross-Border Data Transfer Guideline, which discusses the following:

New conditions for cross-border transfer under PDPA 2024;
The adoption of Binding Corporate Rules;
Applicability of Standard Contractual Clauses;
Certification mechanism; and
Record-keeping obligations.

Ongoing Public Consultation Papers

On 20 March 2025, the Commissioner issued public consultation papers (closing on 19 May 2025) for the development of the following guidelines:

Data Protection Impact Assessments – a proactive process to help organizations assess the risks and impacts related to the processing of personal data to ensure compliance with legal requirements.
Data Protection by Design and by Default - provides guidance to organizations on integrating data protection at every stage of system and process design.
Automated Decision-Making & Profiling - Provides guidance on the regulation of data processing involving automated decision-making and profiling to ensure the protection of individual rights.

With the PDPA 2024 and guidelines taking effect from 1 June 2025, organizations are strongly encouraged to review their current data handling practices and begin aligning them with the published guidelines and proposed guidelines to ensure timely compliance.

From The Newsletter

Newsflash Malaysia

Contact

Contact Person Picture

Geetha Salva

+603 2276 5580

Send inquiry

How We Can Help

Rödl & Partner in Malaysia