Personal Data Protection Act 2010 (as amended by Act A1727, 2024)
A Rapidly Strengthening Framework for Data Protection in Southeast Asia
Malaysia’s Personal Data Protection Act 2010 (PDPA), in force since 2013, regulates personal data processing in commercial transactions within its statutory scope. The Personal Data Protection (Amendment) Act 2024 (Act A1727) introduced phased reforms during 2025, including direct security obligations for processors, Data Protection Officer (DPO) appointments, data breach notification, data portability and international data transfer regimes.
The Act is built around seven Personal Data Protection Principles and is enforced by the Commissioner of the Department of Personal Data Protection (JPDP). For Life Sciences organisations, identifiable clinical and health information warrants particular attention, including consent, security, clinical trial data protection governance and international data transfers.
Our Experts Are Here To Help You!
Ensure your compliance with Malaysia’s PDPA for clinical trials and health data.
Core Compliance Obligations Under the PDPA:
- Comply with the seven Personal Data Protection Principles: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity, and Access.
- Identify an appropriate basis for processing personal data and provide required notices. Under Section 40, processing sensitive personal data generally requires explicit consent unless another statutory condition applies. The statutory definition includes information about physical or mental health and biometric data; genetic data is not separately named but may be sensitive where it reveals health information.
- Appoint a Data Protection Officer (DPO) where the organisation is subject to the Malaysian PDPA and meets an applicable appointment threshold: processing personal data of more than 20,000 individuals; sensitive personal data (including financial information for threshold purposes) of more than 10,000 individuals; or carrying out regular and systematic monitoring. For foreign pharmaceutical Sponsors, applicability depends on the territorial scope of the PDPA and the nature and scale of processing.
- Assess suspected personal data breaches against the regulatory notification criteria. For notifiable breaches, notify the Commissioner as soon as practicable and within the applicable 72-hour timeframe under the 2025 Data Breach Notification Guidelines. Notify affected data subjects where the applicable significant-harm criteria are met, within the prescribed timeframe.
- Assess international transfers under Section 129. Transfers may rely on destination protection that is substantially similar or adequate, or on another statutory ground, including consent, specified contractual necessity, vital interests or reasonable precautions and due diligence. Transfer Impact Assessments and contractual measures, such as EU Standard Contractual Clauses or ASEAN Model Contractual Clauses, may support the relevant assessment; they are not standalone statutory transfer grounds.
- Address eligible data portability requests under Section 43A, including direct transmission between controllers where the statutory conditions and technical feasibility requirements are satisfied.
- Understand the increased penalties under the amended PDPA. Certain contraventions of the core Data Protection Principles can attract fines of up to RM1 million and imprisonment of up to three years; penalties vary by offence.
How MyData-TRUST Can Support You:
- Develop a tailored compliance roadmap for your Malaysia operations
- Assess DPO appointment obligations, provide Data Protection Officer support, and set up the surrounding governance framework
- Support foreign organisations with Malaysia Local Representative services where Section 2(3) applies, including breach coordination and support of data subject communications
- Maintain Records of Processing Activities (RoPA) and conduct Data Protection Impact Assessments (DPIAs) for high-risk processing activities, including clinical trials
- Conduct Transfer Impact Assessments and structure appropriate safeguards for cross-border clinical trial data flows
- Design and deliver training and awareness programmes for clinical and research teams
- Review contracts, informed consent forms, and clinical trial documentation
Why Compliance Matters for Life Sciences:
- Strengthens trust and integrity in clinical trials and research programmes
- Ensures robust, legally mandated safeguards for sensitive data, including health data
- Mitigates reputational and regulatory exposure under significantly higher penalties
- Demonstrates accountability to the JPDP, ethics committees, and participants
Why Choose MyData-TRUST?
- Expertise in Malaysian data protection compliance
- Proven, extensive experience in Life Sciences privacy
- Practical, operational support for clinical research data protection
- Specialist guidance on cross-border data transfers
Frequently asked questions
Is a Data Protection Officer mandatory in Malaysia?
Not every organisation must appoint a DPO. From 1 June 2025, controllers and processors meeting any of the applicable thresholds (more than 20,000 data subjects; more than 10,000 data subjects for sensitive personal data, including financial information for threshold purposes; or regular and systematic monitoring) must appoint one or more DPOs. Appointments must be notified in accordance with the Commissioner’s guidance. For foreign pharmaceutical Sponsors, DPO appointment must be assessed against the territorial applicability of the PDPA and the prescribed criteria. MyData-TRUST can help assess the requirement and provide DPO support where applicable.
Is data breach notification mandatory under the PDPA?
Yes. Since 1 June 2025, qualifying personal data breaches must be notified to the Commissioner under Section 12B and the 2025 Data Breach Notification Guidelines. The guidelines set a 72-hour timeframe for notification to the Commissioner and specify when and how affected individuals must be notified. Organisations should maintain documented assessment and incident-response procedures.
How are cross-border transfers of clinical trial data handled?
Cross-border transfers of personal data are governed by Section 129 of the PDPA. Transfers may proceed where the destination provides substantially similar or adequate protection, or where an applicable alternative statutory condition is satisfied, such as consent, specified contractual necessity, vital interests or reasonable precautions and due diligence. The 2025 Cross-Border Personal Data Transfer Guidelines address Transfer Impact Assessments and safeguards such as contractual clauses. MyData-TRUST supports clinical research data-transfer assessments, documentation and implementation of proportionate safeguards.
Must a foreign organisation appoint a Malaysia Local Representative?
Not automatically. Under Section 2(3) of the Malaysian PDPA, foreign organisations that use equipment in Malaysia to process personal data, other than solely for transit purposes, must appoint a representative based in Malaysia. MyData-TRUST can help foreign organisations determine whether this requirement applies and provide local representation services where needed.
Need more information about MyData-TRUST? Get in touch with our experts.
MyData-TRUST offers global coverage
