Malaysia PDPA

Malaysia's amended PDPA,
explained for DPOs

Since 2025, Malaysian organisations have had to appoint DPOs, report breaches within 72 hours and justify every transfer of personal data abroad. This page sets out what changed and where data loss prevention helps.

Free 30-day data exposure audit See nPro DLP

The short answer

  • Appoint a DPO if you hold personal data on more than 20,000 people, sensitive or financial data on more than 10,000, or monitor people regularly and systematically.
  • Report significant breaches to the Commissioner within 72 hours, and to affected individuals within seven days after that.
  • Justify transfers abroad under one of the section 129 conditions. The old whitelist of approved countries is gone.
  • Penalties for breaching the Data Protection Principles now reach RM1,000,000, up to three years' imprisonment, or both.

This is a summary, not legal advice. Confirm your obligations with your legal adviser and the Personal Data Protection Commissioner.

What changed in 2025

The Personal Data Protection (Amendment) Act 2024 came into force in stages between January and June 2025, with guidelines from the Commissioner setting out the detail.

Obligation
What it requires
Data Protection OfficerFrom 1 June 2025
Required above 20,000 data subjects, above 10,000 for sensitive personal data including financial information, or where personal data is monitored regularly and systematically. Applies to data controllers and data processors. Notify the Commissioner within 21 days of appointing. The DPO must be proficient in Malay and English.
Breach notificationFrom 1 June 2025
A breach that causes or is likely to cause significant harm goes to the Commissioner within 72 hours, and to affected individuals within seven days of notifying the Commissioner. Significant harm covers financial loss, identity fraud and compromised sensitive data, among others. Keep a breach register for at least two years.
Cross-border transfersGuidelines issued 29 April 2025
The whitelist of approved countries is replaced by risk-based conditions under section 129, such as substantially similar laws in the destination, consent, contractual necessity or due diligence. A transfer impact assessment supports the decision and stays valid for up to three years.
Data processors
Processors are now directly bound by the Security Principle, so the vendors handling your data carry their own liability for keeping it secure.
Penalties
Breaching the Data Protection Principles can now bring a fine of up to RM1,000,000, imprisonment of up to three years, or both. The previous maximum was RM300,000 and two years.
Data portabilityFrom 1 June 2025
Individuals can ask for their data to be sent directly to another data controller, where it is technically feasible.

Where DLP fits

What a DPO needs, and what nPro DLP gives you

DLP does not make an organisation compliant on its own. It covers the parts of the PDPA that depend on knowing where personal data is and what is leaving.

Security Principle: stop the leak

Block personal data leaving by USB, cloud upload, clipboard and screen capture, with a Malaysian NRIC detector that uses checksums and Malay keywords. Text inside uploaded screenshots and photos is checked too.

72 hours: know what happened

Each event is recorded with the endpoint, channel, destination and time. Alerts are ranked by severity and DLP events are kept for 12 months, so the facts for a notification are already there.

Evidence without manual work

A ready-made PDPA report covers personal data found, cross-border transfers, blocks and unapproved AI use, as PDF or CSV, emailed daily, weekly or monthly.

No transfer to check the data

nPro is self-hosted. Inspection runs on your own servers, so the DLP tool itself adds no cross-border transfer to justify under section 129.

Know where personal data sits

Sensitive data discovery scans endpoints for regulated content at rest. It reports what it finds and does not block.

Teach the policy in Bahasa Malaysia

In Audit posture, staff see why an action is risky before it is blocked, with the message in Bahasa Malaysia, Bahasa Indonesia or English. A PDPA baseline policy template gives you a starting point.

What it does not cover

nPro does not file breach notifications, appoint or register your DPO, or carry out transfer impact assessments. Outbound email is monitored through your mail platform's audit feed but not blocked inline yet.

Questions DPOs ask

Does our organisation need to appoint a Data Protection Officer under Malaysia's PDPA?
Since 1 June 2025, a DPO must be appointed if you process the personal data of more than 20,000 data subjects, the sensitive personal data (including financial information) of more than 10,000 data subjects, or carry out regular and systematic monitoring of personal data. The Commissioner must be notified within 21 days of the appointment, and the DPO must be proficient in Malay and English.
How quickly must a data breach be reported in Malaysia?
Under the Commissioner's guideline, a breach that causes or is likely to cause significant harm must be reported to the Commissioner as soon as practicable and within 72 hours. Affected individuals must be told without unnecessary delay and within seven days of notifying the Commissioner. A breach register must be kept for at least two years.
Does using a cloud DLP tool count as a cross-border transfer of personal data?
It can. If a cloud DLP service inspects your files outside Malaysia, the personal data in them leaves the country to be checked, and that transfer has to meet one of the conditions in section 129 of the PDPA, typically supported by a transfer impact assessment. A self-hosted DLP such as nPro inspects data on your own servers, so the inspection itself creates no transfer.
Can DLP help us meet the 72-hour breach notification deadline?
It helps with the hardest part, knowing what happened. nPro DLP records each event with the endpoint, channel, destination and time, ranks alerts by severity and keeps DLP events for 12 months, so a DPO can establish what left, when and where. It does not file the notification for you, and it does not replace your breach response plan.
Does nPro DLP detect Malaysian NRIC numbers?
Yes. nPro DLP has a Malaysian NRIC detector that uses checksums and nearby keywords, with keyword matching in English and Malay, so an ordinary 12-digit number is not mistaken for an IC number. It also detects Indonesian, Thai, Singaporean, Vietnamese and Philippine national IDs.

Find out where you stand before a breach does

The free 30-day Data Exposure Audit runs in monitor mode and shows what personal data is leaving, through which channels, and which AI tools it reached. Nothing is blocked and nothing leaves your network.

Get the free 30-day audit Talk to sales

Sources

Last checked 21 October 2026. A summary for general information, not legal advice.