Data Protection Lawyers in Malaysia
Our data protection lawyers help businesses and individuals in Malaysia with disputes and risk under the Personal Data Protection Act 2010 as amended: data breach response, Commissioner investigations and complaints, workplace data issues and compliance reviews.
- PDPA 2010 as amended
- Data breach response
- Workplace data and CCTV
- Online consultations
How We Can Help
- Data breach response and Commissioner notifications
- Commissioner investigations and enforcement notices
- Workplace monitoring, CCTV and employee records
- PDPA compliance reviews and DPO appointments
- Cross-border transfers and data processor contracts
- Complaints and claims over misuse of personal data
Explore related guides
Reviewed by Ms. Khoo Ai Theng, Founder, Advocate & Solicitor of the High Court of Malaya. Last updated October 2026.
Why Choose Us?
15+ Years
Legal experience
72 Hours
To notify the Commissioner of a significant breach
7 Days
To notify affected individuals after notifying the Commissioner
RM1 Million
Maximum fine for breaching the data protection principles
What does the PDPA cover, and what changed in 2025?
The Personal Data Protection Act 2010 (Act 709) governs the processing of personal data in commercial transactions in Malaysia, whatever the size of the business, but it does not apply to the Federal and State Governments. Every data controller must comply with seven principles: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access (s 5(1)).
The Personal Data Protection (Amendment) Act 2024 (Act A1727) received Royal Assent on 9 October 2024 and was brought into force in three stages under P.U.(B) 522/2024:
- On 1 January 2025, administrative changes took effect, including service of documents by electronic means.
- On 1 April 2025, “data user” became “data controller”, biometric data became sensitive personal data, deceased persons were excluded from the definition of data subject, and data processors became directly bound by the Security Principle. The maximum penalty for breaching the principles rose to RM1 million, three years’ imprisonment or both, and the cross-border transfer rules in s 129 were revised, removing the ministerial whitelist.
- On 1 June 2025, the duties to appoint data protection officers (s 12A) and to notify data breaches (s 12B) began, together with the right to data portability (s 43A).
The official reprint of Act 709 as at 15 September 2026 incorporates these changes, and Act A1727 remains its only amending Act.
What must a business do after a personal data breach?
Since 1 June 2025, a data controller that has reason to believe a personal data breach has occurred must notify the Personal Data Protection Commissioner as soon as practicable (s 12B). The Commissioner’s guideline applies this to breaches causing, or likely to cause, significant harm and sets the deadlines.
- Contain the breach and preserve evidence such as logs, emails and vendor reports.
- Assess the risk of significant harm, such as physical injury, financial loss, misuse or identity fraud, exposure of sensitive personal data, or (for the Commissioner only) more than 1,000 people affected.
- Notify the Commissioner within 72 hours, which the guideline’s examples count from when the controller becomes aware of or confirms the breach.
- Where individuals face significant harm, notify them directly, without unnecessary delay and no later than seven days after notifying the Commissioner.
- Log every breach, including those below the threshold, and keep the records for at least two years.
Processors are not directly bound by s 12B, so controllers must require them by contract to report breaches promptly. Failing to notify the Commissioner carries a fine of up to RM250,000, two years’ imprisonment, or both. The police, sector regulators such as Bank Negara Malaysia, and NACSA for critical infrastructure under the Cyber Security Act 2024 may also need to be told.
What happens in a PDP Commissioner investigation or complaint?
An individual who believes their personal data has been processed in breach of the Act can complain to the Personal Data Protection Commissioner (s 104), usually through the Personal Data Protection Department’s online system. The Commissioner may investigate and serve an enforcement notice requiring the controller to remedy a contravention (s 108).
Certain decisions can be appealed to the Appeal Tribunal (s 93). Because the PDPA is enforced mainly through criminal offences, an investigation deserves the same care as any other regulatory inquiry. The penalties include:
- a fine of up to RM1 million, imprisonment of up to three years, or both, for breaching the data protection principles (s 5(2));
- a fine of up to RM200,000, imprisonment of up to two years, or both, for processing sensitive personal data without meeting the conditions in s 40;
- a fine of up to RM250,000, imprisonment of up to two years, or both, for failing to notify the Commissioner of a notifiable breach (s 12B).
The Act also has a provision on offences by bodies corporate (s 133), so directors and senior managers have a personal interest in how an investigation is handled. In practice, appoint one point of contact, answer within the time given, preserve documents, prepare an accurate chronology and check every statement against the records.
Workplace data: monitoring, CCTV and employee records
Employers hold a wide range of personal data about staff, from identity documents and salary records to medical certificates, emails and CCTV footage. Problems usually surface during a misconduct case, a dismissal claim or a data leak.
- CCTV images are personal data. The Personal Data Protection Department suggests a simple notice where cameras operate, and its DPO guideline cites CCTV as an example of regular and systematic monitoring.
- Monitoring of email, devices and systems should be covered by a clear written policy and notice to staff, consistent with the Notice and Choice Principle, and limited to what its purpose requires.
- Health information is sensitive personal data and needs explicit consent unless an exception applies, such as processing needed to exercise or perform a right or obligation imposed by law on the employer in connection with employment (s 40).
- An employee may make a data access request, which must generally be answered within 21 days (s 31), and requests sometimes arrive in the middle of a dispute.
- Departing employees who take customer lists or files raise both data protection and confidential information issues.
Clear policies also make monitoring evidence easier to explain and defend in a domestic inquiry or before the Industrial Court. See our employment law page.
Can individuals claim compensation for misuse of their personal data?
Individuals have enforceable rights under the PDPA, but the Act does not expressly give a right to sue for compensation. The Personal Data Protection Department’s own FAQ says the Act does not specifically provide a right to claim damages and that its remedies take the form of criminal offences.
The rights an individual can exercise include:
- access to their personal data, with a response generally due within 21 days (s 31), and correction of inaccurate data;
- withdrawal of consent to processing;
- a written notice to stop processing likely to cause substantial and unwarranted damage or distress (s 42), or to stop direct marketing (s 43);
- since 1 June 2025, data portability, meaning a request that a controller transmit their data to another controller, subject to technical feasibility and compatibility of data format (s 43A).
Where these rights are ignored, the usual route is a complaint to the Commissioner. Whether a court will award damages for a breach of the PDPA itself is not clearly settled. Depending on the facts, an individual may instead have a claim in contract, for breach of confidence or, where false statements are published, in defamation. We advise on the right route after reviewing the documents.
How NZSK handles data protection matters and compliance reviews
Much of a data dispute turns on what the business did before the incident. Our compliance reviews look at your data the way a regulator or a claimant would, and typically cover:
- privacy notices, consents and how the Notice and Choice Principle works in practice;
- whether you meet the DPO thresholds (more than 20,000 data subjects, more than 10,000 for sensitive personal data including financial information, or regular and systematic monitoring) and whether the DPO was registered with the Commissioner within 21 days of appointment;
- a written breach response plan that can meet the 72-hour window;
- data processor and vendor contracts, including breach reporting clauses;
- cross-border transfers, which s 129 now allows to a place with a law substantially similar to the PDPA or an adequate level of protection, or under exceptions such as consent, with any transfer impact assessment valid for no more than three years;
- CCTV, monitoring and retention policies.
Every matter, including a live breach or investigation, starts with a consultation, online or in person, and we advise after reviewing your documents. For ongoing support, see our corporate advisory retainer.
Frequently Asked Questions
The Personal Data Protection Act 2010 applies to anyone in Malaysia who processes, or controls the processing of, personal data in commercial transactions, whatever the size of the business. It does not apply to the Federal and State Governments. Since 1 April 2025, data processors acting for a data controller must also comply with the Security Principle. Certain classes of data controllers must also register with the Personal Data Protection Commissioner before processing personal data.
In Malaysia, a data controller must notify the Personal Data Protection Commissioner of a personal data breach that causes or is likely to cause significant harm. The Commissioner's guideline requires notification within 72 hours, and notice to affected individuals facing significant harm without unnecessary delay and no later than seven days after notifying the Commissioner. These duties apply from 1 June 2025. Failing to notify the Commissioner can lead to a fine of up to RM250,000, two years' imprisonment, or both.
Since 1 June 2025, data controllers and data processors in Malaysia must appoint a Data Protection Officer if they process personal data of more than 20,000 data subjects, sensitive personal data including financial information of more than 10,000 data subjects, or carry out regular and systematic monitoring. The DPO should be resident in Malaysia or easily contactable, and proficient in Bahasa Malaysia and English. The appointment must be registered with the Commissioner within 21 days.
The Personal Data Protection Act 2010 does not expressly give individuals in Malaysia a right to sue for compensation, and the Personal Data Protection Department's FAQ describes the Act's remedies as criminal offences. Whether a Malaysian court will award damages for a PDPA breach itself is not clearly settled. An affected individual can complain to the Commissioner and, depending on the facts, may have a civil claim in contract or for breach of confidence.
In Malaysia, a person who believes their personal data has been processed in breach of the Personal Data Protection Act 2010 can complain to the Personal Data Protection Commissioner, usually through the Personal Data Protection Department's online complaint system. Include the organisation's details, what happened and when, and copies of supporting documents such as messages or screenshots. The Commissioner may investigate and, where there is a contravention, serve an enforcement notice.
Yes, within limits. In Malaysia, CCTV images are personal data, and the Personal Data Protection Department suggests a clear notice where cameras operate. Monitoring of email, devices and systems should be covered by a written policy and notice to staff, and limited to legitimate purposes such as security and investigating misconduct. Health information is sensitive personal data with stricter rules. Clear policies also make monitoring evidence easier to explain in a domestic inquiry.
Yes. Since 1 April 2025, s 129 of the Personal Data Protection Act 2010 allows a data controller to transfer personal data to a place outside Malaysia that has a law substantially similar to the Act or that ensures an adequate level of protection. Transfers are also allowed under listed exceptions, such as the data subject's consent or where the transfer is necessary to perform a contract. The Commissioner's guideline says a transfer impact assessment is valid for no more than three years.
The cost of PDPA work in Malaysia depends on the number of systems and data flows involved, the volume of documents and contracts to review, whether sensitive personal data or cross-border transfers are in issue and, for a breach, how many people are affected and whether the Commissioner is investigating. NZSK gives a fee quotation after the consultation, once we have reviewed your documents and understood the scope.
Dealing with a data breach, investigation or complaint?
Data protection issues turn on what your documents, systems and contracts actually say, so we do not advise on a description alone. Book a consultation, online or in person at our Puchong or Mont Kiara office, and we will advise you once we have reviewed your documents.
- (+60)12-401 4799 | (+60)3-8060 0267
- [email protected]
Consultation by appointment at Mont Kiara, Kuala Lumpur and Puchong, Selangor, or online.
