
05/06/2025
The benefits of the new Personal Data Protection (Amendment) Act 2024
After many negotiations in the parliament, the government has amended 10 laws in the Personal Data Protection Act. The changes that were implemented on 1st April 2025 are upon direct obligations on data processors to comply with the security principle, changes to cross-border transfer rules, revised definitions of “sensitive personal data” and “personal data”, and increased penalties. While on 1st June 2025 it touched on data protection officer (DPO) appointment, mandatory data breach notifications, and data subject rights to data portability.
1. Terminology Alignment with International Standards
* The term “data user” has been replaced with “data controller” throughout the PDPA, aligning Malaysia’s terminology with international data protection frameworks like the GDPR. This change facilitates clearer understanding and consistency in global data protection practices.
2. Amendment of definitions in the PDPA
* The law has recognised “biometric data” as a type of sensitive personal data, the law introduces new definitions for “personal data breach”, expands the definition of “requestor” to encompass individuals making data portability requests; and narrows down the scope of “personal data” to exclude personal data of deceased individuals.
3. Increased Penalties for Non-Compliance
* Before the amendment for a breach of any of the PDP Principles carries a maximum penalty of a fine of up to RM300,000, or imprisonment for a term of up to two years, or both. In practice, the highest compound issued under the PDPA to date is RM108,000, which was imposed on a security services firm for breaching the General Principle, Disclosure Principle, and Retention Principle. With the Amendment of the Act it will increase the penalty for breach of the PDP Principles to a maximum penalty of a fine of up to RM1,000,000, or imprisonment for a term of up to three years, or both.