Cybersecurity Policy Report, Malaysia Seeks Input on Privacy Law Amendments, (Aug 25, 2025)

By Tony Foley

The Malaysian Department of Personal Data Protection (PDP) has launched a public consultation on proposed amendments to the Personal Data Protection Regulations 2013 focused primarily on enhanced security requirements and augmented penalties.

The proposed amendments are outlined in a public consultation paper developed in April that can be downloaded from this web page but is available only in Malay. A machine translation of the paper notes that the 2013 regulations are subsidiary legislation outlining the obligations of data controllers under the seven personal data protection principles in the Personal Data Protection Act (PDPA), as well as provisions concerning enforcement notices and inspections used by the PDP to enforce compliance. The PDP said the 2013 regulations needed updates to align them with the latest amendments to the PDPA.

Among others, the amendments provide for the following updates:

1. Replacing the term “data user” with “data controller”;

2. Requiring controllers and processors to appoint data protection officers to ensure compliance with the PDPA;

3. Outlining the requirement for data controllers to notify data breaches to the PDP;

4. Allowing data subjects to request that their personal data be transferred from one data controller to another;

5. Abolishing a requirement that data controllers catalog permitted places for the transfers of personal data outside the country;

6. Establishing obligations and responsibilities for data processors to comply with PDPA security principles; and

7. Increasing the level of punishment for violations of the seven personal data protection principles under the PDPA.

Also included in the proposed amendments are changes to the PDP’s Data Protection Standard 2015 that would introduce stricter access controls, require incident response planning, strengthen data storage management via data retention policies, and ensure data integrity by adopting procedures for correcting incorrect data and conducting periodic monitoring.

Comments may be submitted by using the form or QR code included in the PDP’s request for feedback page through Sept. 8.

News: InternationalLegislation DataPrivacy DataSecurity DataBreach