The Personal Data Protection (Amendment) Bill 2024 (“PDPB”) was at last passed by the Malaysian Parliament at the end of July. After Royal Assent and publishing, it will become law (on a date to be determined by the Minister of Digital to be specified in the Gazette). The PDPB introduced several changes intended to better align Malaysia’s 2010 Personal Data Protection Act with global standards.
New requirements include:
1. Mandatory DPO appointment;
2. A direct obligation to comply with the practical steps required by the security principle for processors (currently, this is limited to controllers only);
3. Breach notification obligation:
1. to the Personal Data Protection Commissioner;
2. to data subjects, if the breach causes or is likely to cause significant harm; and
4. A new right to data portability must be provided, subject to some possible limitations.
There are also changes to better align with internationally accepted concepts:
1. “Data Controller” replaces “Data User”;
2. “Sensitive Personal Data” now includes “Biometric Data” (personal data resulting from technical processing relating to the physical, physiological, or behavioral characteristics of a person, requiring additional protections, e.g., explicit consent for processing); and
3. Introduction of a general legal basis for international transfer based on adequacy of protection in the destination jurisdiction.
Penalties for non-compliance with the 7 Personal Data Protection Principles have more than tripled to RM1,000,000 (approx. 226K USD) and/or up to three years imprisonment (vs. former RM300,000 and/or two years imprisonment). Company management may be held personally responsible and subject to penalty, unless they can prove they had no knowledge and took all reasonable precautions.
What steps should businesses take now?
While we await the PDPB coming into force and detailed guidance, businesses and organizations processing data in Malaysia should begin planning to:
1. appoint a DPO;
2. implement a data breach notification process;
3. address the new data portability right
4. comply with the Security Principle, if a processor.