The Personal Data Protection Act 2010 (PDPA) became a stricter law during 2025. Under the 2024 amendment, the maximum fine for breaching a data protection principle rose from RM300,000 to RM1,000,000. According to the Data Protection Report, the duties to notify breaches and to appoint a data protection officer (DPO) followed on 1 June 2025.
Most of what the law asks for is carried out by IT. Access control, encryption, patching, backups, logs and the incident procedure sit with the people who run the systems, while legal and compliance teams set the policy. A breach then tests those systems against a clock measured in hours. For a large enterprise with personal data spread across many systems, the practical question is which control answers which duty.
This PDPA compliance checklist maps the seven principles to supporting controls and looks closely at the Security Principle. It then covers breach response, DPO rules and the order of work for an IT team.
What Does the PDPA Require from IT Teams?
The PDPA sets seven principles for processing personal data, and the Personal Data Protection Commissioner’s principles page lists them as General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access. Legal teams own the notices and the consent wording. IT teams own most of the controls behind Security, Retention, Data Integrity and Access, because those principles are met by how systems store, protect, correct and delete data.
The 2024 amendment arrived in stages. According to the Data Protection Report, the higher penalty, the processor duty under the Security Principle and the new status of biometric data as sensitive took effect on 1 April 2025. DPO appointment, breach notification and the data portability right followed on 1 June 2025. The new penalty also carries imprisonment of up to three years, up from two, under section 5 of the Amendment Act. This is general information, not legal advice.
Which Controls Map to Each Principle?
Each PDPA principle maps to at least one IT control, and the Security Principle in section 9 maps to the most. The table pairs each principle with what it requires, taken from sections 6 to 12 of the Laws of Malaysia reprint of Act 709, which predates the amendment, and with the control we recommend.
| Principle | What it requires | Control we recommend |
|---|---|---|
| General (s 6) | Consent unless an exception applies; data adequate but not excessive | Timestamped consent records; no form fields or columns the purpose does not need |
| Notice and Choice (s 7) | Written notice, in Malay and English | The privacy notice in both languages on every form, app and site that collects data |
| Disclosure (s 8) | No disclosure beyond the original purpose or the third parties named in the notice | A register of vendors and cloud regions that receive data; restricted export and sharing rights |
| Security (s 9) | Practical steps against loss, misuse, modification and unauthorized or accidental access, alteration or destruction | The controls in the next section |
| Retention (s 10) | No retention longer than necessary; destroy data no longer needed | Retention schedules, automated deletion, sanitized retired disks and backups |
| Data Integrity (s 11) | Reasonable steps to keep data accurate, complete and up to date | Input validation, a correction workflow and an audit trail of edits |
| Access (s 12) | Individuals can access and correct their data; a data access request is answered within 21 days (s 31) | Data searchable and exportable by individual; each request tracked against the 21-day clock |
Source: Laws of Malaysia, reprint of Act 709, which states these requirements. The control column is our recommendation.
Read as an IT team, the table splits in two. General, Notice and Choice, and Disclosure are met mostly by records and process, so the job is to make those records exist and keep them searchable. The other four depend on how systems store, protect, correct and delete data, which is where the technical work concentrates. The Access row also carries a clock: a data access request must be answered within 21 days. We recommend opening a ticket for each request on the day it arrives.
Which IT Controls Support the Security Principle?
The Security Principle requires practical steps to protect personal data, but the law does not list them. The Commissioner’s 2015 Personal Data Protection Standard, as Conventus Law summarized it in 2016, names restricted access, password protection, malware protection and a backup or recovery system for electronic data. The Commissioner consulted on an outcome-based replacement in October 2024 and, according to Chambers’ 2026 practice guide, had not issued it by March 2026. Until then, the 2015 measures and the consultation proposals are the nearest guide to what the Commissioner expects.
We recommend the controls below as practical steps for an enterprise; they go beyond the 2015 Standard. Start with access. Multi-factor authentication (MFA) asks for a second factor at login, so a stolen password alone does not open an account. The Commissioner’s 2024 consultation paper proposes limiting access to users who reasonably need it.
Encrypt personal data on servers, laptops and backups, so that a lost device exposes nothing readable. Patching matters just as much. Vulnerability management finds unpatched systems, ranks them by risk and patches them, and the same paper proposes applying updates and patches as soon as possible.
The remaining controls limit the damage when something gets through. Endpoint detection and response (EDR) monitors devices, detects malicious behavior and contains infected machines. Network segmentation separates the databases that hold personal data from the user network, so one compromised machine reaches less.
Immutable backup keeps copies that attackers cannot alter, and disaster recovery restores service from them; our guide to immutable backup explains the difference. Finally, keep an audit trail of who opens personal data and when. The consultation paper proposes an appropriate audit trail, and the investigation that the breach circular requires depends on it.
What Must Your Team Do When a Personal Data Breach Happens?
A data controller must notify the Commissioner as soon as practicable, and supply the required information within 72 hours of the breach, when the breach meets the significant-harm criteria in the Commissioner’s breach notification circular. Affected individuals must then hear within 7 days after the notice to the Commissioner.
The circular treats a breach as causing significant harm where it risks injury, financial loss, credit damage or property damage, or could be misused unlawfully. The same applies where the breach involves sensitive personal data, combines data that enables identity fraud, or is large in scale, which the circular sets at more than 1,000 data subjects. Record your reasoning when you assess a breach against these criteria.
In practice, the clock fixes the order of work. Containment comes first, because the circular requires the controller to investigate the cause and act promptly to contain the breach: isolate affected systems, revoke exposed credentials and preserve the logs. The assessment follows. The notice then has to cover the breach details, the likely consequences, a chronology, the measures taken, the measures for affected individuals and contact details. A late notice must carry the reasons and supporting evidence.
The circular states that details still unknown can follow in stages, no later than 30 days after the first notice. Individuals receive a plain-language notice of what happened and what they can do. The controller keeps the breach notification records, in physical and electronic form, for at least two years from the breach date.
Section 12B of the Amendment Act states that failing to notify the Commissioner is an offense, with a fine of up to RM250,000, imprisonment of up to two years, or both.
Who Must Appoint a Data Protection Officer?
A controller or processor must appoint a DPO when its processing meets any of three triggers in the Commissioner’s DPO circular. The triggers are personal data of more than 20,000 data subjects, sensitive personal data of more than 10,000 data subjects, and regular and systematic monitoring. According to DLA Piper, the duty has applied since 1 June 2025.
For an IT team, the practical points are who the DPO is and where they sit. The circular requires the controller to register the DPO with the Commissioner within 21 days of appointment, and to update the details within 14 days if the DPO leaves. The DPO may be an existing employee or an outsourced provider under a service contract, and one person may serve several controllers or processors.
The circular also states that the DPO should be resident in Malaysia, meaning present for at least 180 days in a calendar year, or easily contactable, and proficient in Malay and English. Appointing a DPO does not release the controller or processor from its own duties under section 12A of the Amendment Act.
What Should an IT Team Do First?
Start with a personal data inventory, because every duty in the PDPA depends on knowing where the data is. Then work through the rest in this order:
- Inventory personal data in every system, database, file share, cloud app and backup, with its owner and location.
- Classify sensitive data, including biometric data, because the DPO trigger counts sensitive data on more than 10,000 data subjects.
- Close Security Principle gaps: enable MFA, patch exposed systems, encrypt devices and backups, and test a full restore.
- Set retention and deletion rules for each data set, including backups and retired disks.
- Write the breach procedure: who contains the breach, assesses harm, notifies the Commissioner and drafts the notice to individuals.
- Check the three DPO triggers, and review vendor contracts so that processors accept security duties.
Frequently Asked Questions
Are Data Processors Liable Under the PDPA?
Yes, data processors have been directly bound by the Security Principle since 1 April 2025, according to the Data Protection Report. The Amendment Act extends section 9 to “a data controller and a data processor” and applies the same penalty.
Can a Business Outsource Its Data Protection Officer?
Yes, the Commissioner’s DPO circular allows the DPO to be an existing employee or an outsourced provider under a service contract. Appointing one does not release the controller from its own duties under the Act.
What Happens If a Business Misses the 72-Hour Deadline?
A late notice must carry the reasons for the delay and supporting evidence, according to the Commissioner’s breach notification circular. Failing to notify at all is an offense under section 12B of the Amendment Act, with a fine of up to RM250,000, imprisonment of up to two years, or both.
Is Biometric Data Sensitive Personal Data?
Yes, the Amendment Act adds biometric data to the definition of sensitive personal data. It defines biometric data as personal data resulting from technical processing that relates to a person’s physical, physiological or behavioral characteristics.
