A founder we spoke with recently forwarded a procurement questionnaire from a larger customer. Halfway down was a question her team of nine engineers had never had to answer: “Who is your data protection officer, and how do you handle a data breach under the PDPA?” They had not appointed one, and had nothing written down for the second half. She is not unusual. Since Malaysia updated its data protection law, questions like these arrive from customers, not just regulators, and they tend to arrive before a contract is signed.
This is a plain guide to the questions software teams ask us about the Personal Data Protection Act 2010 (Act 709), roughly in the order they ask them. It is general information rather than legal advice, and where the details matter you should confirm them with a qualified adviser and against the official guidance from the Personal Data Protection Department.
Does the PDPA even apply to us?
Almost certainly, yes. The PDPA governs the processing of personal data in commercial transactions in Malaysia. If you hold names, emails, phone numbers, payment details, or your customers’ own users’ data, you are processing personal data, and the law now calls you a data controller. Being small does not exempt you.
It is worth clearing up a common confusion here. The Cyber Security Act 2024 is a separate law, and its main duties fall on designated National Critical Information Infrastructure entities in sectors such as banking, energy, and healthcare, not on ordinary small businesses. Unless your organisation has been specifically designated, the PDPA is the law that governs how you protect personal data.
What actually changed in 2024?
The Personal Data Protection (Amendment) Act 2024 (Act A1727) was gazetted in October 2024 and brought into force in stages through 2025. The changes that matter most to a software team took effect on 1 June 2025: mandatory data breach notification, a duty to appoint a data protection officer in some cases, and a new right to data portability.
Earlier in 2025 the law also replaced the term “data user” with “data controller”, made data processors directly responsible for security for the first time, added biometric data to the list of sensitive personal data, and raised the penalties. If you rely on subcontractors or hosting partners to process personal data, they now carry their own legal duty to secure it, rather than only a contractual one to you.
What counts as a breach we must report?
A personal data breach is, broadly, any loss, misuse, unauthorised access, or accidental disclosure of the personal data you hold. Since 1 June 2025, reporting is mandatory. You must notify the Commissioner as soon as practicable, and no later than 72 hours after becoming aware of the breach. If the breach is likely to cause significant harm to the people affected, you must also tell them, no later than seven days after you notify the Commissioner.
Seventy-two hours is not long once you factor in a weekend, an on-call engineer trying to understand what happened, and a management team deciding what to say. That clock is the strongest practical argument for preparing a response before you need one, which we cover in incident readiness without a security team.
Do we need a Data Protection Officer?
You must appoint one if you cross any of these thresholds: you process the personal data of more than 20,000 individuals; you process sensitive personal data, which now includes biometric and financial data, of more than 10,000 individuals; or your core activity involves regular and systematic monitoring of people. Many growing SaaS and platform businesses reach the first threshold sooner than they expect.
The officer does not have to be a new senior hire. It can be an existing, competent employee, or an external appointment, provided they are reachable and genuinely responsible for data protection. If you appoint one, you must notify the Commissioner within 21 days.
What happens if we get it wrong?
The amendment raised the penalties. Breaching the security principle, the part of the law that requires you to protect personal data with appropriate measures, can now bring a fine of up to RM1 million, up to three years’ imprisonment, or both. That is a meaningful increase from the previous ceiling.
In practice, the commercial pressure often arrives first. Enterprise customers increasingly ask about your data protection posture during procurement, and a weak or missing answer can cost you the deal long before any regulator is involved.
We use overseas cloud and SaaS. Is that a problem?
Most Malaysian software teams send personal data abroad the moment they use a foreign cloud region or a hosted analytics tool. The amendment removed the old, unused “whitelist” of approved countries. You may now transfer personal data overseas where the destination has a law substantially similar to the PDPA, or provides an adequate and equivalent level of protection, alongside some specific exceptions. The Commissioner issued cross-border transfer guidelines in April 2025 to explain how this works in practice. The starting point is simply knowing where your personal data goes and who processes it.
Where do we start?
Begin with an honest inventory: what personal data you hold, where it lives, who can reach it, and which third parties process it on your behalf. Almost every later decision depends on that map.
From there, appoint or assign a data protection officer if you are over a threshold, write a breach response plan that can move inside 72 hours, and review the agreements with your processors now that they carry their own security duty. Then work on the security principle itself, which is the technical heart of the law: access control, encryption where appropriate, logging you can actually use, and a way to detect a breach in the first place.
This is the part where the PDPA stops being paperwork and becomes an engineering question. Meeting the security principle is about how your systems are built and operated, not just what your privacy notice says. That is where senior technical advice helps most: turning a legal obligation into specific, sensible changes your team can make without stalling delivery. If a customer’s questionnaire has just landed on your desk, it is a good moment to get that conversation started.