Malaysia: compliance overview

1 regulations, 4 mapped obligations and 0 data-transfer routes, organised by when they start to bind you and what you have to do.

Filter the obligations that bind us Contact an advisor

Regulatory timeline: what comes next

2025-08-01
JPDP issues the DPO Competency Guideline and the Management of DPO Training Service Providers Guideline
Malaysia Personal Data Protection Act and current regulatory requirements
2025-08-25
JPDP publishes Public Consultation Paper No. 4/2025 on amending the Personal Data Protection Regulations 2013
Malaysia Personal Data Protection Act and current regulatory requirements

Applicable regulations (1)

AmendedData & privacyRelevance Medium

Malaysia Personal Data Protection Act and current regulatory requirements

A Chinese AI company faces Malaysian compliance where it: (1) establishes an entity in Malaysia and processes customer or employee personal data, and must register if it falls within the classes of data controllers published by JPDP (spanning communications, banking, insurance, health, education, tourism, employment agencies, real estate, utilities, pawnbrokers and moneylenders); (2) supplies SaaS, model APIs or processing services to Malaysian business customers and must support their security and breach-reporting duties, with notification deadlines set by contract; or (3) suffers a personal-data security incident in Malaysia, which must be reported through the DBN system. Note that this entry does not verify the commencement dates or wording of the individual 2024 amendments to Act 709, so conclusions on cross-border transfer, direct processor duties and penalty amounts must be checked against the official statute.

4 obligations · reviewed 2026-09-12

Sources (4)

Department of Personal Data Protection (Malaysia) — Personal Data Protection Act 2010 (Act 709) pageDepartment of Personal Data Protection (JPDP), Malaysia · retrieved 2026-09-12
JPDP (Malaysia) — registration of prescribed classes of data controllersDepartment of Personal Data Protection (JPDP), Malaysia · retrieved 2026-09-12
JPDP (Malaysia) — Data Breach Notification (DBN) reporting pageDepartment of Personal Data Protection (JPDP), Malaysia · retrieved 2026-09-12
JPDP (Malaysia) — Data Protection Officer (DPO) Competency GuidelineDepartment of Personal Data Protection (JPDP), Malaysia · published 2025-08-01 · retrieved 2026-09-12

Content as of 2026-09-12 · corpus 2026.09|Compiled from public official sources with links and review dates for compliance decision support. Rules change; have licensed professionals review before external disclosure, regulatory filing or contractual commitments.