Describe your business, leave with a checklist you can assign

Set the DPO’s competency requirements and scope of duties in line with JPDP’s Data Protection Officer (DPO) Competency Guideline of 1 August 2025, make the designation, and register the DPO under JPDP’s DPO registration guidance. JPDP issued a Management of DPO Training Service Providers Guideline at the same time, indicating regulatory expectations about the source of DPO training; training providers should be checked against it.

Evidence: DPO appointment document and terms of reference; Qualification check against the JPDP Competency Guideline; Records of the DPO registration filing; DPO training records and checks on the training provider

First determine whether the company’s Malaysian activity falls within the classes of data controllers published by JPDP — communications, banking and finance, insurance, health, education, tourism and hospitality, employment agencies, real estate development, utilities, pawnbrokers, moneylenders and others. If so, submit a new or renewal application and obtain the registration certificate; JPDP states that complete applications are reviewed and the status notified within 14 working days. Changes to registered particulars, replacement of a certificate or cancellation must be handled under JPDP’s separate guidance.

Evidence: Assessment of whether a prescribed class applies; Registration application pack and the registration certificate; Records of any change, replacement or cancellation of registration; Certificate validity tracking and renewal reminder mechanism

Build a breach response process that can be triggered on the Malaysian side and file through JPDP’s Data Breach Notification (DBN) system. JPDP publishes a DBN system user manual; account provisioning, preparation of the reporting fields and internal rehearsals should be completed in advance rather than improvised during an incident. Chinese vendors acting as processors should contractually commit to immediate notification to the Malaysian customer so it can file on time.

Evidence: DBN system account provisioning and access records; Incident response plan including the Malaysian filing path; Filing records and acknowledgements; Contractual notification-deadline clauses with processors; Internal rehearsal records

AI incident and serious incident reporting record (register plus report drafts)

Act 709 is structured around a set of personal data protection principles — notice and choice, consent, disclosure, security, retention, data integrity and access. Companies should implement: a bilingual privacy notice in Malay and English; consent capture and record-keeping; restrictions and approvals for external disclosure; security measures; a retention schedule and destruction mechanism; maintenance of data accuracy; and a process for handling data-subject access and correction requests. The precise statutory wording, including as amended in 2024, must be taken from the official text of the Act.

Evidence: Bilingual privacy notice in Malay and English; Consent records and withdrawal mechanism; Retention schedule and destruction execution records; Register of access and correction requests; Evidence of security measures implemented