MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
Christopher & Lee Ong Level 22 Axiata Tower No 9 Jalan Stesen Sentral 5
Kuala Lumpur Sentral 50470 Kuala Lumpur Malaysia
Tel: +603 2273 1919 Fax: +603 2273 8310 Email: clo-info@christopherleeong.com Web: www.christopherleeong.com
1. Legal and Regulatory Framework 1.1 Overview of Data and Privacy-Related Laws In Malaysia, the data protection and privacy law is provided for in the federal constitution as well as in a dedicated act of parliament governing the collection of personal data in the context of commercial trans - actions. Federal Constitution The federal constitution of Malaysia does not express - ly list privacy as a fundamental right. However, Malay - sian case law has, in limited circumstances, interpret - ed the right to life and personal liberty under Article 5 (1) as encompassing a right to privacy. Personal Data Protection Laws in Malaysia The Personal Data Protection Act 2010 (PDPA) acts as the primary legislation governing the collection and processing of personal data in commercial transac - tions. In line with that, the Personal Data Protection Commissioner (the “Commissioner”) and the Depart - ment of Personal Data Protection ( Jabatan Perlind- ungan Data Peribadi or JPDP) were established to implement and enforce the PDPA. Since the PDPA came into force, several subsidiary regulations and guidelines have been introduced, including: • the Personal Data Protection Regulations 2013 (PDP Regulations);
• the Personal Data Protection (Class of Data Users) Order 2013; • the Personal Data Protection (Registration of Data User) Regulations 2013; • the Personal Data Protection Standard 2015 (PDP Standard); • the Guide to Prepare Personal Data Protection Notice 2022; and • the General Code of Practice of Personal Data Protection. Pursuant to the Personal Data Protection (Amend - ment) Act 2024 (the “Amendment Act”), a suite of guidelines have been, or will be issued by the Com - missioner. These include, namely: • the Data Breach Notification Guideline (“DBN Guideline”) (issued 25 February 2025); • the Appointment of Data Protection Officer Guide - line (“DPO Guideline”) (issued 25 February 2025); • the Right to Data Portability Guideline (“Data Port - ability Guideline”); • the Cross Border Data Transfer Guideline (“CBDT Guideline”) (issued 29 April 2025); • the Management of Data Protection Officer Training Service Providers Guideline (issued 21 July 2025); • the Data Protection Officer Competency Guideline (issued 21 July 2025); • the Data Protection Officer Professional Develop - ment Pathway & Training Roadmap (issued 21 July 2025); • the Data Protection Impact Assessment Guideline;
287 CHAMBERS.COM
Powered by FlippingBook