MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
1.2 Rights and Obligations Data controllers (ie, persons who process personal data or have control or authority over the process - ing of personal data) are required to comply with the relevant requirements under the PDPA. This includes the requirement to comply with the seven personal data protection principles (“PDP Principles”), namely: • General Principle (Section 6) – this is the general requirement to obtain the consent of data subjects for the processing of their personal data, unless any of the PDPA exemptions apply. Additionally, the processing of personal data must be for a lawful purpose directly related to the data control - ler’s activities and be adequate, relevant and not excessive in relation to that purpose. Finally, where sensitive personal data is involved, data controllers are required to obtain the explicit consent of the data subject unless one of the relevant exemptions under Section 40 applies; • Notice and Choice Principle (Section 7) – this is the requirement to issue a written privacy notice in both Bahasa Malaysia and English, setting out the relevant information required under Section 7 of the PDPA; • Disclosure Principle (Section 8) – this is the prohi - bition from the disclosure of personal data with - out the data subject’s consent, except where the disclosure is for purposes or to parties specified in the data controller’s privacy notice, or where an exemption under the PDPA applies; • Security Principle (Section 9) – this is the require - ment to take practical steps to protect personal data from any loss, misuse, modification, unauthor - ised or accidental access or disclosure, alteration or destruction by having regard to the matters specified in the PDPA; • Retention Principle (Section 10) – this is the obli - gation to only retain personal data for the period necessary to achieve the purpose for which it was collected and processed, and to destroy or permanently delete such data when it is no longer needed; • Data Integrity Principle (Section 11) – this is the requirement to take reasonable steps to ensure that personal data is accurate, complete, not mis - leading, and kept up to date; and
• the Data Protection by Design Guideline (“DPbD Guideline”); and • the Automated Decision Making and Profiling Guideline (“ADMP Guideline”). In addition to the above guidelines, sector-specific codes of practice have also been developed, includ - ing for banking and financial services, healthcare, and the aviation sector. These codes set out additional obligations tailored to the operational circumstances of each sector and industry. Sector-Specific Requirements In addition to the PDPA, there are data protection requirements prescribed by sector-specific regula - tions. For example, in the banking and financial sec - tor, Section 133 of the Financial Services Act 2013 (FSA) imposes secrecy obligations, except where one of the conditions for permitted disclosure is met. Bank Negara Malaysia (BNM)’s Risk Management in Technology (RMiT) policy document requires financial institutions to establish comprehensive cyber crisis management frameworks, including a cyber-incident response plan. The Management of Customer Infor - mation and Permitted Disclosures (MCIPD) policy document further prescribes detailed measures and controls governing the collection, storage, use, trans - mission, sharing, disclosure and disposal of customer information. Data Sharing Between Public Sector Agencies Where personal data is shared between federal pub - lic sector agencies, the Data Sharing Act 2025 (DSA) applies. The DSA imposes statutory duties on public sector agencies that request or provide data to other agencies, including requirements to take appropriate measures to safeguard the security and confidential - ity of the data, maintain records of the shared data, and report any unauthorised disclosure to the Director General of the National Digital Department (DGNDD). Taken as a whole, Malaysia’s data governance frame - work operates on a layered basis. The PDPA governs private-sector processing of personal data in com - mercial contexts, supplemented by sector-specific regulatory instruments and codes of practice.
288 CHAMBERS.COM
Powered by FlippingBook