MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
1.6 Data Breach Requirement Notification Requirement and Timeline
• isolate and disconnect the compromised database or system from the network; • suspend or disable compromised access rights; • stop the practices identified as having caused the data breach; and • determine whether the lost data can be recovered or whether any immediate remedial action can be taken to minimise further harm being caused by the breach. Data controllers are also required to conduct a post- breach evaluation to review the effectiveness of the data breach management and response plan, as well as its data protection practices and policies to prevent the recurrence of similar incidents. In addition, data controllers are required to keep and maintain written records and a register detailing all occurrences of personal data breaches for a period of at least two years from the date of notification to The PDPA does not expressly allow aggrieved claim - ants to pursue civil actions against data controllers for any breach of the provisions of the PDPA includ - ing for any loss or damage arising from a personal data breach. This position was affirmed in the Court of Appeal case of Ranjan Paramalingam & Anor v Persatuan Penduduk Taman Bangsar Kuala Lumpur [2023] 1 MLJ 459. However, claimants may still initi - ate civil actions against data controllers through other causes of action, such as breach of contract for the data controller’s breach of its obligations to protect the aggrieved claimant’s personal data. Sector-Specific Requirements Certain sectors also impose data breach notifica - tion requirements. For example, Paragraph 11 of the MCIPD lays out the exact requirements financial insti - tutions must comply with when dealing with customer information breaches. As notification of data breaches under the MCIPD is directed to BNM, the financial institution will also need to comply with the data breach notification requirements under the PDPA, and notify the JPDP within the prescribed timeframes. the Commissioner. Individual Claims
The PDPA read in line with the DBN Guideline impos - es a requirement on data controllers to notify the Commissioner of the occurrence of a personal data breach if the personal data breach causes, or is likely to cause, “significant harm” to data subjects or is of a “significant scale”. A personal data breach is con - sidered to be of a “significant scale” where it affects more than 1,000 data subjects. On the other hand, “significant harm” includes instances where there is a risk that the compromised personal data: • may result in physical harm, financial loss, a nega - tive effect on credit records or damage to or loss of property; • consists of personal data and other personal infor - mation which, when combined, could potentially enable identity fraud. Notification must be made as soon as possible and no later than 72 hours from the occurrence of the breach. If the data controller is unable to submit the notifica - tion to the Commissioner within 72 hours, the data controller must submit a written notice to the Com - missioner detailing the reasons for the delay, together with supporting evidence. Besides the Commissioner, data controllers must also notify affected data subjects if a breach results in, or is likely to result in, “significant harm” to the affected data subjects. Affected data subjects must be noti - fied of the personal data breach without unnecessary delay and in any case, no later than seven days after the initial data breach notification is made to the Com - missioner. Dealing With the Data Breach The DBN Guideline imposes a requirement on data controllers to act promptly as soon as they become aware of any personal data breach by assessing, con - taining and reducing the potential impact of the data breach, by considering the following immediate con - tainment actions where applicable: • may be misused for illegal purposes; • consists of sensitive personal data; or
291 CHAMBERS.COM
Powered by FlippingBook