MALAYSIA Law and Practice Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
5.4 Blocking Statutes There are currently no blocking or foreign-judgment control rules restricting foreign discovery, sanctions compliance, or cross-border disclosures in Malaysia. 5.5 Recent Developments Section 129 of the PDPA was amended by the Per - sonal Data Protection (Amendment) Act 2024, which came into effect on 1 April 2025. The Amendment Act removed the whitelist previously provided for under Section 129 (1) of the PDPA as well as Section 129 (3), which provided that personal data may be transferred outside Malaysia if the “transfer is necessary as being in the public interest in circum - stances as determined by the Minister”. Additionally, the Amendment Act introduced two new conditions, allowing data controllers to conduct their own assessments and transfer personal data outside Malaysia if: • the receiving place has any law in force that is sub - stantially similar to the PDPA; or • the receiving place ensures an adequate level of protection in relation to the processing of personal data which is at least equivalent to the level of protection afforded by the PDPA. The Commissioner has also issued the CBDT Guide - line which is meant to be read together with Section 129 of the PDPA.
work on Personal Data Protection, which aims to harmonise data protection standards across South- East Asia. In line with the principles under the ASEAN Framework on Personal Data Protection, the ASEAN Model Contractual Clauses for Cross Border Data Flows (“ASEAN MCCs”) were introduced. The ASEAN MCCs sets out the responsibilities, security measures and obligations of parties to the ASEAN MCCs and are designed for the use of private-sector parties in ASEAN member states. The use of the ASEAN MCCs was recognised in the CBDT Guideline as a method to comply with Sec - tion 129 (3)(f) of the PDPA, namely the requirement to take all reasonable precautions and exercise all due diligence. However, the CBDT Guideline recom - mends that data controllers review the ASEAN MCCs to determine whether any additional clauses need to be included. In addition to the general personal data protection- related requirements, data controllers in certain sec - tors may also be required to meet the relevant sec - tor-specific regulations or guidelines which impose requirements on cross-border data transfers. For example, financial institutions are required to comply with the relevant BNM guidelines, such as the RMiT, MCIPD and Outsourcing Policy Document. When engaging overseas cloud service providers, for exam - ple, financial institutions are required to first conduct due diligence on the service provider. 5.2 Government Notifications and Approvals Malaysia currently does not require any registrations, filings or approvals from authorities for international transfers of data. 5.3 Data Localisation Requirements There are currently no strict data localisation or resi - dency obligations in Malaysia. However, transfers of personal data outside Malaysia will need to comply with Section 129 of the PDPA.
301 CHAMBERS.COM
Powered by FlippingBook