MALAYSIA Trends and Developments Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
Christopher & Lee Ong Level 22 Axiata Tower No 9 Jalan Stesen Sentral 5
Kuala Lumpur Sentral 50470 Kuala Lumpur Malaysia
Tel: +603 2273 1919 Fax: +603 2273 8310 Email: clo-info@christopherleeong.com Web: www.christopherleeong.com
The Personal Data Protection (Amendment) Act 2024 (the “Amendment Act”) was passed by the Malaysian parliament in Q4 of 2024, and introduced the first set of amendments to the Personal Data Protection Act 2010 (PDPA) since its inception. The amendments were introduced to deal with rapid advances in tech - nology and the increasing use of personal data, while also bringing the PDPA in line with international per - sonal data protection standards, such as the Euro - pean Union’s General Data Protection Regulation (EU GDPR). In addition to the amendments introduced by the Amendment Act, the Personal Data Protection Com - missioner (the “Commissioner”) issued several guide - lines to supplement the PDPA and to provide further guidance and clarification on the amendments intro - duced by the Amendment Act. That said, Malaysia’s personal data protection frame - work is currently still being reviewed and further devel - opments in 2026 are likely. These include amendments to the PDPA’s subsidiary regulation, the Personal Data Protection Regulations 2013 (“PDP Regulations”), as well as the issuance of several new guidelines. This article highlights the key amendments introduced by the Amendment Act as well as the guidelines that have been issued by the Commissioner. It will also analyse the significance of the amendments and guidelines and their impact on data controllers and data processors. Finally, this article will highlight the upcoming amendments and guidelines, to provide
organisations with an indication of what they need to do in order to prepare for PDPA compliance in the future. Key Changes Replacement of the term “Data User” with “Data Controller” The Amendment Act replaced the term “Data User” with “Data Controller”. While this amendment was primarily cosmetic in nature, it helped align terminology used in the PDPA with that of other countries. Malaysian data controllers should therefore update their personal data protec - tion documents and policies to reflect this change in terminology. Recognition of biometric data as a type of sensitive personal data The Amendment Act introduced “biometric data” as a new category of sensitive personal data. Sensitive personal data in turn is a subcategory of personal data that, due to its sensitive nature, is subject to stricter processing requirements. Examples of sensitive per - sonal data include a data subject’s physical or mental health or condition, political opinions, commission or alleged commission of an offence, and more recently, biometric data. Under the PDPA, the explicit consent of the data subject is required for the processing of their sensi - tive personal data (as opposed to consent for other types of personal data). Additionally, data controllers
303 CHAMBERS.COM
Powered by FlippingBook