MALAYSIA Trends and Developments Contributed by: Deepak Pillai, Yong Shih Han and Matthew Chang Jun Xiang, Christopher & Lee Ong
• DPO Professional Development Pathway & Training Roadmap. As a result of these amendments, data controllers/ processors will need to determine whether they are required to appoint a DPO and amend their internal policies and organisational structure to include this new role. Data controllers/processors that meet the threshold will be required to: • appoint a DPO, whether internally or externally (ie, through a service provider, such as a law firm, that offers external DPO services); • amend internal documents and policies to reflect the establishment of the DPO position in line with the responsibilities outlined under the DPO Guide - line; and • notify the Commissioner of the appointment. Introduction of the mandatory Data Breach Notification regime The Amendment Act introduced a new mandatory obligation on data controllers to notify the Commis - sioner and affected data subjects as to the occurrence of a personal data breach. This obligation is not a blanket requirement. Based on the Guideline on Data Breach Notification (the “DBN Guideline”), only data breaches that are of “significant harm” or “significant scale” are required to be reported to the Commis - sioner; whereas data breaches that are of “significant harm” require the affected data subjects to be notified. For clarity, the DBN Guideline provides that a data breach is considered to cause or is likely to cause “significant harm” if there is a risk that the compro - mised personal data: • may result in physical harm, financial loss, a nega - tive effect on credit records, or damage to or loss of property;
On the other hand, a personal data breach is of “sig - nificant scale” if the number of affected data subjects is more than 1,000. Data controllers that hit the above-mentioned thresh - olds will be required to notify the Commissioner within 72 hours from the occurrence of the personal data breach. On the other hand, notification to affected data subjects must be completed no later than seven days after the initial data breach notification is made to the Commissioner. In addition to the threshold and timelines, the DBN Guideline also imposes other requirements such as the information that is to be included in the notifica - tion, record-keeping requirements and containment actions that are to be carried out in the event of a data breach. As a result of the amendments, data controllers will need to review their internal data protection frame - work to ensure that their data breach response plans (including notification to the Commissioner), as well as their records, are up to the standards required under the DBN Guideline. Introduction of the new right to data portability The Amendment Act has introduced a new right to data portability, which enables data subjects to request that a data controller transmit their personal data to another data controller, subject to technical feasibility and compatibility of format. Based on the Public Consultation Paper on the Guide - line on Data Portability (the “Data Portability PCP”), the specific guidance on the implementation of this right, including the types of personal data covered under this right, the mechanisms for transfer as well as the timelines for compliance with this right, will likely be covered under the upcoming guideline as and when it is issued. Therefore, data controllers will need to wait for the issuance of the guideline to determine the policies and systems that may need to be put in place to provide this right to data subjects.
• may be misused for illegal purposes; • consists of sensitive personal data; or
• consists of personal data and other personal infor - mation which, when combined, could potentially enable identity fraud.
305 CHAMBERS.COM
Powered by FlippingBook