Following the 2024 amendments to the Personal Data Protection Act 2010 and Circular of Personal Data Protection Commissioner No. 1/2025, many businesses in Malaysia that collect or handle personal data will be legally required to appoint a Data Protection Officer (DPO).
However, depending on the nature and scale of its personal data processing activities, a business may not be required to appoint a DPO at all, or be required to appoint several!
To know if your business needs to appoint a DPO, keep reading to the end.
Which organisations need to appoint a DPO?
According to the DPO Appointment Guideline by the Department of Personal Data Protection (PDP), an organisation must appoint a DPO if any of the following applies:
- you process personal data of more than 20,000 individuals
- you handle sensitive personal data (e.g. health) of over 10,000 individuals, or
- your activities involve regular and systematic monitoring of individuals
The Guideline also states that if your organisation determines these thresholds are not met, you may maintain a record of the justification for not appointing a DPO.
An exception in cases of “urgency”
Even if the thresholds are not met, where there is an urgency, the Commissioner may still require the appointment of a DPO.
While the Guideline does not define what constitutes “urgent”, organisations should evaluate and document any circumstances that could warrant such urgency.
Ultimately, it is the organisation’s responsibility to assess whether the thresholds are met, or, if they are not, to determine whether an appointment is still necessary, and to be prepared to justify that decision if requested by the Commissioner.
DPO appointment options
If your organisation is required to appoint a DPO, you generally have two options:
- Appoint an internal team member (e.g. compliance officer, legal counsel, or IT lead); or
- Outsource the DPO function to a qualified external service provider.
Refer to our in-house vs outsourced DPO guide to evaluate which option works best.
Regardless, the appointment must be submitted by the organisation via the official PDPA system, administered by the Commissioner.
The obligation to appoint a DPO officially takes effect from 1 June 2025 and given the steps involved in identifying, assessing, and formally registering your DPO, organisations are strongly encouraged to begin the process as early as possible.
Book a free DPO readiness consultation
Whether you are planning to appoint someone internally or explore an outsourced solution, our team can guide you through the requirements and help you make a confident and compliant decision.
Book a free DPO readiness consultation with us today and take the first step toward PDPA compliance.
