This article provides a brief overview of the PDPA framework in Malaysia for businesses, including key principles that guide how organisations should collect, use and safeguard personal data.
Personal data under PDPA
Under the PDPA, personal data generally refers to any information that can directly identify a person, as well as information that can identify a person when combined with other data.
In a business context, personal data may include information such as:
- names
- identification numbers (such as NRIC or passport numbers)
- phone numbers or email addresses
- residential addresses
- employment records
- financial or transaction details.
Personal data can exist in many forms, whether stored electronically in databases and systems, or contained in physical documents such as application forms, contracts, or personnel files.
Data controllers
Under the PDPA, the primary obligations fall on organisations that control or determine how personal data is processed. Such organisations are commonly referred to as data controllers.
In practice, most businesses that collect or process personal data during commercial activities will fall within this category, and those that meet certain thresholds are required to appoint a Data Protection Officer (DPO).
Key principles
The PDPA establishes seven core principles that govern how organisations should handle personal data in the course of commercial activities:
- General Principle: Personal data should generally not be processed without the consent of the individual, unless permitted under the PDPA.
- Notice and Choice Principle: Organisations must inform individuals about how their personal data will be collected, used and disclosed.
- Disclosure Principle: Personal data should not be disclosed to third parties for purposes other than those originally communicated to the individual, unless further consent is obtained or the disclosure is permitted by law.
- Security Principle: Organisations must take practical steps to protect personal data from loss, misuse, unauthorised access, or disclosure. This may include implementing appropriate technical, administrative and physical safeguards.
- Retention Principle: Personal data should not be kept longer than necessary for the purpose for which it was collected. Once the data is no longer required, organisations should take reasonable steps to delete or dispose of it securely.
- Data Integrity Principle: Organisations should take reasonable steps to ensure that personal data is accurate, complete, and kept up to date.
- Access Principle: Individuals have the right to request access to their personal data and request corrections if the information is inaccurate or incomplete.
These principles form the foundation of PDPA compliance and guide how organisations should manage personal data throughout its lifecycle.
Individual rights
In addition to imposing obligations on organisations, the PDPA also grants certain rights to individuals whose personal data is being processed:
- Right of Access: Individuals can request access to the personal data held by an organisation, subject to certain conditions under the PDPA.
- Right to Correction: Individuals can request corrections if their personal data is inaccurate, incomplete, misleading, or not up to date.
- Right to Withdraw Consent: In certain circumstances, individuals may withdraw their consent for the processing of their personal data.
- Right to Data Portability: Individuals can request that their personal data be transferred to another data controller.
- Right to Prevent Processing: Individuals may request that their personal data is no longer used for direct marketing purposes or when processing is likely to cause damage or distress.
In practice, organisations should have clear internal procedures for receiving and responding to such requests. Having proper processes in place helps organisations manage these requests effectively while ensuring compliance with the PDPA.
Consequences of non-compliance
Failure to comply with the requirements of the PDPA may expose organisations to enforcement actions under the Act, which may include financial penalties or other sanctions prescribed by law, in addition to operational and reputational risks for businesses.
Further reading
This summary is a consolidation of our various dedicated guides and for a deeper understanding of a particular PDPA topic, readers may want to see:
- whether you need to appoint a DPO
- PDPA compliance for marketing departments
- a full PDPA compliance framework
- cross-border data transfers
- PDPA-compliant AI use in businesses
- handling data breach notifications
PDPA compliance in 90 days with ELP
If your business requires assistance in reviewing data protection practices, preparing privacy notices, or developing PDPA compliance frameworks, our team at ELP can help ensure your organisation’s data handling practices align with the requirements of the PDPA.
