PDPA Compliance Basics for Foreign Companies in Malaysia

The Personal Data Protection Act governs the processing of personal data in commercial transactions in Malaysia. If your Malaysian entity holds customer, employee or supplier data — which is to say, if it operates — it is in scope.

A GDPR policy is not a PDPA policy

The most common assumption among European and multinational groups is that a GDPR-compliant framework covers Malaysia by implication. It does not. The two regimes share ancestry and a good deal of vocabulary, but they differ in registration requirements, in the treatment of consent, in cross-border transfer rules, and in enforcement.

A group policy is a reasonable starting point. It is not a compliance position.

The principles

The Act is built on a set of principles that shape everything else. In outline:

• General — processing requires the data subject's consent, subject to the exceptions the Act provides
• Notice and choice — data subjects must be informed of what is collected, why, who it may be disclosed to, and their rights over it
• Disclosure — data may not be disclosed for purposes beyond those notified, or to parties beyond those notified
• Security — practical steps must be taken to protect data against loss, misuse and unauthorised access
• Retention — data must not be kept longer than necessary for its purpose
• Data integrity — data must be accurate, complete and current
• Access — data subjects may request access to their data and correction of it

The privacy notice

The notice obligation has a specific and frequently missed requirement: the notice must be given in both Bahasa Malaysia and English. A privacy policy published only in English does not satisfy it.

For a foreign-owned company this usually means the group's existing notice needs to be adapted rather than translated — adapted to describe what the Malaysian entity actually does with data, and then produced in both languages.

Registration

Certain classes of data user are required to register with the Personal Data Protection Commissioner. The classes are prescribed and cover a range of sectors. Whether your activity falls into a registrable class needs to be checked against the current order rather than assumed either way, since the classes have been revisited.

Cross-border transfer

Transfers of personal data out of Malaysia are restricted and permitted only in the circumstances the Act allows. For a subsidiary that routinely sends employee or customer data back to a parent company abroad — which describes most foreign-owned entities — this is not a peripheral issue. It is the provision most likely to be breached in ordinary daily operation, without anybody noticing.

If your Malaysian entity uses group IT systems hosted elsewhere, that is a cross-border transfer and needs to be addressed on its terms.

Enforcement and amendments

Non-compliance carries penalties including fines and, for certain offences, imprisonment. The Act has been amended, with changes affecting areas including breach notification and the treatment of data processors. Anyone working from an understanding formed several years ago should refresh it.

A workable starting position

1. Establish what personal data the Malaysian entity holds, where it came from, and where it goes
2. Determine whether you fall into a registrable class
3. Produce a privacy notice that describes actual practice, in both required languages
4. Address cross-border transfers explicitly, particularly to the parent
5. Document your security measures and retention periods rather than leaving them implicit
6. Put a process in place for access and correction requests before you receive one

This is one of the areas where the gap between "we have a group policy" and "we are compliant in Malaysia" is widest. Tell us how your data actually flows and we will map the gap.