PDPA MY
Personal Data Protection Act 2010
Malaysia
In force since 2013, amended 2024
Asia & Africa
Who must comply
Persons who process or control personal data in respect of commercial transactions in Malaysia.
Penalties
Fines up to RM 1 million and imprisonment for certain offenses, with higher amounts introduced by the 2024 amendments.
Key obligations
- Obtain consent for processing in commercial transactions
- Get explicit consent for sensitive personal data
- Provide a written notice of purpose in English and Malay
- Honor access and correction requests
- Notify breaches and appoint a data protection officer under the amendments
How ConsentX helps
Consent capture for commercial processing
Explicit opt-in for sensitive categories
Bilingual notice support in the banner
Access and correction request workflow
Region rule engine tuned for Malaysia
Get PDPA MY ready with ConsentX
This page is a plain-English summary for general information and is not legal advice. Confirm your obligations with qualified local counsel.
How to comply with PDPA MY using ConsentX
- 1
Scan your website
Run a free scan to find every cookie and tracker on your site, so you know exactly what needs consent under PDPA MY.
- 2
Show a geo-aware consent banner
Add the ConsentX banner. It detects each visitor region and shows the consent experience that PDPA MY requires, automatically.
- 3
Block trackers until consent
Keep non-essential cookies and trackers blocked until the visitor agrees, so nothing fires before consent.
- 4
Record tamper-evident proof
Every choice is stored as a tamper-evident consent receipt you can produce in a PDPA MY audit.
- 5
Handle data requests on time
Use the built-in DSAR workflow with SLA timers to answer access, deletion and opt-out requests within the legal deadline.
Frequently asked questions
Does Malaysia's PDPA require consent?+
Yes. Processing personal data in commercial transactions requires consent, and sensitive data requires explicit consent.
Did Malaysia update its PDPA?+
Yes. The 2024 amendments add mandatory breach notification, a data protection officer requirement and higher penalties.