Published February 8, 2021.
Malaysia’s Personal Data Protection Act (PDPA) regulates the processing of personal data for commercial use inside the country. It applies to any website, company or organization located inside Malaysia.
Malaysia’s PDPA requires you to obtain end-user consent prior to processing any personal data, and to inform Malaysian users about the details of your website’s data processing.
Malaysia’s Personal Data Protection Act (PDPA) was passed in 2010, took effect in 2013 and was last updated in 2016.
Malaysia’s PDPA revolves around end-user consent, requiring your website to first obtain express and explicit consent from its visitors before activating any cookies and trackers that process personal data, much like other major data privacy laws around the world such as the EU’s GDPR, Brazil’s LGPD and South Africa’s POPIA.
The Malaysian PDPA governs the commercial use of personal data, and does not apply to the public sector, federal or state governments.
Did you know that a website on average has 21 cookies in use?
Scan your website for free to detect and control them all
In short, Malaysia’s PDPA requires that you obtain end-user consent, requires you to inform Malaysian users about your website’s data processing, empowers Malaysian residents with the rights to access and correct their data, regulates all personal data processing through its 7 PDPA Principles. It is enforced by the Department of Personal Data Protection (PDP) and applies to any website, company or organization in Malaysia that processes personal data from Malaysian residents.
Malaysia’s PDPA quick breakdown –
Under Malaysia’s PDPA, Malaysian residents are empowered with enforceable rights over their personal data.
Cookiebot CMP is a world-leading solution for controlling all cookies and trackers on your website to ensure compliance with major data privacy laws around the world, including Malaysia’s PDPA, EU’s GDPR, UK’s GDPR, California’s CCPA, Brazil’s LGPD, South Africa’s POPIA and many others.
Since Malaysia’s PDPA requires you to ask for and obtain the express and explicit consent from Malaysian users before using cookies and trackers on your website, Cookiebot CMP is the optimal solution to make your domain fully compliant without any need for complex technical implementation on your end.
Cookiebot CMP is a plug-and-play compliance solution that has automated the entire PDPA compliance process – from automatically detecting all your website’s cookies and controlling them, to collecting the PDPA compliant consents from end-users and securely storing them, as well as renewing them regularly.
Consent banner by Cookiebot CMP for PDPA compliance in Malaysia.
By giving you detailed information on each cookie on your website, including the purpose, duration, technical specifications and provider, Cookiebot CMP enables your website to meet the notification and information requirements necessary for PDPA compliance in Malaysia.
Cookiebot CMP comes with highly customizable consent banners to match your website’s layout and can be shaped to fit compliance requirements under most other major data privacy laws in the world.
Let’s break down Malaysia’s PDPA in detail and have a look at its 7 PDPA Principles, which spell out the specifics of its compliance requirements, as well as making a comparison between Malaysia’s PDPA and the EU’s GDPR.
The Personal Data Protection Act (PDPA) forms Malaysia’s data privacy regime and is accompanied by both the Personal Data Protection Regulations (PDPR) 2013 that detail the practical aspects of PDPA compliance, and the Codes of Practice 2017 that set best-practice standards for PDPA compliance in each sector of Malaysia.
Under Malaysia’s PDPA, you are required to register as a data user with the Department of Personal Data Protection (PDP) if you process personal data within sectors such as communications, banking, finance, insurance, tourism, education, and others.
You are also required to, as part of the registration to Commissioner at the PDP, to appoint a representative responsible for PDPA compliance.
Under Malaysia’s data privacy law, compliance is governed by seven data protection principles that detail how your website is required to handle user’s personal data.
The seven Malaysian PDPA Principles are –
End-users are protected under Malaysia’s PDPA from unconsented data harvest by third parties.
Under the first Malaysian PDPA Principle called the “General Principle”, the requirement for your website to obtain the valid consent from users prior to any personal data collection is explained.
This PDPA Principle states that consent must be an explicit, affirmative opt-in on part of a user for it to be valid under Malaysia’s PDPA.
This means that implied consent does not constitute valid consent under Malaysia’s PDPA (e.g. having a cookie banner on your website saying that personal data is being collected with no real way for users to first consent to the collection or to opt out).
In general, under Malaysia’s PDPA, personal data is only allowed to be processed if it’s –
Exceptions to the consent requirement are also detailed and include situations such as when personal data is collected in order to fulfill a contract, among others.
For data to be regarded as personal data under Malaysia’s PDPA, it must meet the following three thresholds –
Sensitive personal data includes –
There are no specific requirements in regard to consent when it comes to sensitive personal data – all consents must be explicit and express opt-in on part of the end-user.
Under Malaysia’s PDPA, personal data includes the stuff that most cookies on websites process: IP addresses, search history, browser history, device details and unique IDs.
The second PDPA Principle explains how you must give end-users a prior notice about- and detailed information on your website’s personal data processing activities.
You must inform your Malaysian end-users about –
This notice for your Malaysian end-users forms part of the basis for the consent requirement, since users must know what they are consenting to.
The notice must be given before any processing takes place of personal data from end-users, and it must be given in both Malay and English.
Disclosure of personal data to any third party is prohibited by Malaysia’s PDPA unless explicit consent has been obtained from the end-user.
This means that whatever personal data your website collects through its cookies and trackers, e.g. via analytics services or social media plugins, can only be shared with anyone else if your website’s visitors have given you their express consent to do so.
In general, sharing and disclosure of personal data is restricted to the purposes stated in your notice and information to the end-user and limited to the third parties that you’ve listed.
Correct and accurate lists of third parties that your website shares personal data with can be requested by the Personal Data Protection Department of Malaysia (PDPD) and subject to inspection.
While transfers of personal data abroad is not prohibited under Malaysia’s PDPA, end-users must consent to all third parties, who their personal is shared with.
Under Malaysia’s PDPA, it is mandatory for you to put in place safeguards to protect whatever personal data you collect from end-users.
To meet this PDPA compliance requirement, your website must have a security policy that details, among others –
The legal responsibility of protecting Malaysian end-users’ personal data includes, - but is not limited to - technical security measures (e.g. safe storage, encryption, safe transfer means), organizational security measures (e.g. appointed compliance personnel, access and authorizations) and safeguarding personal data from misuse and abuse (e.g. unconsented disclosure, data breaches and loss).
Once you’ve collected personal data from end-users, you’re only allowed to retain (or store) it for the amount of time necessary for the fulfilment of the purpose, which you stated in your notice and information.
Under Malaysia’s PDPA, once personal data has been used for the purpose it was collected for, your website is legally required to delete it.
There are no standard minimum retention periods detailed in Malaysia’s PDPA, but it is up to you to determine the minimum necessary duration for storing personal data collected on your website (with regard to the purpose for which it was initially collected, of course).
However, there are certain additional requirements that you need to be aware of, such as –
You’re not allowed to collect more data or to keep it for longer than necessary, under Malaysia’s PDPA.
“Data integrity” means the responsibility that – under Malaysia’s PDPA – rests on you and your website’s shoulders to always make sure that the personal data collected from end-users is complete, accurate and up to date.
It’s the right of Malaysian end-users to request access to see what personal data you’ve collected on them, e.g. through cookies and trackers on your website – and to request correction of that data, if they find it to be incomplete, inaccurate or misleading.
Malaysia’s PDPA is very similar to the EU’s GDPR in key areas, chief among them being prior consent and rights to access and correct personal data.
Prior consent is perhaps the most famous part of the EU’s GDPR and Malaysia’s equivalent regime puts it on the map as one of the consent-focused data privacy laws in the world, alongside Brazil’s LGPD, Canada’s PIPEDA, South Africa’s POPIA and Singapore’s PDPA – and setting it apart from opt-out focused laws like California’s CCPA.
But while Malaysia’s PDPA and the EU’s GDPR look quite similar, the two data privacy laws are different in key areas.
Big differences between the PDPA and GDPR include –
Core similarities, yet big differences between the PDPA and GDPR in Malaysia and EU.
Cookiebot CMP enables compliance with major data privacy laws
Try Cookiebot CMP free for 30 days – or forever if you have a small website
Malaysia’s Personal Data Protection Act (PDPA) is one of the world’s consent-based data privacy laws, empowering Malaysian residents with enforceable rights to their personal data, and requiring websites and companies located inside Malaysia to play by fair rules so as not to abuse the data privacy of visitors and customers.
Malaysia’s PDPA is scheduled to be updated sometime in the next couple of years.
Malaysia’s Personal Data Protection Act (PDPA) is the data privacy law in effect in Malaysia, which governs the processing of personal data from Malaysian residents for commercial use. Malaysia’s PDPA took effect in 2010 and was last amended in the summer of 2016.
Compliance with Malaysia’s PDPA for your website means to obtain the express/explicit consent from Malaysian end-users before processing any of their personal data, and to notify them with detailed information on your website’s data processing activities, such as what kinds of data you collect, for what purposes and who you share it with.
Malaysia’s PDPA defines personal data broadly as any information that can identify an individual either directly or indirectly. This includes data that most websites in the world process through cookies and trackers, such as IP addresses, search and browser history, device details, unique IDs and many other kinds of online data.
Websites, companies and organizations located inside Malaysia and who process personal data from Malaysian residents are liable for PDPA compliance. Malaysia’s PDPA does not currently have extraterritorial scope, meaning that it does not apply to anyone outside of Malaysia, and does not prohibit transfers of personal data outside of Malaysia either.