Currently, Malaysia does not have a data breach notification requirement under the Personal Data Protection Act 2010 (PDPA). One of the proposed amendments to be tabled for Parliament discussion in October 2022 is the introduction of a mandatory data breach notification regime.

Proposed amendments to the PDPA are expected to be tabled at the next Parliament sitting in October 2022. These amendments were selected from the public consultation paper on proposed reforms to the PDPA issued by the Personal Data Protection Commission (PDPC) in February 2020. Although there are 22 proposed amendments in the public consultation paper, it has been reported that only 5 out of those 22 proposed amendments will be tabled for discussion this year.

The proposed amendments include the introduction of a mandatory data breach notification requirement under the PDPA, which will require notifiable personal data breaches to be reported to the PDPC within 72 hours. The PDPC has proposed to issue guidelines to assist organisations to comply with this new notification requirement.

Based on publicly available information, the other 4 proposed amendments to be tabled for Parliament discussion are:

  • impose a direct obligation on data processors to comply with security principles under the PDPA;
  • require the appointment of a data protection officer;
  • the right to data portability, i.e. a data user should transfer personal data of a data subject to another data user in a user-friendly machine readable format at the request of the data subject data if this is technically feasible; and
  • instead of a whitelist, a blacklist of jurisdictions for cross-border data transfer out of Malaysia would be issued.
Our observations

Similar to other jurisdictions across Asia, the proposed amendments to PDPA will bring the Malaysia PDPA more in line with the EU General Data Protection Regulation, which is often regarded as the global standard.

It would be advisable for businesses to follow these developments closely to ensure that their current business practices will be updated to comply with the new requirements under PDPA.

For further information, please contact Mark Robinson, Peggy Chow, Sue May Yeo or your usual Herbert Smith Freehills contact.

Disclaimer
Herbert Smith Freehills LLP is licensed to operate as a Qualified Foreign Law Firm in Malaysia. Where advice on Malaysian law is required, we will refer the matter to and work with licensed Malaysian law practices where necessary.

Mark Robinson
Mark Robinson
Partner, Singapore
+65 6868 9808
Peggy Chow
Peggy Chow
Of Counsel, Singapore
+65 6868 8054
Sue May Yeo
Sue May Yeo
Associate, Kuala Lumpur
+60 3 2777 5000