What are the Malaysia PDPA compliance deadlines?

Jan 1, 2025: PDPA amendments phase 1. Apr 1, 2025: PDPA amendments phase 2. Jun 1, 2025: PDPA amendments phase 3.

When does Malaysia PDPA take effect?

Malaysia PDPA took effect on Nov 15, 2013.

Who does Malaysia PDPA apply to?

Anyone processing personal data in commercial transactions in Malaysia, or using equipment in Malaysia for processing (federal and state governments excluded). Certain classes of data controllers must register. The DPO and breach notification guidelines set scale-based triggers.

What are the penalties under Malaysia PDPA?

General offences: fine up to RM 1,000,000 and/or imprisonment up to 3 years (raised from RM 500,000 / 2 years).

Malaysia PDPA

Amended Malaysia · In force Nov 15, 2013 · no upcoming deadlines

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

ComplianceJun 1, 2025 · 17 months ago · Source

PDPA amendments phase 3Mandatory DPO appointment, data breach notification, and data portability take effect.

Takes effectApr 1, 2025 · 19 months ago · Source

PDPA amendments phase 2'Data controller' terminology, biometric data as sensitive data, higher penalties, Security Principle for processors, and removal of the cross-border whitelist take effect.

Takes effectJan 1, 2025 · 22 months ago · Source

PDPA amendments phase 1Miscellaneous provisions commence (e.g. electronic service of notices).

Summaries for reference, not legal advice. Check the official text.

What it does

Malaysia's commercial-sector data protection law. The 2024 amendments, phased in during 2025, rename 'data users' as 'data controllers', add biometric data to sensitive data, apply the Security Principle directly to processors, replace the transfer whitelist with adequacy and safeguards tests, raise fines, and add mandatory DPOs, data breach notification and data portability.

Who it applies to: Anyone processing personal data in commercial transactions in Malaysia, or using equipment in Malaysia for processing (federal and state governments excluded). Certain classes of data controllers must register. The DPO and breach notification guidelines set scale-based triggers.
Penalties: General offences: fine up to RM 1,000,000 and/or imprisonment up to 3 years (raised from RM 500,000 / 2 years).
Enforced by: Personal Data Protection Commissioner (Jabatan Perlindungan Data Peribadi)
Official name: Personal Data Protection Act 2010 (Act 709), as amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727)
Citation: Act 709; Act A1727 (Royal Assent 9 Oct 2024, gazetted 17 Oct 2024)
Topics: Privacy, Breach notification, Biometrics, Data residency

Verified 2026-09-22 pdp.gov.my christopherleeong.com

Research notes

The phase breakdown comes from Christopher & Lee Ong's reading of the Minister's commencement notice; the pdp.gov.my notice page did not render its contents. The PDPA's original commencement (15 Nov 2013) is from established knowledge. Breach notification timelines (Commissioner within 72 hours; data subjects within 7 days) are in the Commissioner's guideline and were not re-verified here. The Personal Data Protection (Amendment) Act 2024 received royal assent on 9 Oct 2024; the original Act 709 came into force on 15 Nov 2013.

In forceAustralia

Australia Cyber Security Act (ransomware reporting)Australia's first standalone cyber law: mandatory reporting of ransomware or cyber-extortion payments within 72 hours, security standards for consumer smart devices, 'limited use' protections for information shared with ASD and the National Cyber Security Coordinator, and a Cyber Incident Review Board. Ransomware payment reporting has applied since 30 May 2025.In effect since Nov 30, 2024

AmendedAustralia

Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days

AmendedAustralia

Australia SOCI ActAustralia's critical infrastructure security law. Owners and operators of critical infrastructure assets must register ownership and operational information, and many must report cyber security incidents to the Australian Signals Directorate. Responsible entities for many asset classes must also keep a critical infrastructure risk management program. Systems of national significance face enhanced cyber security obligations, and the government has step-in and assistance powers.In effect since Jul 11, 2018

In forceChina

China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022

In forceChina

China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026

In forceChina

China Cross-Border Data Flow ProvisionsRelaxes China's data export regime by exempting common transfers (contracts with the individual, cross-border HR, emergencies, and non-CII transfers of PI of fewer than 100,000 people a year) and setting volume thresholds for when a CAC security assessment, standard contract or certification is needed. Data is not 'important data' unless regulators have notified or published it as such.In effect since Mar 22, 2024

In forceChina

China Cyber Incident Reporting MeasuresRequires network operators in China to grade cybersecurity incidents using an annexed grading guide and report incidents rated relatively major or above. CII operators must report within 1 hour, central government bodies within 2 hours, and other operators to the provincial CAC within 4 hours. A full post-incident report is due within 30 days after handling ends, and ransom demands must be disclosed.In effect since Nov 1, 2025

AmendedChina

China Cybersecurity LawChina's base cybersecurity statute: multi-level protection scheme duties for network operators, localization and security review duties for critical information infrastructure (CII) operators, and content controls. The 2025 amendment, in force from 1 January 2026, adds AI governance support, ties PI processing to PIPL, allows fines on first violations and sharply raises maximum fines.In effect since Jun 1, 2017

Questions about Malaysia PDPA

What are the Malaysia PDPA compliance deadlines?: Jan 1, 2025: PDPA amendments phase 1. Apr 1, 2025: PDPA amendments phase 2. Jun 1, 2025: PDPA amendments phase 3.
When does Malaysia PDPA take effect?: Malaysia PDPA took effect on Nov 15, 2013.
Who does Malaysia PDPA apply to?: Anyone processing personal data in commercial transactions in Malaysia, or using equipment in Malaysia for processing (federal and state governments excluded). Certain classes of data controllers must register. The DPO and breach notification guidelines set scale-based triggers.
What are the penalties under Malaysia PDPA?: General offences: fine up to RM 1,000,000 and/or imprisonment up to 3 years (raised from RM 500,000 / 2 years).

Deadlines

What it does

Related