Malaysia modernised its Personal Data Protection Act in three stages through 2025, adding data protection officers, mandatory breach notification, direct duties for processors and a right to data portability. Cross-border transfers moved from a whitelist to a GDPR-style test.
From 1 January 2026, the Online Safety Act and licensing of large social media platforms brought new content and child-safety duties for online services in Malaysia.
- Core data law
- Personal Data Protection Act 2010 (amended 2024)
- Regulator
- Personal Data Protection Commissioner
- New duties
- DPO, breach notification, portability (from 1 Jun 2025)
- Online safety
- Online Safety Act 2025, in force 1 Jan 2026
- Platforms
- Licensing for large social media and messaging services
- Penalties
- Fines up to RM1 million and imprisonment for some offences
Who needs to comply
Businesses processing personal data in commercial transactions in Malaysia
The PDPA applies to data controllers and, since 2025, directly to processors for security.
Social media, messaging and content platforms
The Online Safety Act and licensing rules apply to licensed and deemed-licensed platforms.
The laws, in detail
01Personal Data Protection Act (as amended)
Seven data protection principles, rights, DPOs, breach notification, transfers and portability.
When it applies
Processing personal data in commercial transactions in Malaysia, or using equipment in Malaysia.
What you must do
- Notice and choice, disclosure, security, retention, integrity and access principles
- Appoint a DPO where thresholds are met
- Notify the Commissioner of breaches as soon as practicable, and affected people where harm is likely
- Transfers where the destination has substantially similar law or adequate protection
- Portability where technically feasible
Regulator
Personal Data Protection Commissioner
Penalties
Fines up to RM1 million and/or imprisonment for certain breaches.
02Online Safety Act 2025
Platform duties on harmful content and child protection.
When it applies
Licensed application, content and network service providers, including deemed-licensed social media platforms.
What you must do
- Risk-based safety measures
- Child protections, including age assurance under codes
- User reporting and assistance mechanisms
Regulator
MCMC
Penalties
Fines under the Act and licence action.
03Cyber Security Act 2024
Cybersecurity duties for national critical information infrastructure (NCII) entities.
When it applies
Designated NCII entities and their providers.
What you must do
- Comply with codes of practice
- Risk assessments and audits
- Notify cybersecurity incidents promptly
Regulator
National Cyber Security Agency (NACSA)
Penalties
Fines and imprisonment for non-compliance.
04Securities Commission digital asset rules
Recognised market operators for digital asset exchanges, IEOs and custodians.
When it applies
Operating digital asset exchanges, custody or token offerings in Malaysia.
What you must do
- Registration as a recognised market operator
- Investor protection and technology risk rules
- AML/CFT compliance
Regulator
Securities Commission Malaysia
Penalties
Enforcement action and penalties.
Compliance checklist
01 · Before you launch
- Bilingual (Malay and English) privacy notice
- Map transfers against the new test
- Check platform licensing thresholds
02 · At launch
- Appoint a DPO if required and register their details
- Breach notification process
- User reporting tools
03 · As you scale
- Online Safety Act codes, including age assurance
- Portability requests
- Processor contracts with security duties
Key dates
- 1 Apr 2025Processor security duties
- 1 Jun 2025DPO, breach notification and portability
- 1 Jan 2026Online Safety Act in force; platform licensing
Common mistakes
- Notices only in English
- No DPO registration
- Ignoring platform licensing as user numbers grow
FAQs
Does Malaysia allow data transfers abroad?
Yes, where the destination has substantially similar law or adequate protection, or under listed exceptions.
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.