The Personal Data Protection (Amendment) Act 2024 was the biggest change to Malaysia's data protection law since 2010. Its obligations have been in force since 2025. In 2026 the Personal Data Protection Commissioner has turned to the details, publishing new guidelines that explain how organisations should assess risk, design their processing and handle automated decisions.
Recap: The Amendments in Force Since 2025
The amendments took effect in three phases:
- 1 January 2025: mainly administrative changes
- 1 April 2025: "data user" becomes "data controller", biometric data becomes sensitive personal data, data processors are directly bound by the security principle, and the maximum fine for breaching the data protection principles rises from RM300,000 to RM1,000,000
- 1 June 2025: mandatory Data Protection Officers, data breach notification and the new right to data portability
Under the Act, a breach must be notified to the Commissioner as soon as practicable; the Commissioner's Data Breach Notification Guideline sets the expectation at 72 hours. Affected individuals must be informed where the breach is likely to cause significant harm. DPO appointments must be notified to the Commissioner within 21 days. Cross-border transfers follow the Cross Border Personal Data Transfer Guideline issued in April 2025, which replaced the old whitelist approach.
Three New Guidelines Published on 30 April 2026
1. Data Protection Impact Assessment (DPIA)
Controllers must carry out a DPIA where they anticipate a high risk to personal data. The guideline uses both quantitative and qualitative triggers:
- Quantitative: processing personal data of more than 20,000 data subjects, or sensitive personal data of more than 10,000
- Qualitative: for example legal or similarly significant effects, systematic monitoring, innovative technologies, vulnerable individuals or automated decision-making
The DPO is involved in the assessment, senior management remains ultimately responsible, and processors must provide reasonable assistance.
2. Data Protection by Design (DPbD)
This guideline describes how to build protection into the whole lifecycle of a processing activity, based on proactiveness, end-to-end protection, transparency and user-centricity. It is best-practice guidance rather than a mandatory requirement — but it is a strong indicator of what the Commissioner considers good practice.
3. Automated Decision-Making and Profiling (ADMP)
Using automated decision-making or profiling is itself a trigger for a DPIA. Where outcomes may have legal or significant effects on individuals, the guideline expects specific safeguards, and the DPO has an oversight role. If sensitive personal data is involved, the stricter rules for sensitive data under the PDPA apply.
Registration of Data Controllers
Certain classes of data controllers must still register with the Commissioner. The Commissioner has issued Circular No. 1/2026 on the registration of data controllers — organisations in the regulated classes should review it and check that their registration is up to date.
Your 2026 PDPA Checklist
- Confirm your DPO is appointed and notified to the Commissioner
- Screen your processing activities against the DPIA thresholds and carry out DPIAs where triggered
- List all automated decisions and profiling — in HR, credit, marketing and fraud prevention — and assess them
- Embed privacy by design in your project and change management process
- Test your breach response against the 72-hour expectation
- Document cross-border transfers and the safeguard used for each
How ResGuard Can Help
The ResGuard Data Protection Manager includes a records of processing, a DPIA module, data breach management and vendor assessments. Our outsourced DPO and DPO support services help Malaysian organisations meet the new obligations. Contact us for an assessment.
This article provides general information as of 20 October 2026 and does not constitute legal advice. Sources: Personal Data Protection (Amendment) Act 2024, Personal Data Protection Department publications and guidelines, and published law firm summaries.