Malaysia’s PDPA amendments: what they change for AI data handling.

What the amendment actually changes

Malaysia’s Personal Data Protection (Amendment) Act 2024 came into force in phases between January and June 2025. The principal Act now replaces “data user” with “data controller” throughout, brings biometric data into the definition of sensitive personal data, and puts data processors under direct Security Principle obligations for the first time, rather than treating processor security as the controller’s problem alone.

The penalty for an offence under the Act rose from a maximum of RM300,000 to RM1,000,000, and the maximum prison term from two years to three. Malaysia did not adopt a revenue-percentage penalty model like Indonesia, Vietnam or Singapore, so the exposure is a fixed statutory ceiling rather than a share of turnover. That ceiling still applies per offence, and a data controller running an AI system that mishandles personal data has no separate, more lenient standard to fall back on.

◇

A system trained or grounded on personal data is now the controller’s direct liability, not a downstream technicality.

A data protection officer and a 72-hour clock

Appointing a data protection officer became mandatory from June 2025 for organisations that process the personal data of 20,000 or more data subjects, process sensitive personal data of 10,000 or more data subjects, or carry out regular and systematic monitoring. The DPO Guideline published in May 2025 requires registration within 21 days of appointment and a published, dedicated contact channel.

Breach notification now runs on a fixed clock. Controllers must notify the Personal Data Protection Department as soon as practicable and within 72 hours of discovering a breach. Where the breach is likely to cause significant harm, affected individuals must also be told, within seven days of notifying the Department. Missing the notification obligation is a separate offence from the breach itself, with its own exposure up to the RM1,000,000 ceiling.

• Know which AI systems process personal data before an incident forces you to find out under time pressure.
• Confirm whether your organisation crosses the 20,000 or 10,000 data-subject thresholds that trigger a mandatory DPO.
• Keep a breach notification draft ready that names the systems, likely data categories and an initial harm assessment.
• Assign who calculates the 72-hour clock and who has authority to notify the Department without waiting for a full investigation.

Cross-border transfer: from whitelist to assessment

The previous regime allowed transfers only to a ministerial whitelist of jurisdictions. Guidelines on Cross-Border Personal Data Transfer, launched 29 April 2025, replace that whitelist with five legal bases: transfer to a jurisdiction with substantially similar or equivalent protection, established through a Transfer Impact Assessment valid for three years; explicit data subject consent with written notice of the transfer; performance of a contract; legal proceedings; and reasonable precautions supported by binding corporate rules, contractual clauses (including the ASEAN Model Contractual Clauses or GDPR Standard Contractual Clauses), or recognised certifications such as APEC CBPR.

Most enterprise AI deployments call a model, embedding or retrieval service hosted outside Malaysia. Each of those calls is now a transfer that needs a documented basis, not an assumption that the vendor’s general terms cover it.

◇

Choosing an overseas model API is now a documented legal decision, not a procurement checkbox.

Automated decision-making and profiling

The Personal Data Protection Department consulted through March 2025 on draft guidelines covering data protection impact assessments, privacy by design, and automated decision-making and profiling. Finalisation was still pending when this note was written, but the direction is consistent with the seven principles in Malaysia’s National Guidelines on AI Governance and Ethics: transparency about when a decision affecting a person is automated, and a path for that person to seek human review.

A retrieval-augmented system that influences a real decision, such as eligibility, pricing or hiring screening, should already be able to show what data it used, which model produced the output, and who can override it. Waiting for the guidelines to finalise before building that capability leaves the harder work for the deadline.

• Identify which AI-assisted decisions touch eligibility, pricing, employment or other consequential outcomes for individuals.
• Document the logic and data categories behind each one in terms a non-technical reviewer can follow.
• Build a human review path before a regulator or a complainant asks for one.

What to check before your next model call

None of this requires a new AI-specific law to bite. It is already enforceable under the amended PDPA, at penalty levels more than three times the previous ceiling.

• Map which prompts, embeddings or fine-tuning data include personal data, and classify any biometric content as sensitive.
• Confirm whether your organisation needs a registered DPO under the 2025 thresholds.
• Pick and document a cross-border transfer basis for every overseas model or cloud vendor in use.
• Prepare a 72-hour breach playbook that names the AI systems in scope and who has authority to notify the Department.
• Review vendor contracts for the Security Principle obligations that now sit directly with processors, not only controllers.