Sourced from pdp.gov.my and the gazetted Act. Gaps stated where a provision cannot be primary-source-verified.
Last updated: October 2026. Last checked: 19 October 2026 against the gazetted Act A1727, the commencement order P.U.(B) 522/2024 and the Commissioner's guidelines on pdp.gov.my. What's new: the 2024 amendments came into force in three stages (1 January, 1 April and 1 June 2025), not two, and the DPO and breach rules come from the February 2025 guidelines.
- This page is general information, not legal advice; for your own situation, speak to a lawyer who advises on data protection.
What does PDPA regulate in a marketing operation?
PDPA regulates every step where a business processes identifiable personal data in a commercial transaction, from the lead form to the CRM record and the follow-up message. For a marketing operation that means:
- the lead form on the landing page,
- the record in the CRM system that the sales team works,
- the WhatsApp thread that follows up,
- the retargeting audience uploaded to Meta or Google,
- and the retention window over which any of that data is kept.
Each of these has a PDPA analysis. The Act does not distinguish "digital" from "offline" data — the same seven principles (General, Notice-and-Choice, Disclosure, Security, Retention, Data Integrity, Access) apply.
Source: Personal Data Protection Act 2010 (Act 709), sections 6–12 (Personal Data Protection Principles). Referenced against the JPDP portal at pdp.gov.my (opens in a new tab). Verified 19 October 2026.
What consent does PDPA require for lead forms?
The Notice-and-Choice Principle (section 7 of Act 709) requires that at the point of collection the data subject is told, in the national language and in English, what data is collected, the purposes of collection, the classes of third parties to whom it may be disclosed, and the choices and means the data subject has to limit that processing.
In practice this drives the shape of a lead form: a checkbox is not enough — the notice text must be present and legible, the purpose must be stated, and the choice must be revocable.
Consent obtained for one purpose (say, sales follow-up on a specific enquiry) does not extend to another purpose (say, promotional emails about unrelated services) without a separate consent for the second purpose. The same rule applies to WhatsApp automation and other messaging channels: the consent captured for an enquiry does not implicitly authorise broadcast or promotional messages.
Is there a Do Not Call registry in Malaysia?
PDPA does not set up a national Do Not Call register. Its opt-out tool is section 43 of Act 709: a person can tell a business in writing to stop, or not begin, processing their personal data for direct marketing, and the business must comply within a reasonable period.
If the business does not comply, the person can apply to the Commissioner, and a business that then ignores the Commissioner's requirement commits an offence (a fine of up to RM200,000, up to two years in prison, or both). The Act defines direct marketing as any advertising or marketing material directed to particular individuals, by any means.
In practice, keep one suppression list fed by every opt-out you receive, by WhatsApp reply, SMS keyword, email unsubscribe or a phone request, and check it before every campaign. We found no official Malaysian Do Not Call register on any government site when we checked on 19 October 2026.
What did the PDPA amendments change, and when?
The Personal Data Protection (Amendment) Act 2024 (Act A1727) came into force in three stages: 1 January 2025 (sections 7, 11, 13 and 14: administrative changes such as electronic service of notices), 1 April 2025 (sections 2, 3, 4, 5, 8, 10 and 12:
'data controller' terminology, biometric data, processor security duty, higher penalties, cross-border transfers) and 1 June 2025 (sections 6 and 9: DPO, breach notification and data portability).
- The Data Breach Notification (DBN) Guideline and the DPO Guideline were both issued on 25 February 2025, alongside Circular No. 1/2025 (Appointment of DPO) and Circular No. 2/2025 (Data Breach Notification) published on pdp.gov.my (opens in a new tab). The Amendment restructures core terminology and adds specific, enforceable obligations:
More detail on What did the PDPA amendments change, and when?
- Data controller replaces data user. The Amendment renames the primary regulated entity. Data processors are now directly liable (previously only the data user carried liability). Every service contract with a marketing vendor should be revisited on this point.
- Mandatory Data Protection Officer (DPO) appointment. A DPO must be appointed by a data controller or data processor that processes personal data of more than 20,000 data subjects, or sensitive personal data (including financial information) of more than 10,000 data subjects, or engages in regular and systematic monitoring of data subjects. The DPO should be resident in Malaysia (physically present for at least 180 days in a calendar year) or easily contactable by any means, and proficient in Bahasa Melayu and English. Register the appointment on the SPDP system within 21 days. Source: Circular No. 1/2025 and the DPO Guideline (25 February 2025).
- Mandatory breach notification — section 12B. A breach is notifiable where it causes or is likely to cause significant harm, or affects more than 1,000 data subjects. The Commissioner must be notified as soon as practicable and no later than 72 hours from the occurrence of the breach; the guideline counts the 72 hours from when the controller is informed of, or detects, the incident. A late notice needs written reasons. Affected data subjects must be told without unnecessary delay, and no later than 7 days after the notice to the Commissioner, where significant harm is likely. Keep breach records for at least 2 years. Source: Circular No. 2/2025 and the DBN Guideline (25 February 2025).
- Penalties raised sharply. Breach of a data-protection principle now carries a fine of up to RM1,000,000 and imprisonment up to 3 years (raised from RM300,000 / 2 years). Failure to notify under section 12B(1) carries up to RM250,000 and 2 years.
- Data-portability right. A data subject may ask the controller, by written notice sent electronically, to transmit their personal data directly to another data controller of their choice, subject to technical feasibility and data-format compatibility (new section 43A).
- Cross-border transfers restructured. The whitelist mechanism (previously requiring gazetted "safe" jurisdictions) is abolished in favour of a substantially-similar / adequate-protection test, and controllers may conduct a Transfer Impact Assessment (TIA), whose findings are valid for up to three years.
Sources: Personal Data Protection (Amendment) Act 2024 (Act A1727); Circular No. 1/2025 (Appointment of DPO); Circular No. 2/2025 (Data Breach Notification); DBN Guideline and DPO Guideline (25 February 2025); commencement order P.U.(B) 522/2024; JPDP portal pdp.gov.my. Verified 19 October 2026. Sector-specific instruments continue to be issued; check pdp.gov.my before finalising controls for regulated industries.
What are the seven PDPA principles?
Act 709 sets seven Personal Data Protection Principles in sections 6 to 12, and a business that processes personal data must follow all of them. The table puts each one in marketing terms.
| Principle | Section | What it means for marketing data |
|---|---|---|
| General | s.6 | Get consent before processing (sensitive data needs explicit consent under s.40), and collect only data that is adequate and not excessive for a stated, lawful purpose. |
| Notice and Choice | s.7 | Tell people in writing, in Bahasa Melayu and English, what you collect, why, who you share it with and how they can limit its use. |
| Disclosure | s.8 | Do not disclose data for a purpose, or to a class of third party, that you did not state in the notice without fresh consent. |
| Security | s.9 | Protect data from loss, misuse and unauthorised access. Since 1 April 2025, processors such as agencies and SaaS vendors carry this duty directly. |
| Retention | s.10 | Keep data only as long as the purpose needs, then destroy or permanently delete it. |
| Data Integrity | s.11 | Take reasonable steps to keep data accurate, complete, not misleading and up to date. |
| Access | s.12 | Let people access and correct their personal data. |
Breaching a principle is an offence carrying a fine of up to RM1,000,000, up to three years in prison, or both, under section 5(2) as amended by Act A1727.
When did each PDPA amendment come into force?
The Personal Data Protection (Amendment) Act 2024 (Act A1727) came into force in three stages set by the Minister of Digital in P.U.(B) 522/2024 (opens in a new tab), gazetted on 24 December 2024. Read with the text of Act A1727 (opens in a new tab), the stages work out as below.
| In force from | Act A1727 sections | What changed |
|---|---|---|
| 1 January 2025 | 7, 11, 13, 14 | Administrative changes, including electronic service of notices and how fees are paid; existing orders, guidelines and codes of practice stay valid. |
| 1 April 2025 | 2, 3, 4, 5, 8, 10, 12 | "Data user" becomes "data controller"; biometric data becomes sensitive personal data; "personal data breach" is defined; deceased people are excluded; processors must follow the Security Principle; the penalty for breaching a principle rises to RM1,000,000 or three years; the cross-border whitelist is removed. |
| 1 June 2025 | 6, 9 | Duty to appoint a data protection officer (new s.12A), mandatory breach notification (new s.12B) and the right to data portability (new s.43A). |
Under the amended section 129, a controller may transfer personal data abroad where the destination has a law substantially similar to the PDPA or an adequate level of protection. The Commissioner's cross-border guideline (29 April 2025) explains how to assess that.
Who must appoint a DPO and report data breaches?
Every data controller must report a personal data breach to the Commissioner, and controllers or processors above the Commissioner's thresholds must appoint a data protection officer. Both duties have applied since 1 June 2025, with the detail set in the February 2025 guidelines.
| Duty | Who and when | Detail |
|---|---|---|
| Appoint a DPO | Controllers and processors processing personal data of more than 20,000 data subjects, sensitive personal data (including financial information) of more than 10,000, or doing regular and systematic monitoring | The DPO should be resident in Malaysia (at least 180 days a year) or easily contactable, and proficient in Bahasa Melayu and English. Register the appointment on the SPDP system within 21 days. |
| Notify the Commissioner | Breaches that cause or are likely to cause significant harm, or that affect more than 1,000 data subjects | As soon as practicable and no later than 72 hours, by the online form on pdp.gov.my, by email to dbnpdp@pdp.gov.my or by hard copy. Late notices need written reasons. |
| Notify affected people | Where significant harm is likely | Without unnecessary delay, and no later than 7 days after notifying the Commissioner. |
| Keep records | Every breach | Keep a breach register for at least 2 years from the notification. |
Failing to notify the Commissioner is an offence carrying a fine of up to RM250,000, up to two years in prison, or both (section 12B(3)). The Data Breach Notification Guideline (opens in a new tab) and the DPO Guideline (opens in a new tab) give the full tests and worked examples.
What does PDPA mean for WhatsApp and SMS marketing?
A WhatsApp or SMS marketing message uses personal data, so it needs a purpose the person was told about and consented to, and it must stop when they object. The Act has no separate rule for each channel; the same principles and the section 43 opt-out apply to messages, calls and email.
- Capture marketing consent separately from the enquiry. Agreeing to be contacted about a quote is not consent to promotions.
- Show the written notice at the point of capture, in Bahasa Melayu and English, naming the purpose and the classes of third parties (for example, your CRM or messaging vendor).
- Give an opt-out in every promotional message and record it in one suppression list across WhatsApp, SMS and email.
- Do not upload contacts to ad platforms or messaging tools for a purpose outside the notice.
- Check your vendor contracts: since April 2025, processors must meet the Security Principle themselves.
This is how shakalakaa builds compliant WhatsApp marketing and automation for Malaysian brands: consent captured at the enquiry, promotional flows kept separate from transactional ones, and opt-outs synced across every connected tool. Clinics using AI tools should also read AI marketing tools and PDPA for Malaysian clinics.
What has the Commissioner published in 2026?
In 2026 the Department of Personal Data Protection published guidelines on Data Protection Impact Assessment, Data Protection by Design, and Automated Decision-Making and Profiling. It also opened Public Consultation Paper No. 1/2026 on an AI and personal data protection framework.
Marketing teams that profile audiences or run automated lead scoring should read the profiling guideline first. Copies are on pdp.gov.my (opens in a new tab); check there for the current version before you finalise any controls.
How long can a business keep personal data?
Section 10 of Act 709 (Retention Principle) requires that personal data not be kept longer than is necessary for the fulfilment of the purpose for which it was processed. For a marketing operation this is a policy decision, not a statutory number: define the purpose, define the retention window that supports it, document it, and delete on schedule.
Common defaults used by practitioners — 24 months for enquiry-only leads, 6 years for records tied to invoiced work — are defensible only if the business can point to a written policy and evidence of deletion runs. The Retention Principle is what the DPO, once appointed, is expected to enforce.
How do I write a PDPA privacy notice?
The free PDPA policy generator below produces a business-specific privacy notice covering the seven PDPA principles, direct-marketing opt-outs and the 2024 Amendment obligations, tailored to lead-form and CRM data.
Prefer the standalone tool? Open the PDPA privacy policy generator in a full page.
Apakah Akta Perlindungan Data Peribadi (PDPA)?
Ringkasan Bahasa Malaysia bagi rakan perniagaan yang mencari akta perlindungan data peribadi, pdpa compliance malaysia atau pdpa consent requirements. Akta Perlindungan Data Peribadi 2010 (Akta 709) ditadbir oleh Pesuruhjaya Perlindungan Data Peribadi dan Jabatan Perlindungan Data Peribadi (JPDP) di bawah Kementerian Digital.
Setiap perniagaan yang memproses data peribadi bagi transaksi komersial mesti mendapatkan persetujuan yang khusus, dimaklumkan dan boleh dibuktikan sebelum data itu digunakan untuk pemasaran.
- Baca panduan penuh dalam Bahasa Melayu: Akta Perlindungan Data Peribadi (PDPA) Malaysia.
Where can I read more about PDPA and marketing?
See the PDPA and lead data guide and the Singapore counterpart DNC/PDPA on Singapore lead follow-up. For the tax dimension of running an agency operation, see the e-invoice Malaysia hub and SST on digital marketing in Malaysia.
- Cite this
- shakalakaa (Plixitt Solutions). “PDPA Malaysia (Personal Data Protection Act).”
- https://shakalakaa.my/resources/pdpa-malaysia · Updated 2026-10-19
- Licensed under CC BY 4.0.
shakalakaa (Plixitt Solutions). "PDPA Malaysia (Personal Data Protection Act)." https://shakalakaa.my/resources/pdpa-malaysia. Updated 2026-10-19. Licensed under CC BY 4.0.
shakalakaa Resource Library
This is one of ~50 dated, sourced references in the reference library — ad cost benchmarks, KKM/MDC/PDPA compliance guides and Malaysian business regulation.