Every business collects personal data, whether it realises it or not. A customer’s phone number on a delivery form, an employee’s IC copy in a personnel file, CCTV footage at the shop entrance, a mailing list built from an online promotion. In Malaysia, all of this is regulated by the Personal Data Protection Act 2010, and recent amendments have raised the stakes considerably. Businesses that once treated data protection as a privacy notice buried on a website now face breach notification duties, data protection officer requirements and heavier penalties. Understanding what the law actually asks of you is the first step to staying on the right side of it.

 

The Seven Principles and the 2024 Amendments

 

The Personal Data Protection Act 2010, often called the PDPA, applies to personal data processed in respect of commercial transactions. It does not apply to the Federal and State Governments, but it covers most private businesses, from sole proprietors to large groups. The Act is built around seven principles. The General Principle requires consent for processing in most cases. The Notice and Choice Principle requires a written notice, in both Bahasa Malaysia and English, explaining why data is collected and who it may be disclosed to. The Disclosure, Security, Retention, Data Integrity and Access Principles then govern who sees the data, how it is protected, how long it is kept, whether it is accurate, and the individual’s right to access and correct it.

 

Certain classes of data users, such as those in banking, insurance, healthcare, education, tourism, real estate and direct selling, must also register with the Personal Data Protection Commissioner. Whether your business falls within a registrable class depends on the relevant orders, so it is worth checking rather than assuming.

 

The Personal Data Protection (Amendment) Act 2024 brought significant changes, which have been phased in. Data controllers are now expected to notify the Commissioner of personal data breaches, and in some cases the affected individuals. Data controllers and processors may need to appoint a data protection officer. Data processors are now directly bound by the Security Principle, individuals gain a right to data portability, and the maximum penalties for breaches of the principles have been increased. Guidelines issued by the Commissioner fill in much of the practical detail.

 

In practice, compliance starts with knowing what data you hold. Many businesses are surprised to find personal data scattered across sales spreadsheets, messaging apps, old email accounts, HR folders and third-party platforms. Mapping where data comes from, why it is kept, who can access it and when it is deleted makes it far easier to apply each principle sensibly. Retention is a common weak spot. The Act does not allow personal data to be kept longer than necessary for its purpose, yet many companies keep everything indefinitely. A simple retention schedule, combined with access controls and staff training, often addresses the biggest risks without requiring expensive new systems.

 

Key areas where data protection guidance makes a real difference include:

 

• Privacy notices – drafting bilingual notices that genuinely reflect what the business does with personal data
• Consent and marketing – making sure promotional messages and data sharing rest on valid consent
• Vendor and processor contracts – setting clear security and confidentiality obligations for IT providers, payroll firms and cloud services
• Breach response planning – having a tested plan for assessing, containing and reporting a data breach within the required timelines
• Employee data – handling recruitment records, medical information and monitoring practices lawfully
• Cross-border transfers – checking that data sent overseas meets the conditions now set out in the amended Act

 

Why Local Expertise Matters

 

Data protection sounds like an IT issue, but most compliance failures are about contracts, notices and internal processes. A retailer in Mont Kiara, a clinic in Petaling Jaya and a logistics company in Kuala Lumpur will each handle personal data differently, and the right policy for one may be wrong for another. Advice that reflects how the Commissioner actually approaches complaints and guidelines in Malaysia is far more useful than a generic overseas template. Local advisers can also explain how data protection interacts with other Malaysian rules, such as employment law and sector-specific regulations.

 

Customers in the Klang Valley are also becoming more aware of their rights, and complaints to the Commissioner are no longer unusual. A business that can show it has a clear notice, a sensible retention policy and a working breach plan is in a much stronger position if a complaint does arrive. Many business owners first think about the PDPA only after a complaint or a suspected breach. At that point they often search for a lawyer near me who can review what happened, assess whether notification is required, and help manage communications with customers. Starting earlier, with a short compliance review, is usually far less stressful.

 

A Firm Rooted in the Community

 

Toh Liew and Gentry is a law firm based in Solaris Mont Kiara offering corporate and commercial advisory work, including data protection compliance, alongside its civil and commercial litigation, debt recovery, and new companies and start-ups practice. That mix helps when a data issue overlaps with a contractual dispute or a customer claim. For business owners who prefer to sit down with a lawyer office near me rather than trade emails with a distant adviser, the office is easy to reach from Kuala Lumpur and Petaling Jaya, with convenient parking.

 

Personal data is built on trust. Customers and employees hand it over expecting it to be handled carefully. Taking compliance seriously protects your business from regulatory risk, and just as importantly, it shows the people you serve that their trust is well placed. With the amended Act now in force, there has rarely been a better moment to review how your business collects, stores and shares personal data.

 

Get Legal Support for Your Business

 

Business Name: Toh Liew & Gentry – Solaris Mont Kiara

Address: L-3A-09, No. 2, Jalan Solaris, Solaris Mont Kiara, 50480 Kuala Lumpur, Federal Territory of Kuala Lumpur

Phone: 03-6211 7117

Hours: Monday – Friday, 9:00 AM – 6:00 PM

Website: https://tlglegal.com.my/

Email: general@tlglegal.com.my