Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
Regulaciones › Resto del mundo › Malasia
PDPA (Malasia)
Ley de Protección de Datos Personales de 2010 (Malasia)
CuándoEn vigor desde 2013; modificada en 2024, con las normas sobre el DPO y sobre violaciones aplicables desde el 1 de junio de 2025
Quién la aplicaComisionado de Protección de Datos Personales (JPDP)
A quién se aplicaResponsables y encargados del tratamiento que tratan datos personales en transacciones comerciales en Malasia.
Informar al reguladorNotificar al Comisionado tan pronto como sea factible y en un plazo de 72 horas desde la violación
DPO obligatorioLos responsables y encargados deben designar un DPO cuando traten datos de más de 20,000 titulares, da…
RegistroCategorías de responsables establecidas (banca, seguros, salud, telecomunicaciones, educación, sector inmobil…
Transferencias al extranjeroTransferencia permitida si la ley del destino es sustancialmente similar o la protección es equivalente, o en vir…
Plazo de solicitudesAtender las solicitudes de acceso y rectificación en un plazo de 21 días, prorrogable 14 días con aviso por escr…
Multa máximaHasta RM1,000,000 (unos USD 235k) y/o 3 años de prisión por incumplir los principios de protección de da…
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Alcance y base jurídica
Alcance extraterritorial
1
Applies to persons established in Malaysia, or using equipment in Malaysia other than for transit; foreign users must nominate a local representative.s.2(2)-(3) · source ↗
Limited to commercial transactions (s.2(1)).
Base jurídica
3
Consent is the general rule; non-consent processing only where necessary for contract, legal obligation, vital interests, justice and similar listed grounds.s.6(1)-(2) · source ↗
Consentimiento
3
Consent must be obtained in a form that can be recorded and maintained by the data controller.PDP Regulations 2013 reg. 3 · secondary source · source ↗
Regulation text not opened; requirement reported by DLA Piper.
Datos sensibles
2
Health, political, religious, offence and biometric data need explicit consent or a listed exception.ss.4, 40(1) · source ↗
Breach of s.40 is an offence: up to RM200,000 and/or 2 years (s.40(3)).
Niños
3
For data subjects under 18, a parent, guardian or person with parental responsibility acts and consents.s.4 ('relevant person') · source ↗
Derechos de las personas
Derechos
2
Access, correction, withdrawal of consent, prevent damaging processing, stop direct marketing and data portability.ss.30, 34, 38, 42, 43, 43A · source ↗
Counted: access, correction, objection (ss.42-43), portability. No erasure, restriction or automated-decision right.
Plazo de solicitudes
2
Comply with access and correction requests within 21 days, extendable by 14 days with written notice.ss.31(1)-(3), 35(1)-(3) · source ↗
Marketing
1
Data subjects may require a controller, by written notice, to stop or not begin processing for direct marketing.s.43(1) · source ↗
MCMC Aug 2025 consultation on consent for unsolicited commercial messages not in force.
Gobernanza
DPO obligatorio
1
Controllers and processors must appoint a DPO when processing data of over 20,000 subjects, sensitive data of over 10,000, or systematic monitoring.s.12A; DPO Guideline para 4.2 · source ↗
Statute is unconditional; Commissioner's guideline sets thresholds. In force 1 Jun 2025.
Requisitos del DPO
2
No minimum qualification; DPO must be in Malaysia 180 days a year or easily contactable and proficient in Malay and English; register within 21 days.DPO Guideline paras 5.4, 6.10, 7.1 · source ↗
Aug 2025 Competency Guideline sets non-mandatory competency tiers (secondary).
Registro
2
Prescribed classes of controllers (banking, insurance, health, telecoms, education, real estate and others) must register and renew certificates with fees.ss.14-16; Class of Data Users Order · source ↗
Processing without a certificate: up to RM500,000 and/or 3 years (s.16(4)). Class list from DLA Piper. Circular 1/2026 on registration not read.
DPIA
0
No DPIA requirement in the Act; Commissioner guidelines on DPIA expected.Not addressed · secondary source · source ↗
DPIA guideline expected in 2026 per DLA Piper.
Registros
1
Keep a record of applications, notices, requests and other information relating to personal data, in the Commissioner's prescribed form.s.44 · source ↗
Conservación
2
Do not keep data longer than necessary and take reasonable steps to destroy or permanently delete it.s.10(1)-(2) · source ↗
PDP Standard 2015 retention standard applies (under review).
Violaciones de datos
Informar al regulador
2
Notify the Commissioner as soon as practicable and within 72 hours of the breach.s.12B(1); Circular Bil. 2/2025 para 4(4) · source ↗
Failure to notify: up to RM250,000 and/or 2 years (s.12B(3)).
Informar a las personas
2
Notify affected data subjects without unnecessary delay where significant harm is likely, within 7 days of notifying the Commissioner.s.12B(2); Circular Bil. 2/2025 para 5(2) · source ↗
Transferencias
Transferencias al extranjero
2
Transfer allowed if destination law is substantially similar or protection equivalent, or under listed exceptions (consent, contract, due diligence).s.129 (as amended by A1727 s.12) · source ↗
Cross Border Transfer Guideline 3/2025 recognizes TIAs, BCRs, contractual clauses and certification.
Aplicación de la ley
Multa máxima
2
Up to RM1,000,000 (about USD 235k) and/or 3 years' imprisonment for breaching the data protection principles.s.5(2) · source ↗
Responsabilidad penal
3
Most breaches are criminal offences with imprisonment; directors and officers are jointly liable unless they prove due diligence.ss.5(2), 16(4), 40(3), 133 · source ↗
Officer liability section number (s.133) not visible in fetched text; reported by DLA Piper.
Acción privada
0
No statutory right for data subjects to sue for compensation; complaints go to the Commissioner.Not addressed · secondary source · source ↗
Commissioner has proposed adding a private right of action.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales