Malaysia
Personal Data Protection Act 2010 (Act 709), as amended by Act A1727 of 2024
Malaysia's Personal Data Protection Act covers personal data processed in commercial transactions. A 2024 amendment added biometric data to the definition of sensitive personal data, and that change started on April 1, 2025. The amendment defines biometric data as personal data from technical processing of a person's physical, physiological or behavioural characteristics. It also raised the penalties for breaking the data protection principles.
Key Provisions
- Biometric data has been sensitive personal data since April 1, 2025
- The Act applies to personal data processed in commercial transactions
- Organisations must tell you the purpose of processing
- The maximum penalty for breaking the data protection principles rose in 2025
- The 2024 amendment added a right to data portability
- The Commissioner has published consultation papers on breach notification, data protection officers and cross-border transfers
Your Biometric Rights
- Right to be told the purpose of processing
- Right to access personal data
- Right to correct personal data
- Right to withdraw consent
- Right to prevent processing that may cause damage or distress
- Right to prevent processing for direct marketing
Penalties for Non-Compliance
Breaking the data protection principles can bring a fine of up to RM1 million, up to three years in prison, or both, raised from RM300,000 and two years.
What We Do Here
We file opt-out requests on your behalf with the face search engines we support, and re-file as necessary. The PDPA gives people in Malaysia rights to access and correct personal data, and to withdraw consent. We file through each engine's own opt-out process rather than under the PDPA, and a complaint to the Personal Data Protection Commissioner is yours to make.
Get ProtectedOfficial sources
Government, regulator, court and parliament pages we checked this page against. This is general information, not legal advice.