PDPA in plain English

The Personal Data Protection (Amendment) Act 2024 came into force in stages during 2025. What leaders need to know:

• Penalties: breaching the data protection principles can mean a fine of up to RM1,000,000 and/or up to three years' jail (from 1 Apr 2025).
• Biometric data (faces, fingerprints, voiceprints) is now sensitive personal data.
• Data processors, not just your company, have direct security duties. Check your AI and software vendors' contracts.
• Breach notification (from 1 Jun 2025): tell the Commissioner within 72 hours of a breach that causes or is likely to cause significant harm, and affected people within seven days of that notice. Keep a breach register for at least two years.
• Data protection officer: required if you process personal data of more than 20,000 people, sensitive or financial data of more than 10,000, or do regular and systematic monitoring. Register the DPO with the Commissioner within 21 days.
• Portability: people can ask to move their data to another provider (from 1 Jun 2025).
• Overseas transfers: most AI tools process data outside Malaysia. Transfers are allowed where the destination's law is substantially similar or protection is equivalent, or under other conditions such as consent; the 2025 guideline describes a Transfer Impact Assessment.

Your three moves this quarter: know which AI tools touch personal data, check the vendor terms, and make sure your breach plan names who calls the Commissioner.

This is a summary, not legal advice.