← Global Privacy Laws Research Library
A1727
Personal Data Protection (Amendment) Act 2024
Personal Data Protection (Amendment) Act 2024: Malaysia
Prepared by Shubhank Suman · Last reviewed
CURRENT: ALL PROVISIONS COMMENCED IN PHASES BY 1 JUNE 2025
- Legal character
- Amending Act
- Region
- Asia-Pacific
What it covers
The amendments materially change:
- terminology
- controller/processor accountability
- biometric data
- DPO requirements
- breach notification
- portability
- security responsibilities
- cross-border transfer architecture.
AI, privacy and cybersecurity relevance
- AI: High
- Privacy: Very High
- Cyber: Very High
AI
HIGH / INDIRECT
The amendment itself is not an AI Act.
It matters to AI because biometric systems, profiling and automated decisionmaking can involve precisely the data and processing activities affected by the amendments.
Malaysia's regulator has also published a separate 2025 guideline on automated individual decisionmaking and profiling, which should be linked as related guidance rather than misrepresented as part of the Amendment Act. The regulator's amendment page lists that guidance among its current privacy materials. (PDP)
Cybersecurity
VERY HIGH
Breach notification, DPO oversight and processor security significantly strengthen operational governance.
Current validity
CURRENT: FULLY COMMENCED BY 1 JUNE 2025. (PDP)
Read first
Act 709 → 2024 amendments → biometric data → Section 12A DPO → Section 12B breach → Section 43A portability → current transfer regime.
Provisions / sections covered
COMMENCEMENT
The official Gazette notification establishes:
1 January 2025
Sections 7, 11, 13, 14.
1 April 2025
Sections 2, 3, 4, 5, 8, 10, 12.
1 June 2025
Sections 6 and 9.
Therefore the amendment Act's staged commencement was completed by 1 June 2025. (PDP)
IMPORTANT CHANGES
Data controller terminology
The amendments replace the terminology of:
"data user"
with:
"data controller"
subject to specified exceptions. (PDP)
Biometric data
Biometric information is brought explicitly into the protected/sensitive-data framework.
Data Protection Officer
New Section 12A establishes DPO obligations for qualifying controllers/processors.
Breach notification
New Section 12B establishes statutory personal-data-breach notification requirements.
Data portability
New Section 43A introduces a portability mechanism.
Processor security
The amended security framework extends more directly to processors.
Subject-matter tags
- Data portability
- Profiling
- Automated decision-making
- Data breach
- Cross-border transfers
- Data protection officer
- Controller and processor
- Biometrics
- Accountability
Subject-matter tags describe what the indexed text discusses. They are not legal conclusions.
Document page in the Knowledge Base - full text or PDF where it is available for this record.
This library locates primary and official sources. It does not interpret the law and it is not legal advice.