Amendments to the Personal Data Protection Act 2010 – Dates of Coming into Force

The Minister of Digital has, by notification in the Gazette, appointed the dates on which the provisions of the Personal Data Protection (Amendment) Act 2024 (“Amendment Act”) come into force. The Amendment Act will come into operation in three stages (i.e., 1 January 2025, 1 April 2025 and 1 June 2025).
 
We set out below the dates on which salient amendments to the Personal Data Protection Act 2010 (“PDPA”) will come into force:
 
Date of Coming into Force Sections of the Amendment Act; Salient Amendments to the PDPA
1 January 2025 Sections 7, 11, 13, and 14 of the Amendment Act
These amendments do not introduce any new obligations onto data controllers.
1 April 2025
Sections 2, 3, 4, 5, 8, 10, and 12 of the Amendment Act
  1. Section 2 – Replaces the term “data user” with “data controller”.
  2. Section 3 – Amends the definitions of certain terms in the PDPA, including:
  • recognising “biometric data” as a type of sensitive personal data;
  • excluding personal data of deceased individuals from scope of the PDPA; and
  • introducing definitions for “personal data breach”; and
  • amending the definition of “requestor” to now include individuals making data portability requests.
  1. Sections 4 and 5 – Extends the Security Principle to data processors, including direct imposition of penalties on data processors for breach.
  2. Section 4 – Increased penalties for breach of personal data protection principles up to RM1,000,000 and/or up to three years imprisonment.
  3. Section 12 – Removal of the whitelist regime for cross border transfers; personal data may also be transferred out of Malaysia to a country that has substantially similar laws or where the country ensures equivalent levels of protection
1 June 2025
Sections 6 and 9 of the Amendment Act
  1. Section 6 – Introduces requirements for data controllers to:
  • appoint a data protection officer; and
  • notify the Personal Data Protection Commissioner (“Commissioner”) and data subjects of personal data breaches.
  1. Section 9 – New right of data portability for data subjects.
 
Our article highlighting the salient changes under the Amendment Act can be accessed here.

The Commissioner has also published public consultation papers on guidelines for the upcoming amendments. It is expected that these guidelines will be issued before the relevant amendments come into force. Our articles on the public consultation papers can be accessed here and here
 
For further information, please contact Jillian Chia (Head/Partner), Natalie Lim (Partner) and Charmayne Ong (Partner) of the Personal Data Protection Practice of Skrine.
This alert contains general information only. It does not constitute legal advice nor an expression of legal opinion and should not be relied upon as such. For further information, kindly contact skrine@skrine.com.