On July 10, 2024, Bill D.R. 21/2024 for an Act to amend the Personal Data Protection Act 2010 (PDPA) was read for the first time in the House of Representatives.  

What are the key amendments to the bill?

The bill's provisions include:

• mandatory appointment of a data protection officer (DPO) by data controllers and processors;
• mandatory data breach notification by data controllers to the Personal Data Protection Commissioner;
• fines of up to MYR 250,000 (approx. $53,130) or imprisonment for up to two years, or both, for non-compliance with data breach notifications;
• data subjects' right to data portability, subject to technical feasibility and data format compatibility;
• the requirement for data processors to comply with the security principle under the PDPA;
• an increase in the maximum penalty for breach of the principles under the PDPA, from MYR 300,000 (approx. $63,760) and imprisonment of two years to MYR 1 million (approx. $212,530), and imprisonment of three years; and
• changes in the rules regarding data transfers, specifically that a data controller may transfer any personal data to any place outside Malaysia if there is in that place any law in force which is substantially similar to the PDPA or that place ensures an adequate level of protection in relation to the processing of personal data which is at least equivalent to the level of protection afforded by the PDPA.

You can read the bill here and track its progress on the Parliament's website here, both only available in Malaysian.

Update: July 19, 2024

Bill passed in House of Representatives

On July 16, 2024, the bill passed in the House of Representatives on its second Reading.

Next steps

The bill will become law after passing the Senate and receiving Royal Assent. The bill will enter into effect on a date appointed by the Minister of Communications and Multimedia by notification in the Gazette. 

You can read the bill here and view its history on the Parliament's website here, both only available in Malaysian.