Malaysia: Personal Data Protection (Amendment) Act 2024 (Act A1727) including cybersecurity regulation partially entered into force
Description
Personal Data Protection (Amendment) Act 2024 (Act A1727) including cybersecurity regulation partially entered into force
On 1 April 2025, sections 2, 3, 4, 5, 8, 10, and 12 of the Personal Data Protection (Amendment) Act 2024 (Act A1727) entered into force, imposing direct security obligations on data processors under section 5(1A), with non-compliance penalties of up to MYR 1 million or three years' imprisonment, while section 12B established mandatory breach notification requirements to both the Commissioner and affected data subjects where significant harm occurs.
Original sourceScope
Policy Area
Data governance
Policy Instrument
Cybersecurity regulation
Regulated Economic Activity
cross-cutting
Implementation Level
national
Government Branch
executive
Government Body
central government
Complete timeline of this policy change
Hide details
2024-07-04
under deliberation
2024-07-10
under deliberation
2024-07-16
under deliberation
2024-07-31
adopted
2024-10-09
adopted
2025-01-01
in force
2025-04-01
in force