Malaysia: Personal Data Protection (Amendment) Act 2024 (Act A1727) including cross-border data transfer regulation entered into force

On 1 April 2025, section 129 of the Personal Data Protection (Amendment) Act 2024 (Act A1727) entered into force, removing the previous white-list regime for cross-border data transfers. Under the amended provisions, data controllers may transfer personal data to jurisdictions providing comparable levels of protection, contingent upon conducting impact assessments to evaluate safeguards in recipient countries. This change was implemented alongside other amendments in sections 2, 3, 4, 5, 8, 10 and 12 through Gazette notification P.U. (B) 522, which established staggered enforcement dates for different provisions of the Act. The removal of specific transfer restrictions under section 129 was accompanied by deletion of subsection (1) and modifications to the conditions governing international data transfers.