PERSONAL DATA PROTECTION ACT 2010

Personal Data Protection LAWS OF MALAYSIA REPRINT Act 709 PERSONAL DATA PROTECTION ACT 2010 As at 1 July 2023 PUBLISHED BY THE COMMISSIONER OF LAW REVISION, MALAYSIA UNDER THE AUTHORITY OF THE REVISION OF LAWS ACT 1968 2023 1 2 Act 709 Laws of Malaysia PERSONAL DATA PROTECTION ACT 2010 Date of Royal Assent … … … … 2 June 2010 Date of publication in the Gazette … … … 10 June 2010 Personal Data Protection LAWS OF MALAYSIA Act 709 PERSONAL DATA PROTECTION ACT 2010 ARRANGEMENT OF SECTIONS Part I PRELIMINARY Section 1. Short title and commencement 2. Application 3. Non-application 4. Interpretation Part II PERSONAL DATA PROTECTION Division 1 Personal Data Protection Principles 5. Personal Data Protection Principles 6. General Principle 7. Notice and Choice Principle 8. Disclosure Principle 9. Security Principle 10. Retention Principle 11. Data Integrity Principle 12. Access Principle 3 4 Laws of Malaysia Act 709 Division 2 Registration Section 13. Application of this Division 14. Registration of data users 15. Application for registration 16. Certificate of registration 17. Renewal of certificate of registration 18. Revocation of registration 19. Surrender of certificate of registration 20. Register of Data Users Division 3 Data user forum and code of practice 21. Data user forum 22. Register of Data User Forums 23. Code of practice 24. Commissioner may issue code of practice 25. Applicable code of practice 26. Revocation, etc., of code of practice 27. Submission of new code of practice by data user forum 28. Register of Codes of Practice 29. Non-compliance with code of practice Division 4 Rights of data subject 30. Right of access to personal data 31. Compliance with data access request 32. Circumstances where data user may refuse to comply with data access request Personal Data Protection 5 Section 33. Notification of refusal to comply with data access request 34. Right to correct personal data 35. Compliance with data correction request 36. Circumstances where data user may refuse to comply with data correction request 37. Notification of refusal to comply with data correction request 38. Withdrawal of consent to process personal data 39. Extent of disclosure of personal data 40. Processing of sensitive personal data 41. Repeated collection of personal data in same circumstances 42. Right to prevent processing likely to cause damage or distress 43. Right to prevent processing for purposes of direct marketing 44. Record to be kept by data user Part III EXEMPTION 45. Exemption 46. Power to make further exemptions Part IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER 47. Appointment of Commissioner 48. Functions of Commissioner 49. Powers of Commissioner 50. Appointment of Deputy Commissioners and Assistant Commissioners 51. Appointment of other officers and servants 52. Loans and advances to officers and servants 53. Tenure of office 54. Revocation of appointment and resignation 55. Temporary exercise of functions and powers of Commissioner 6 Laws of Malaysia Act 709 Section 56. Vacation of office 57. Remuneration and allowances 58. Delegation of Commissioner’s functions and powers 59. Direction by Minister 60. Returns, reports, accounts and information Part V PERSONAL DATA PROTECTION FUND 61. Establishment of Fund 62. Expenditure to be charged on Fund 63. Conservation of Fund 64. Reserve fund 65. Financial year 66. Limitation on contracts 67. Bank accounts 68. Accounts and audit 69. Expenditure and preparation of estimates Part VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE 70. Establishment of Advisory Committee 71. Functions of Advisory Committee 72. Members of Advisory Committee 73. Tenure of office 74. Revocation of appointment and resignation 75. Temporary exercise of functions of Chairman 76. Vacation of office 77. Allowances 78. Time and place of meetings Personal Data Protection Section 79. Advisory Committee may invite others to attend meetings 80. Minutes 81. Procedure 82. Members to devote time to business of Advisory Committee Part VII APPEAL TRIBUNAL 83. Establishment of Appeal Tribunal 84. Powers of Appeal Tribunal 85. Members of Appeal Tribunal 86. Secretary to Appeal Tribunal and other officers, etc. 87. Tenure of office 88. Resignation and revocation of appointment 89. Temporary exercise of functions of Chairman 90. Vacation of office 91. Allowances 92. Disclosure of interest 93. Appeal to Appeal Tribunal 94. Record of decision of Commissioner 95. Stay of decision pending appeal 96. Composition of Appeal Tribunal 97. Sitting of Appeal Tribunal 98. Procedure of Appeal Tribunal 99. Decision of Appeal Tribunal 100. Enforcement of decision of Appeal Tribunal PART VIII INSPECTION, COMPLAINT AND INVESTIGATION 101. Inspection of personal data system 102. Relevant data user, etc., to be informed of result of inspection 7 8 Laws of Malaysia Act 709 Section 103. Reports by Commissioner 104. Complaint 105. Investigation by Commissioner 106. Restriction on investigation initiated by complaint 107. Commissioner may carry out or continue investigation initiated by complaint notwithstanding withdrawal of complaint 108. Enforcement notice 109. Variation or cancellation of enforcement notice Part IX ENFORCEMENT 110. Authorized officers 111. Authority card 112. Power of investigation 113. Search and seizure with warrant 114. Search and seizure without warrant 115. Access to computerized data 116. Warrant admissible notwithstanding defects 117. List of computer, book, account, etc., seized 118. Release of computer, book, account, etc., seized 119. No cost or damages arising from seizure to be recoverable 120. Obstruction to search 121. Power to require production of computer, book, account, etc. 122. Power to require attendance of persons acquainted with case 123. Examination of persons acquainted with case 124. Admission of statements in evidence 125. Forfeiture of computer, book, account, etc., seized 126. Joinder of offences 127. Power of arrest Personal Data Protection 9 Part X MISCELLANEOUS Section 128. Register 129. Transfer of personal data to places outside Malaysia 130. Unlawful collecting, etc., of personal data 131. Abetment and attempt punishable as offences 132. Compounding of offences 133. Offences by body corporate 134. Prosecution 135. Jurisdiction to try offences 136. Service of notices or other documents 137. Public Authorities Protection Act 1948 138. Public servant 139. Protection against suit and legal proceedings 140. Protection of informers 141. Obligation of secrecy 142. Things done in anticipation of the enactment of this Act 143. Power to make regulations 144. Prevention of anomalies Part XI SAVINGS AND TRANSITIONAL PROVISIONS 145. Personal data processed before the date of coming into operation of this Act 146. Registration of persons who process personal data before the date of coming into operation of this Act 10 Laws of Malaysia Act 709 Personal Data Protection 11 LAWS OF MALAYSIA Act 709 PERSONAL DATA PROTECTION ACT 2010 An Act to regulate the processing of personal data in commercial transactions and to provide for matters connected therewith and incidental thereto. [15 November 2013, P.U. (B) 464/2013] ENACTED by the Parliament of Malaysia as follows: Part I PRELIMINARY Short title and commencement 1. (1) This Act may be cited as the Personal Data Protection Act 2010. (2) This Act comes into operation on a date to be appointed by the Minister by notification in the Gazette, and the Minister may appoint different dates for different provisions of this Act. Application 2. (1) This Act applies to— (a) any person who processes; and (b) any person who has control over or authorizes the processing of, any personal data in respect of commercial transactions. 12 Laws of Malaysia Act 709 (2) Subject to subsection (1), this Act applies to a person in respect of personal data if— (a) the person is established in Malaysia and the personal data is processed, whether or not in the context of that establishment, by that person or any other person employed or engaged by that establishment; or (b) the person is not established in Malaysia, but uses equipment in Malaysia for processing the personal data otherwise than for the purposes of transit through Malaysia. (3) A person falling within paragraph (2)(b) shall nominate for the purposes of this Act a representative established in Malaysia. (4) For the purposes of subsections (2) and (3), each of the following is to be treated as established in Malaysia: (a) an individual whose physical presence in Malaysia shall not be less than one hundred and eighty days in one calendar year; (b) a body incorporated under the *Companies Act 1965 [Act 125]; (c) a partnership or other unincorporated association formed under any written laws in Malaysia; and (d) any person who does not fall within paragraph (a), (b) or (c) but maintains in Malaysia— (i) an office, branch or agency through which he carries on any activity; or (ii) a regular practice. Non-application 3. (1) This Act shall not apply to the Federal Government and State Governments. *NOTE—The Companies Act 1965 [Act 125] has since been repealed by the Companies Act 2016 [Act 777] which comes into operation on 31 January 2017 – see subsection 620(1) of Act 777. Personal Data Protection 13 (2) This Act shall not apply to any personal data processed outside Malaysia unless that personal data is intended to be further processed in Malaysia. Interpretation 4. In this Act, unless the context otherwise requires— “credit reporting agency” has the meaning assigned to it in the Credit Reporting Agencies Act 2010 [Act 710]; “this Act” includes regulations, orders, notifications and other subsidiary legislation made under this Act; “register” means the Register of Data Users, Register of Data User Forums or Register of Codes of Practice; “personal data” means any information in respect of commercial transactions, which— (a) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with the intention that it should wholly or partly be processed by means of such equipment; or (c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data user, including any sensitive personal data and expression of opinion about the data subject; but does not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under the Credit Reporting Agencies Act 2010; 14 Laws of Malaysia Act 709 “sensitive personal data” means any personal data consisting of information as to the physical or mental health or condition of a data subject, his political opinions, his religious beliefs or other beliefs of a similar nature, the commission or alleged commission by him of any offence or any other personal data as the Minister may determine by order published in the Gazette; “prescribed” means prescribed by the Minister under this Act and where no mode is mentioned, means prescribed by order published in the Gazette; “Advisory Committee” means the Personal Data Protection Advisory Committee established under section 70; “vital interests” means matters relating to life, death or security of a data subject; “Fund” means the Personal Data Protection Fund established under section 61; “use”, in relation to personal data, does not include the act of collect