Is a PDPA Notice Enough for PDPA Compliance in Malaysia?
Ask most business owners what personal data protection compliance in Malaysia involves and you will usually hear the same answer: a PDPA notice. Get one drafted, put it on the website, attach it to the registration form, and the job is done.
But the job has barely started.
A PDPA notice merely satisfies one of the seven principles in the Personal Data Protection Act 2010 (Akta Perlindungan Data Peribadi 2010) ("PDPA"), i.e. the Notice and Choice Principle in section 7 of the PDPA. The other six principles, the Personal Data Protection Regulations 2013, the Personal Data Protection Standard 2015 and the 2024 amendments to the PDPA each impose obligations that no notice can meet.
What happens if the Commissioner comes to inspect?
Suppose you run three dental clinics in the Klang Valley. Over ten years, you have built up records for about 14,000 patients: names, IC numbers, phone numbers, treatment notes and X-rays. Appointment reminders go out on WhatsApp. Patient files sit in a cloud-based clinic management system. Your staff clock in with their fingerprints.
Last year, you paid for a PDPA notice. It is bilingual, it is on your website, and a copy is printed on every patient registration form.
One morning, a letter arrives from the Personal Data Protection Commissioner. It gives you written notice that the Commissioner intends to inspect your personal data system.
You are not worried. You have the notice.
The inspection officer reads it, thanks you, and then asks for the documents that Regulation 14(2) of the Personal Data Protection Regulations 2013 ("PDPR") allows an inspector to request:
your records of consent from patients;
a record of the written notice you issued;
your list of disclosures of patient data to third parties;
your security policy;
your record of compliance with the retention standard; and
your record of compliance with the data integrity standard.
The officer also asks where your certificate of registration is displayed. Private dental clinics fall within a class of data users that must register with the Commissioner. The certificate must be displayed at your principal place of business, with a certified copy at each branch.
The problem is you have one item on that list, the PDPA Notice.
But this raises another question. If the notice is only one piece, what does the rest of PDPA compliance look like?
What does a PDPA notice actually do?
A PDPA notice tells people what you do with their personal data. That is all it does.
What is a PDPA notice?
A PDPA notice, also called a Personal Data Protection Notice or privacy notice, is the written notice that section 7 of the PDPA requires you to give individuals. Many businesses call it their privacy policy. It must at least explain:
what personal data you process and why;
where you got it;
which classes of third parties you may disclose it to;
how the person can access and correct it, and how they can limit its processing;
whether supplying the data is obligatory, and what happens if they do not supply it; and
who to contact with enquiries or complaints.
It must be in both Bahasa Malaysia and English, and given as soon as practicable, usually when you first collect the data.
A good notice is a legal requirement, and many businesses still get it wrong. An English-only notice, for example, does not meet section 7(3) of the PDPA.
But a notice informs people. It does not give you permission to use their data, and it does not protect that data.
Is a PDPA notice the same as consent?
No. This is the most common misunderstanding, and the Commissioner has addressed it directly. The Commissioner's Guide to Prepare Personal Data Protection Notice (January 2022) says:
"Privacy Notice should not be the platform for a data user to get data subject's consent, especially a blanket consent. Data user has to manage the consent in a proper method, to record and maintain it accordingly."
Regulation 3 of the PDPR sets the rules:
consent must be obtained in a form that can be recorded and properly maintained;
if the consent form also covers other matters, the consent request must be presented so that it is distinguishable from them;
for anyone under 18, consent must come from a parent, guardian or person with parental responsibility; and
the burden of proving consent lies on you, not the individual.
Consent is not always required. Section 6(2) of the PDPA allows processing without consent where it is necessary, for example, to perform a contract with the individual or to comply with a legal obligation. But your WhatsApp promotions, your loyalty programme and the photographs you post on social media usually depend on consent. If you rely on consent, you must be able to prove you have it.
In the clinic example, that means a record for every patient. For every child patient, it means a record of the parent's consent.
What are the seven personal data protection principles, and what proof does each one need?
Section 5 of the PDPA requires every data controller to comply with all seven principles. Here is what each principle asks of you, and what you should be able to produce if asked.
Principle | PDPA section | What it requires | What you should be able to show |
General | s. 6 | Process data only for a lawful, directly related purpose; obtain consent unless an exception applies; collect no more than necessary | Consent records |
Notice and Choice | s. 7 | Give a written notice in Bahasa Malaysia and English | Your PDPA notice and a record of its issue |
Disclosure | s. 8 | Disclose data only for the stated purposes and to the classes of third parties named in your notice | A list of disclosures to third parties |
Security | s. 9 | Take practical steps to protect data from loss, misuse and unauthorised access | A security policy that meets the PDP Standard |
Retention | s. 10 | Keep data no longer than necessary, then destroy or permanently delete it | Disposal records and a disposal schedule |
Data Integrity | s. 11 | Keep data accurate, complete and up to date | An update process and a record of compliance |
Access | s. 12 | Let individuals access and correct their data | A procedure for handling requests within 21 days |
Only one row in that table is a notice.
The other six are about what happens inside your business, and none of them can be shown with a notice.
[For further details about 7 PDPA Principles in Malaysia, please click here]
What does the PDP Standard 2015 expect from you day to day?
The Personal Data Protection Standard 2015 ("PDPS") is where the principles turn into practice. The Commissioner describes it as a "minimum requirement". The Standard applies to anyone who processes personal data in commercial transactions.
Some of its requirements are very specific. Consider a few of them against the dental clinic:
Access control. You must register every employee who handles personal data, give authorised staff their own user ID and password, and terminate access as soon as someone leaves. In the practice of the dental clinic case, the locum dentist who left in March should no longer be able to log in to the clinic system, and should no longer be in the WhatsApp group where staff share appointment lists.
Transfers. Transferring personal data by removable media device (like a pendrive) or cloud computing service is not permitted without written consent from an officer authorised by top management. Every such transfer must be recorded.
Vendors. Any third party you appoint to process personal data, such as your clinic software provider, must be bound by a contract.
Paper. Personal data on paper must be kept in locked storage, with a record of who holds the keys, and destroyed by shredding or another appropriate method when no longer needed.
Retention. Personal data collection forms used in commercial transactions must be disposed of within 14 days, unless they carry legal value in relation to the transaction. You also need a disposal schedule for inactive data, with a 24-month period, and records showing the disposals actually happened.
Accuracy. You must offer a way for people to update their details, and update records immediately once a correction request is received.
This is why PDPA compliance cannot be a single document. Most of the Standard describes things your staff do every day.
What should you ask yourself before your next PDPA review?
What exactly does your PDPA notice promise? Read it line by line, and name the person in your business responsible for making each statement true.
What gives you proof of consent? Where is it recorded, how would you retrieve it for one particular customer, and for anyone under 18, who gave it?
Does your business fall within a class that must register? Check the Personal Data Protection (Class of Data Users) Order 2013, as amended. It covers businesses such as private clinics, pharmacies, licensed travel agents, private schools, direct sellers, moneylenders, pawnbrokers, and companies providing legal, audit, accounting, engineering or architectural services.
How many people's data do you hold? Count past and inactive records too. They count toward the thresholds for appointing a data protection officer (DPO), and they are probably overdue for disposal.
If a laptop with your customer list were stolen tonight, who would handle the data breach notification to the Commissioner within 72 hours, and with what information?
So what did the dental clinic really get wrong?
The notice was not wasted. It was the first page of the file.
The clinic's mistake was treating the first page as the whole file. The inspection was never going to be about whether the clinic had told patients what it does with their data. It was always going to be about whether the clinic could show that it actually does what it said.
That is the real difference between a PDPA notice and PDPA compliance. A notice tells people what you do with their data. Compliance means being able to prove it.
Frequently asked questions about PDPA compliance in Malaysia
Is a PDPA notice mandatory in Malaysia?
Yes. Section 7 of the PDPA requires every data controller processing personal data in commercial transactions to give a written notice, in Bahasa Malaysia and English, regardless of business size.
Does a PDPA notice count as consent?
No. The Commissioner's guidance states that a notice should not be used to obtain consent. Consent must be obtained separately, in a form that can be recorded and maintained.
Do SMEs in Malaysia need to appoint a data protection officer?
Only if they meet a threshold: more than 20,000 data subjects, more than 10,000 data subjects whose sensitive personal data (including financial information) is processed, or regular and systematic monitoring of personal data.
What is the data breach notification deadline in Malaysia?
Since 1 June 2025, a data controller that has reason to believe a personal data breach has occurred must notify the Personal Data Protection Commissioner as soon as practicable, and within 72 hours under the Commissioner's guideline. If the breach is likely to cause significant harm, the affected individuals must also be notified within seven days.
Do all businesses need to register with the Personal Data Protection Commissioner?
No. Only businesses in the classes listed in the Class of Data Users Order must register. All other businesses must still comply with the rest of the PDPA.
For further detail, click here to find out do you need register as Data Controller under the PDPA.
What is the penalty for breaching the PDPA principles?
Since the 2024 amendments to the PDPA, a fine of up to RM1 million, imprisonment of up to three years, or both. Under section 133, directors and managers of a company may also be charged personally, unless they prove the offence happened without their knowledge and that they exercised due diligence to prevent it.
Is your PDPA compliance only as deep as your notice?
Speak to LAWENCO today! We start with a PDPA gap review: what personal data you hold, which obligations apply to your business, and what is missing. From there, we prepare the notices, consent forms, security, retention and breach response policies, and vendor agreements you need. We also advise on DPO appointment and registration.
Written by,
Registered Trademark, Patent and Design Agent
LL.B (HONS), CLP
Advocate & Solicitor
Disclaimer
This article is for general information only and does not constitute legal advice. You should obtain advice on your specific circumstances.
Comments