Personal Data Protection Act 2010 (PDPA)

On 15 November 2013, the Personal Data Protection Act 2010 (PDPA) came into force in Malaysia with the objective of protecting the personal data of individuals with respect to commercial transactions.

Frequently asked questions:

What is PDPA?

The Personal Data Protection Act 2010 (“PDPA”) is an Act that regulates the processing of personal data in regards to commercial transactions.

It was gazetted in June 2010.

The penalty for non-compliance is between RM100k to 500k and/or between 1 to 3 years imprisonment.

How does PDPA affect your business?

This Act applies to any person who collects and processes personal data in regards to commercial transactions.

The seven principles of the Act are:

  1. general
  2. notice and choice
  3. disclosure
  4. retention
  5. security
  6. access
  7. data integrity principle

Personal data relates directly or indirectly to a data subject, who is identified or identifiable from that information, or from that and other information in the possession of a data user, including any sensitive personal data and expression of opinion about the data subject. For example: name, identity card number, date of birth, mobile number and etc.

In the case where personal data processing is outsourced to a third party, known as the data processor, it is the responsibility of the data user to ensure that the data processor provides sufficient guarantee to protect the personal data from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction.

What are the main challenges?

This Act affects the personal data life cycle management process from the point personal data is collected, used, stored and destroyed.

This Act applies to customers, employees and third party service providers’ personal data.

A company's way of doing business will definitely be affected as business processes are required to be refined to comply with the PDPA requirements.

Most importantly, a central repository may be required for consent management. The process becomes more complex when cross border personal data transfer is involved.

How we can help you

Are you ready when the Act comes into force?

We are currently assisting our clients to be PDPA compliant.

The scope of work includes performing a gap analysis and impact assessment against the PDPA requirements as well as developing an implementation roadmap in closing the gaps identified in a most practical and efficient manner.

On top of that, PwC provides PDPA awareness training.

Please contact us for more information.

The personal data protection related services we provide include:

Gap Analysis and Development of Implementation Roadmap

  • Identify the gaps to meet the legal requirements and industry standards
  • Develop a strategic roadmap to address the gaps

Framework Development

  • Develop structure, roles and responsibilities, policies and procedures


  • Audit processes and systems to assess compliance with policies, standards and legal requirements

Seminar and Training

  • Design and present training and awareness programmes

Contact us

Glenda Eng Hui Sian

Director, Risk Services, PwC Malaysia

Tel: +60 (3) 2173 0557

Follow us