The framework
Malaysia regulates personal data through the Personal Data Protection Act 2010, supervised by the Personal Data Protection Commissioner.
For advertisers the consent posture matters most, and Malaysia sits in the opt-in bloc, where tracking and outreach need permission up front.
Key instruments
Personal Data Protection Act 2010, amended 2024
Malaysia's 2024 amendment package modernized a 2010-era law in phases through 2025. Mandatory breach notification, DPO appointments and a data portability right arrived on 1 June 2025, biometric data joined the sensitive category, and processors took on direct security duties. Government processing remains outside the Act, a notable gap.
Marketing and advertising
Consent-based processing with a statutory right to stop direct marketing; the Act covers commercial transactions and excludes government. Most channel decisions here follow from that consent rule.
Cross-border transfers
2024 amendments scrapped the whitelist: transfers allowed where the destination has substantially similar law or adequate protection.
Enforcement and penalties
Raised in 2024 to RM 1M and imprisonment exposure per violation.