The Personal Data Protection Act (PDPA) in Malaysia requires businesses to protect their customers’ personal data by not misusing, collecting, or processing it without explicit consent.
The PDPA was enacted as a response to the indiscriminate collection and use of personal information without consent or security precautions, causing concerns about privacy and safety.
The PDPA establishes rules that businesses must follow, including obtaining consent and ensuring secure storage of information.
These regulations safeguard individuals’ privacy and information, and recognize the importance of personal data in today’s digital age.
Objective of Personal Data Protection Act
The objectives of the PDPA are to protect personal information while recognizing the need for businesses to collect, use, or share it for legitimate reasons.
The PDPA applies to personal information in both electronic and non-electronic formats, but not to personal or domestic use, employee data, or public agencies.
Most businesses in Malaysia have to deal with the collection, processing, and transfer of personal data in their day-to-day operations, making them data users under the PDPA.
As such, it is essential for businesses to comply with the Act.
The Communications and Multimedia Minister has announced that amendments to the PDPA are in the pipeline to strengthen the law after a series of personal data breaches in the country.
Malaysia Personal Data Protection Act (PDPA) for Business
Here are some key points that businesses should be aware of:
1. Consent
Organizations must obtain explicit consent from individuals before collecting, processing, or disclosing their personal data.
Consent should be informed, freely given, and specific to the purposes for which the data is collected.
2. Notice and Choice
Organizations are required to provide individuals with clear and concise notices regarding the collection, use, and disclosure of their personal data.
Individuals should also be given the option to choose whether their data can be used for direct marketing purposes.
3. Data Transfer
If personal data is transferred outside of Malaysia, organizations must ensure that the receiving country has a level of data protection that is comparable to Malaysia’s PDPA, or obtain consent from the individuals before transferring their data.
4. Security Measures
Organizations are required to implement appropriate security measures to protect personal data against unauthorized access, disclosure, alteration, or destruction.
5. Rights of Individuals
Individuals have the right to access, correct, and withdraw their consent to the collection and use of their personal data.
Organizations are required to respond to such requests in a timely manner.
6. Compliance and Penalties
Organizations must comply with the PDPA, and failure to do so can result in fines, penalties, and other legal consequences.
To register under the PDPA, businesses can go to the daftar.pdp.gov.my link and complete the registration.
The Act specifically allows data users to process employee data, but only under certain conditions.
Overall, the PDPA presents both challenges and opportunities for businesses in Malaysia.
Compliance with the PDPA’s data protection principles may require significant investments in information technology and personnel training, which could be a challenge for smaller businesses.
However, compliance with the PDPA can also improve consumer trust and confidence in a business, leading to increased customer loyalty and repeat business.
Additionally, Malaysia’s digital progress has kept pace on the global front, and the country is poised for further growth in this area.
However, financing or digitalization costs remain one of the top challenges for businesses in Malaysia, especially in light of the COVID-19 pandemic and its economic impacts
What is GDPR in Malaysia?
GDPR stands for the General Data Protection Regulation, which is a comprehensive data protection regulation enacted by the European Union (EU) to protect the privacy and personal data of individuals residing in the EU.
It came into effect on May 25, 2018, and sets forth stringent requirements for organizations that process personal data of EU residents, regardless of their location.
It’s important to note that GDPR is a regulation of the EU and is not specifically applicable in Malaysia.
However, organizations in Malaysia that process personal data of EU residents or have business operations that involve the EU may be subject to compliance with GDPR due to its extraterritorial application.
Organizations in Malaysia that are subject to GDPR may need to comply with various requirements, such as obtaining explicit consent for processing personal data, implementing appropriate security measures, appointing a Data Protection Officer (DPO) in certain situations, conducting data impact assessments, and notifying data breaches to relevant authorities and affected individuals within a specified timeframe.
It’s recommended for organizations in Malaysia that may be subject to GDPR to seek legal advice and conduct thorough assessments to ensure compliance with the regulation, considering the specific requirements and nuances of GDPR, as well as the context of their operations and data processing activities.
Conclusion
In summary, it’s important for businesses operating in Malaysia to familiarize themselves with the PDPA and ensure compliance with its requirements to protect the privacy and rights of individuals whose personal data is collected and processed.
For specific legal advice and guidance, it’s recommended to consult qualified legal professionals or refer to the official PDPA legislation and relevant authorities in Malaysia.
To register under the PDPA, businesses can go to the daftar.pdp.gov.my link.
Related articles:
