The 2024 PDPA Amendments All Businesses Must Know
If your business handles any customer data—names, phone numbers, email addresses—you are subject to the Personal Data Protection Act 2010 (PDPA).
In 2025, the grace period for the PDPA (Amendment) Act 2024 is ending, and the “teeth” of this law are about to bite. The amendments introduce two game-changing obligations that all Malaysian businesses must be aware of.
1. Key Change: Mandatory Data Breach Notification
Previously, many businesses would handle a data breach internally, often without notifying the authorities or their customers. This is no longer an option.
- The New Law: The amendments introduce a mandatory data breach notification requirement.
- What this Means: If your company suffers a data breach (e.g., a hack, a lost laptop, an email sent to the wrong list), you must, by law, report this breach to the Department of Personal Data Protection (JPDP) within a specified timeframe (likely 72 hours).
2. Key Change: Drastically Higher Penalties
To ensure compliance, the government has significantly increased the penalties.
- Old Fines: Fines were previously capped at a maximum of RM500,000.
- New Fines: The amendments raise the maximum fine to RM5 million, along with potential imprisonment. This elevates a data breach from an “IT problem” to a major financial and legal risk.
What Your Company Must Do Now
- Appoint a Data Protection Officer (DPO): The amendments make this a formal legal requirement for many organisations.
- Have a Response Plan: You must have a clear, documented “Data Breach Response Plan” ready before a breach happens.
- Review Contracts: Ensure your contracts with “data processors” (like cloud services or payroll vendors) are compliant with the new law.
Leave a Reply