PDPA (Personal Data Protection Act)
Malaysia's data privacy law that governs how businesses collect, store, and use customer personal data. All businesses collecting customer info must comply.
What is PDPA?
The Personal Data Protection Act 2010 (PDPA) is Malaysia's primary data privacy legislation. It governs how organisations collect, process, store, use, and disclose personal data of Malaysian individuals.
Who Must Comply?
Any business that collects personal data of Malaysian individuals in the course of commercial transactions must comply — this includes virtually all e-commerce stores, service businesses, apps, and websites.
Key Obligations
- Consent — obtain explicit consent before collecting personal data
- Notice — inform users why you're collecting their data and how it will be used
- Access & Correction — allow individuals to access and correct their data
- Security — implement appropriate safeguards to protect personal data
- Retention — don't keep personal data longer than necessary
Penalties for Non-Compliance
Violations can result in fines up to RM500,000 and/or imprisonment up to 3 years. Ensure your website has a Privacy Policy, consent checkboxes on sign-up forms, and a clear data retention policy.
Apply this with MarketOS
AI content, ads, SEO, CRM — built for Malaysian SMEs.