PDPA Malaysia security checklist for SMEs

Last reviewed: 8 November 2026

Not legal advice. This page is general education, written from public official sources linked below. It is not legal advice and may be out of date. For decisions about your business, check the official source or ask a Malaysian lawyer.

The Personal Data Protection Act 2010 (Act 709, “PDPA”) applies to businesses that process personal data in commercial transactions, such as customer, staff and supplier records. The Personal Data Protection (Amendment) Act 2024 (Act A1727) added new duties. This page turns the security parts into a checklist. It does not cover every PDPA duty.

What changed with the 2024 amendments

The amendments came into operation in three stages: 1 January, 1 April and 1 June 2025 (official commencement notice). In short:

Change	In operation from	Source
Data processors (for example your IT or cloud provider) must themselves comply with the Security Principle; maximum penalty for breaching the Personal Data Protection Principles raised to RM1,000,000 or 3 years' imprisonment or both	1 April 2025	Act A1727 ss. 4–5, notice
Rules on transferring personal data outside Malaysia (section 129) amended; the Commissioner has issued cross-border transfer guidelines	1 April 2025	Act A1727 s. 12, CBPDT Guidelines
Appoint a Data Protection Officer (DPO), when the thresholds below apply	1 June 2025	Act A1727 s. 6, DPO Guideline
Notify the Commissioner of personal data breaches	1 June 2025	Act A1727 s. 6, DBN Guideline
Right to data portability	1 June 2025	Act A1727 s. 9

Security checklist

The Security Principle (section 9 of Act 709) requires practical steps to protect personal data from loss, misuse, unauthorised access and similar risks. The Personal Data Protection Standard 2015 sets out the Commissioner's minimum security, retention and data integrity measures. Practical steps for an SME:

Know where personal data lives: email, accounting and HR systems, shared drives, WhatsApp, paper files.
Control access: individual accounts, no shared logins, MFA on email and cloud systems, remove access when staff leave. A business password manager helps.
Protect devices: screen locks, updates on, disk encryption on laptops.
Back up and test restores (backup options).
Secure your website and email: HTTPS, security headers, SPF/DKIM/DMARC. Check your website and your email domain.
Have written terms with data processors (IT vendors, payroll, cloud) on security, since they are now directly bound by the Security Principle.
Keep data only as long as needed, then delete it securely.
Prepare a breach plan: who decides, who contacts the Commissioner, and how you will tell affected people (see below).

Data breach notification

According to the Commissioner's Guideline on Data Breach Notification:

A breach must be notified to the Commissioner when it causes or is likely to cause “significant harm”. The guideline counts as significant harm a risk of physical harm, financial loss or damage to credit records; misuse for illegal purposes; sensitive personal data; data that could enable identity fraud; or a breach of significant scale, meaning more than 1,000 affected data subjects.
Notify the Commissioner as soon as practicable and no later than 72 hours from the occurrence of the breach.
Where significant harm is likely, notify affected individuals without unnecessary delay, no later than 7 days after notifying the Commissioner.
Keep a register of breaches, including ones that did not need notifying, for at least 2 years.
Failing to notify the Commissioner can lead to a fine of up to RM250,000, imprisonment of up to 2 years, or both.

Reports are made through the JPDP breach notification page.

Do you need a Data Protection Officer?

Under the Commissioner's DPO Guideline, you must appoint a DPO if you process personal data of more than 20,000 data subjects, sensitive personal data (including financial information) of more than 10,000 data subjects, or carry out regular and systematic monitoring of personal data. You must register the DPO and submit their business contact details within 21 days of appointment (same guideline; see the DPO registration guide).

FAQ

Does the PDPA apply to small businesses?

The PDPA applies to personal data processed in commercial transactions, regardless of business size. Check the Commissioner's guidance on application of the Act for exceptions.

How fast must a data breach be reported in Malaysia?

The Commissioner's guideline says no later than 72 hours from the occurrence of the breach, when the breach causes or is likely to cause significant harm.

Does a small business need a DPO?

Only if it meets one of the thresholds in the DPO Guideline, such as processing personal data of more than 20,000 data subjects.