PDPA Malaysia security checklist for SMEs

Last reviewed: 8 November 2026

Not legal advice. This page is general education, written from public official sources linked below. It is not legal advice and may be out of date. For decisions about your business, check the official source or ask a Malaysian lawyer.

The Personal Data Protection Act 2010 (Act 709, “PDPA”) applies to businesses that process personal data in commercial transactions, such as customer, staff and supplier records. The Personal Data Protection (Amendment) Act 2024 (Act A1727) added new duties. This page turns the security parts into a checklist. It does not cover every PDPA duty.

What changed with the 2024 amendments

The amendments came into operation in three stages: 1 January, 1 April and 1 June 2025 (official commencement notice). In short:

Change	In operation from	Source
Data processors (for example your IT or cloud provider) must themselves comply with the Security Principle; maximum penalty for breaching the Personal Data Protection Principles raised to RM1,000,000 or 3 years' imprisonment or both	1 April 2025	Act A1727 ss. 4–5, notice
Rules on transferring personal data outside Malaysia (section 129) amended; the Commissioner has issued cross-border transfer guidelines	1 April 2025	Act A1727 s. 12, CBPDT Guidelines
Appoint a Data Protection Officer (DPO), when the thresholds below apply	1 June 2025	Act A1727 s. 6, DPO Guideline
Notify the Commissioner of personal data breaches	1 June 2025	Act A1727 s. 6, DBN Guideline
Right to data portability	1 June 2025	Act A1727 s. 9

Security checklist

The Security Principle (section 9 of Act 709) requires practical steps to protect personal data from loss, misuse, unauthorised access and similar risks. The Personal Data Protection Standard 2015 sets out the Commissioner's minimum security, retention and data integrity measures. Practical steps for an SME:

Know where personal data lives: email, accounting and HR systems, shared drives, WhatsApp, paper files.
Control access: individual accounts, no shared logins, MFA on email and cloud systems, remove access when staff leave. A business password manager helps.
Protect devices: screen locks, updates on, disk encryption on laptops.
Back up and test restores (backup options).
Secure your website and email: HTTPS, security headers, SPF/DKIM/DMARC. Check your website and your email domain.
Have written terms with data processors (IT vendors, payroll, cloud) on security, since they are now directly bound by the Security Principle.
Keep data only as long as needed, then delete it securely.
Prepare a breach plan: who decides, who contacts the Commissioner, and how you will tell affected people (see below).

Data breach notification

According to the Commissioner's Guideline on Data Breach Notification:

A breach must be notified to the Commissioner when it causes or is likely to cause “significant harm”. The guideline counts as significant harm a risk of physical harm, financial loss or damage to credit records; misuse for illegal purposes; sensitive personal data; data that could enable identity fraud; or a breach of significant scale, meaning more than 1,000 affected data subjects.
Failing to notify the Commissioner can lead to a fine of up to RM250,000, imprisonment of up to 2 years, or both.

The breach clockFor a breach that causes, or is likely to cause, significant harm. The clock starts when the breach happens, not when you find it.

Breach happens
The clock startsThe 72 hours count from the occurrence of the breach.
Within 72 hours
Notify the CommissionerAs soon as practicable, and no later than 72 hours.
Within 7 more days
Tell the people affectedWhere significant harm is likely: without unnecessary delay, and no later than 7 days after notifying the Commissioner.
At least 2 years
Keep a breach registerRecord every breach, including ones that did not need notifying.

Reports are made through the JPDP breach notification page.

Do you need a Data Protection Officer?

A data subject is the person the data is about, such as a customer or a staff member. Under the Commissioner's DPO Guideline:

Do you need a Data Protection Officer?Answer each question. One yes is enough.

Do you process personal data of more than 20,000 data subjects?
YesAppoint a DPO.
Do you process sensitive personal data, including financial information, of more than 10,000 data subjects?
YesAppoint a DPO.
Do you carry out regular and systematic monitoring of personal data?
YesAppoint a DPO.

No to allThe guideline does not require a DPO. The rest of the PDPA still applies.

After you appoint a DPO, register them and submit their business contact details within 21 days of appointment (same guideline; see the DPO registration guide).

FAQ

Does the PDPA apply to small businesses?

The PDPA applies to personal data processed in commercial transactions, regardless of business size. Check the Commissioner's guidance on application of the Act for exceptions.

How fast must a data breach be reported in Malaysia?

The Commissioner's guideline says no later than 72 hours from the occurrence of the breach, when the breach causes or is likely to cause significant harm.

Does a small business need a DPO?

Only if it meets one of the thresholds in the DPO Guideline, such as processing personal data of more than 20,000 data subjects.