Does my new company need to comply with PDPA?
If your company processes customers' personal data commercially, PDPA obligations apply — and the 2024 amendments strengthened them, adding requirements including data breach notification and, for some organisations, appointing a data protection officer. Certain classes of data user must also register with the Commissioner.
Sources: Personal Data Protection Act 2010 (as amended 2024)
Also asked as: PDPA 2010 requirements new business; data protection registration malaysia; personal data protection act company; pdpa amendment 2024.
Most SMEs handle this with sensible basics: a privacy notice, consent where required, controlled access to customer data, and a breach response plan. We flag whether your activity class carries registration duties and refer specialists for programme work.
Key facts
- Applies to commercial processing of personal data
- 2024 amendments: breach notification, DPO for some organisations
- Some classes must register with the Commissioner
Call +60 10-383 5988 (a licensed secretary replies within one working hour (Mon–Fri 8:30am–5:30pm MYT; outside hours, first thing next working day)) or walk in at J-3A-15, Solaris Mont Kiara.