This 1-day program provides practical guidance on navigating the legal requirements of personal data protection in Malaysia. It focuses on day-to-day data handling challenges and includes real-world examples for better understanding.

With the latest PDPA amendments, the mandatory appointment of a Data Protection Officer (DPO) has become a critical requirement. This course highlights the DPO’s role in driving compliance, managing data breaches, and ensuring accountability under PDPA frameworks.

Participants will gain insight into building a strong privacy culture, developing risk-based compliance strategies, and aligning internal practices with regulatory standards. Organizations are strongly advised to appoint a qualified DPO and implement comprehensive data protection policies to avoid heavy penalties and enforcement actions.

Non-compliance with the PDPA can lead to severe consequences, including penalties of up to RM1,000,000 and/or 3 years’ imprisonment per offence. Organizations are strongly urged to appoint a qualified DPO, conduct regular training, and implement robust privacy policies.

As you are aware, there were recent amendments made to the Malaysian Personal Data Protection Act 2010 (“PDPA”). Some of the PDPA amendments have already come into force on 1 January 2025. However, some amendments have already taken effect as of 1 April 2025, while others will come into effect on 1 June 2025, as follows:

1 April 2025

• Replacement of the term “data user” with “data controller”
• Recognition of biometric data as a category of sensitive personal data
• Obligation of the data processors to comply with the Security Principle
• Increased penalties for non-compliance with the PDPA
• Principles to a maximum fine of RM1,000,000.00 and imprisonment of three (3) years
• Changes to transfer of data overseas

1 June 2025

• New obligation for both data controllers and data processors to appoint a Data Protection Officer (DPO)
• New mandatory personal data breach notification regime for data controllers
• New right of data portability granted to data subjects