On 4 July 2024, Minister of Digital, Gobind Singh Deo, announced that the Cabinet has approved the proposed amendments to the Personal Data Protection Act 2010 (“PDPA 2010”), and they are expected to be tabled in the current parliamentary session. The Second Meeting of the Third Session of the 15th Parliament will convene from 24 June 2024 to 18 July 2024.

It is noteworthy that the key proposed amendments to the PDPA 2010 are influenced by the provisions of the European Union General Data Protection Regulations (“EU GDPR”). Hence, upon coming into effect, these proposals would significantly affect Malaysian organisations and how they handle data processing. Some of the key proposals highlighted by Gobind for amending the PDPA 2010 include:

Additional Duties for Data Processors

Under the EU GDPR, data processors have a duty to, among others, implement appropriate security measures and demonstrate compliance with requirements imposed by data supervisory authorities. As the PDPA 2010 currently stands, a data user engaging a data processor is required to procure sufficient guarantees from the data processor in respect of technical and organisational security measures governing the processing to be carried out and to take reasonable steps to ensure compliance with those measures.

This is carried out by imposing obligations on data processors via a data processing agreement. Upon the amended PDPA 2010 being implemented, data processors may also be made liable for data breaches and will no longer be bound merely by the four corners of the data processing agreement.

Data Protection Officers

The EU GDPR requires a DPO to be appointed by data controllers and processors where certain thresholds are met. The duties of a DPO under the EU GDPR include working towards compliance with all relevant data protection laws, monitoring specific processes such as data protection impact assessments, raising awareness and training employees on data protection, as well as collaborating with supervisory authorities.

Currently, the PDPA 2010 does not mandate the appointment of a DPO. However, once this requirement is imposed by the amended PDPA, organisations that are not prepared may face practical issues, including the availability of expertise in the area and cost implications. It was also announced earlier this year that the Data Protection Officers Guidelines are among the seven guidelines that will be developed under the PDPA.

Conclusion

With the anticipated amendments to the PDPA 2010 scheduled for presentation by July 2024, it is crucial for organisations to initiate proactive preparations to ensure they can effectively implement the necessary operational measures. This includes reviewing existing data protection practices, assessing potential impacts of the amendments on current operations, and planning appropriate adjustments to policies and procedures. By taking these steps ahead of time, organisations can better navigate and comply with the forthcoming regulatory changes, thereby safeguarding data privacy and enhancing overall compliance efforts.

Author: Arissa Ahrom