News and developments
Six (6) Things Your Business Need To Know On Personal Data Protection in Malaysia
In 2019, the Personal Data Protection Commissioner Malaysia (“PDPCM”) has undertaken the Act’s compliance inspections on business and commercial entities operating in Malaysia as the follows:
(b) Retention Principle
(c) Data Integrity Principle
![](https://www.legal500.com/developments/wp-content/uploads/sites/19/2021/03/Screenshot_2021-03-05-Campaign-Preview1.png)
It is therefore apparent that PDPCM’s enforcement approach in year 2019 had focused on the sectors of services, education, tourism and hospitalities, in particular the services sector, where the number of inspection visits conducted by PDPCM was approximately twenty (20) % of the total conducted inspections.2
Part 2: Six (6) Things You Need to Know on Personal Data Protection
1. Is Your Business Required to Comply with the Act?
As mentioned above, any processing of personal data in the context of commercial transactions would inevitably attract the application of the Act. Under the Act, "commercial transactions" include any matters relating to:- the supply or exchange of goods or services;
- agency;
- investments;
- financing;
- banking; and
- insurance.3
- Federal Government and State Governments;4
- where personal data are being processed outside of Malaysia, unless it is intended to be further processed in Malaysia;5 and
- credit report agencies under the Malaysia Credit Reporting Agencies Act 2010.6
2. Does Your Business Involve Processing of Personal Data?
Under the Act, the term "processing" refers to the collecting, recording, holding or storing of the personal data or carrying out any operation or set of operations on the personal data. For ease of understanding, below are some of the examples which may be considered as processing:- Collecting data through forms, by phone or via the web;
- Publishing data;
- Selling data;
- Using administrative data;
- Using data for marketing purposes;
- Recording data;
- Disclosing or providing data to other organizations; and/or
- Destroying data.7
3. Is Your Business Complying with the Personal Data Protection Principles?
In essence, the application of the Act revolves around seven (7) fundamental principles, namely8:- the General Principle;
- the Notice and Choice Principle;
- the Disclosure Principle;
- the Security Principle;
- the Retention Principle;
- the Data Integrity Principle; and
- the Access Principle.
4. Are There Any Guidelines or Standards issued on the Compliance of the Seven (7) Principles?
According to the PDPCM, the principles which are commonly breached by entities are the general, security, retention, and disclosure principles. This was probably caused by the concerns of having to bear the costs of compliance with the principles especially for the SME's owners. In addition, the lack of awareness of the public or businesses towards the personal data protection in our country also contributed to the breaches.10 Premised on such, the Personal Data Protection Standard 2015 ("Standard 2015") was introduced whereby it established the following three (3) minimum mandatory principles which entities must strictly adhere to:- the Security Principle;
- the Retention Principle; and
- the Data Integrity Principle.
- the requirements under the Standard 2015; and
- the principles under the Act,
5. What Are The Minimum Standards Under the Security Principle, the Retention Principle and the Data Integrity Principle?
The PDPCM has provided the following minimum standards to assist data users and processors to comply with the Security Principle, the Retention Principle and the Data Integrity Principle: (a) Security Principle In processing a data subject's personal data, a data user or processor is required to undertake all reasonable and practicable steps preventing any loss, misuse, modifications, unauthorized or accidental access or disclosure, alteration or destruction of the said data.12 On the other hand, where the data processing is carried out by an external third party, it is imperative to note that the data user must secure a sufficient guarantee from the third party service provider in respect of its security measures for the protection of the data and to undertake all reasonable steps to ensure compliance of this principle.13 (b) Retention Principle This principle stipulates that a data subject's personal data must not be retained longer than necessary for the fulfilment of the purpose for which it is being processed.14 Upon fulfilment of the said purpose, it is the duty of the data user to take all reasonable steps to destroy or permanently delete all personal data after the retention period.15 The retention periods are varied in accordance to the requirements set out by different laws, for instance data regarding employee payrolls is required to be kept for seven (7) years long.16 On the other hand, if the data does not hold any legal value, it shall be disposed of within 14 days, whilst inactive personal data shall be disposed of within 24 months.17 (c) Data Integrity Principle This principle imposes a continuous obligation upon data users to take reasonable steps to ensure that the personal data to be accurate, complete, not misleading and kept up-to-date by having regard to the purpose, for which the personal data was collected and further processed.18 The above are some of the minimum standards that the PDPCM has prescribed to assist data users and businesses in working towards compliance with the above-mentioned three (3) data principles which are commonly breached. It is still mandatory to comply with the remaining principles of the seven (7) data principles as prescribed by the Act.6. Some Steps That Your Business Can Take To Ensure Compliance with the Minimum Standards
The following are some of the steps that your business may take to meet the minimum standards of data protection: (a) Security Principle![](https://www.legal500.com/developments/wp-content/uploads/sites/19/2021/03/Screenshot_2021-03-05-Campaign-Preview2.png)
![](https://www.legal500.com/developments/wp-content/uploads/sites/19/2021/03/Screenshot_2021-03-05-Campaign-Preview3.png)
![](https://www.legal500.com/developments/wp-content/uploads/sites/19/2021/03/Screenshot_2021-03-05-Campaign-Preview4.png)