Malaysia In Process Of Updating Its Privacy Law

Malaysia is in the process of updating its Personal Data Protection Act to align more closely with laws in other jurisdictions. The law was originally passed in 2010 and then modified this year. As part of the modification process, the country's Personal Data Protection Department (PDPD) sought input at the end of the summer on different areas of the newly revised law. Included in the request for input was the breach notification process, DPOs, and data portability. The time frame for input ended at the beginning of this month, and we thus expect to see more direction on these points in the near future.

Changes to Breach Notice Process

The first area for which the PDPD sought input was on data breach notifications. The law as revised will impose a new notification obligation. In particular, there will be a mandatory obligation to notify the Personal Data Protection Commissioner in the event of a breach. The PDPD sought input on when that notice would need to be