Every Malaysian who has ever received a cold call about a personal loan they never applied for has wondered the same thing: how did they get my number? The Personal Data Protection Act 2010 — the PDPA — is supposed to answer that. Most coverage of it is written for compliance officers. This one is written for the person on the receiving end of the call.
The law was amended in 2024, and the amendments came into force in stages across 2025. Companies got new obligations. You got new rights. Almost nobody has been told what they are.
What the PDPA covers, and where it stops
The PDPA governs personal data processed in commercial transactions. If a bank, telco, insurer, retailer, gym, clinic or app holds your name, IC number, phone number or address because of a commercial relationship, it falls inside the Act.
Two limits matter, and they surprise people.
First, the Act does not apply to the Federal Government or State Governments. That carve-out sits in Section 3 of the Act itself. Public-sector data sharing is handled separately under the Data Sharing Act 2025, which came into force on 28/04/2025 — a different law with a different regulator.
Second, data processed purely for personal, family or household purposes sits outside the Act. Your neighbour's WhatsApp group chat is not a data controller.
The 2024 amendment also swapped the vocabulary. What the Act used to call a "data user" is now a data controller. A privacy notice that still says "data user" has not been updated since 2024.
The rights you actually have as a data subject
You are the "data subject". The Act gives you a short list of things you can demand — not vague principles, but requests a company has to answer.
- Right of access. You can ask a company for a copy of the personal data it holds about you.
- Right of correction. If that data is wrong, you can require it to be fixed.
- Right to withdraw consent. You can pull back the consent you gave, in writing.
- Right to prevent processing for direct marketing. This is the one that stops the loan calls and the insurance SMS.
- Right to prevent processing likely to cause damage or distress.
- Right to data portability. Introduced by the 2024 amendment, this lets you ask that your data be transmitted directly from one controller to another, where it is technically feasible and the formats are compatible.
- Right to be notified. A controller must tell you what it collects and why, before or at the point of collection.
The direct-marketing right is the most underused of the seven, and the easiest to exercise — it does not depend on how the company got your number in the first place.
What the 2024 amendment changed for you
Four changes are worth knowing as a consumer.
Biometric data is now sensitive personal data. Fingerprints and face scans now sit in the highest-protection category, alongside health and religious data. Given how many Malaysian apps and buildings ask for a face scan, this matters.
Companies must appoint a Data Protection Officer. The Personal Data Protection Department, JPDP, published its DPO appointment guideline on 25/02/2025. In practice this gives you a named human to write to.
Breach notification became mandatory. More on that below.
Penalties went up. The maximum fine for breaching the personal data protection principles rose to RM1 million, effective 01/04/2025 — the number that finally got boardrooms interested.
For the full sequencing of what commenced when, Mayer Brown's summary of the amendments and the accompanying guidelines is the clearest public breakdown.
How to make a request, and how to withdraw consent
There is no official form for a data access request. There is a deadline, which is better.
- Find the right address. Check the company's privacy notice — usually in the website footer or the app's settings. Post-2025, most large Malaysian companies list a DPO email there.
- Write in plain terms. State that you are making a data access request under the Personal Data Protection Act 2010. Give your full name, IC number and the account or reference number they know you by.
- Say what you want. A copy of the personal data held about you, and where relevant, the source it came from.
- Expect a fee. A controller may charge a reasonable fee for an access request. The maximum is fixed under the Personal Data Protection (Fees) Regulations 2013, so it is a small administrative amount, not a deterrent.
- Count 21 days. A data controller must comply with an access or correction request within 21 days of receiving it.
Send it by email and keep the sent copy. That timestamp is what a complaint later rests on.
Correction requests work the same way, except you should attach evidence of the correct detail — a MyKad copy for a wrong IC number, a utility bill for a wrong address.
Withdrawing consent is a separate written notice, made under Section 38 of the Act. Once you send it, the controller again has 21 days to tell you whether it will comply, to what extent, and if not, why.
Two things people get wrong here. Withdrawing consent for marketing is not the same as closing your account — say explicitly that you want to keep the service and stop the promotional messages, or you may get an unhelpful reply about contract termination. And "please remove me from your database" is weaker than it sounds. Ask specifically to cease processing your personal data for direct marketing purposes, and to be removed from any third-party marketing lists your data was shared with.
If the calls continue and the number is not the company at all, you are probably looking at a scam operation rather than a marketing one. That is a different playbook — start by checking the number against Semak Mule before you engage.
What happens when a company is breached
This is the biggest practical change from the amendment, and the one most people have not noticed.
Under the Personal Data Protection Commissioner's Circular No. 1/2025, a data controller that has reason to believe a personal data breach has occurred must notify the Commissioner within 72 hours.
If the breach is likely to cause significant harm to affected individuals, the controller must also notify those individuals — without unnecessary delay, and in any event within 7 days after it notified the Commissioner.
So the timeline to expect, from the moment a company knows: 72 hours to the regulator, 7 days from there to you. If you learn about a breach from a news report weeks before you get an email, that gap is itself something JPDP can be told about.
When a breach notice does land, the sensible response is unglamorous. Change the password on that service and anywhere you reused it. Turn on two-factor authentication. Treat any call referencing the breach as hostile until proven otherwise — leaked data is exactly what makes the next scam call sound convincing, and AI voice cloning has made those calls harder to dismiss.
How to complain to JPDP when a company ignores you
JPDP's own guidance is to complain to the organisation first and give it a chance to respond. Do that, in writing, wait out the 21 days, then escalate. A complaint can be lodged with the department in writing or through its online channels:
| Channel | Detail |
|---|---|
| Complaints email | [email protected] |
| JPDP call centre | 03-7456 3888 |
| Government call centre (MyGCC) | 03-8000 8000 |
| Portal | pdp.gov.my |
Attach the original request, the date you sent it, and whatever reply you did or did not get. A complaint with a paper trail moves; a complaint that is only a grievance does not. If you disagree with the Commissioner's eventual decision, the Act provides for an appeal to the Appeal Tribunal.
For the wider set of official portals worth bookmarking before you need them, our rundown of Malaysian government portals covers the ones that come up most.
FAQ
Does the PDPA apply to government agencies?
No. Section 3 of the Act states it does not apply to the Federal Government or State Governments. Public-sector data sharing is governed separately under the Data Sharing Act 2025, which took effect on 28/04/2025.
How long does a company have to respond to my request?
21 days from receipt, for both data access and data correction requests. The same 21-day window applies to a notice withdrawing consent.
Can a company charge me to see my own data?
Yes, a reasonable fee is allowed, capped by the Personal Data Protection (Fees) Regulations 2013. It is an administrative charge, not a barrier.
What is the penalty if a company breaks the rules?
The maximum fine for contravening the personal data protection principles was raised to RM1 million with effect from 01/04/2025.
Do I have to be told if my data is leaked?
If the breach is likely to cause you significant harm, yes. The controller must notify the Commissioner within 72 hours, and notify affected individuals within 7 days of that notification.
