Most SME sites in Malaysia collect personal data through a form, a chat widget and an advertising pixel, then treat the privacy policy as decoration. Since the 2024 amendment came into force, that gap has deadlines attached.
PDPA and your Malaysia website: the short answer
If your business collects a name, an email address or a phone number through its website, the Personal Data Protection Act 2010 applies to you, and the Personal Data Protection (Amendment) Act 2024 raised what it asks. The practical minimum is four things: a personal data protection notice in Bahasa Malaysia and English, shown at the point of collection rather than buried in the footer; consent that is recorded instead of assumed; a written record of where that data travels once it leaves the form; and a named person who is accountable when something goes wrong. Everything else is refinement.
The amendment came into force in stages across 2025, with the mandatory breach notification and data protection officer obligations taking effect on 1 June 2025. The change of tone matters more than any single clause. Personal data used to be an administrative afterthought on most SME sites. It is now a set of obligations with deadlines attached, and the first is measured in hours.
What the 2024 amendment actually changed
Four changes reach an ordinary business website. The law now calls you a data controller rather than a data user, and your vendors data processors, which sounds cosmetic until you notice that processors carry direct liability for the Security Principle instead of sheltering behind your contract. According to analysis of the amendment by Tay and Partners, a controller who contravenes the personal data protection principles faces a fine of up to RM1 million or imprisonment of up to three years.
Second, breach notification became mandatory: a reportable breach must be reported to the Commissioner within 72 hours, and affected individuals informed within seven days of that report where significant harm is likely, with failure to notify carrying a fine of up to RM250,000. Third, organisations above certain processing thresholds must appoint a data protection officer. Fourth, individuals gained a data portability right, and the old whitelist for sending data abroad was replaced by a test of whether the destination provides substantially similar protection, with the Commissioner publishing cross-border transfer guidelines in 2025.
Consent, and the notice most sites get wrong
Malaysia does not offer a broad legitimate interest basis the way Europe does. Consent sits at the centre, and the Notice and Choice Principle in Section 7 requires a written notice in both Bahasa Malaysia and English, given when the data is first collected. An English-only policy linked from the footer satisfies neither the language requirement nor the timing one, and it is the most common failure we find when we audit a Malaysian SME site.
What the notice has to say is specific and unglamorous: what data you collect, the purpose, its source, who you may disclose it to, how the person can access and correct it, whether supplying it is obligatory, and how to limit its use. Consent should be a deliberate act rather than an inference: an unticked box beside one plain sentence, with the submission timestamped and stored, is worth more in an investigation than a paragraph nobody opened. If you later use that address for a newsletter you never mentioned, that is a new purpose, and the Act gives the person a standing right to stop direct marketing.
The PDPA Malaysia website checks that involve your ads and your CRM
Malaysia has no cookie-specific rule. According to the Chambers Data Protection and Privacy 2026 guide for Malaysia, there are currently no requirements dedicated to online tracking technologies, consent models or cookie policies. That is not permission to ignore them. A Meta pixel, a Google Ads conversion tag and a chat widget all transmit identifiers and behaviour to third parties, and where that is processing personal data, the consent and notice principles apply. The defensible position is a banner that loads analytics and advertising tags only after a choice, essential cookies kept separate, and a cookie section in the notice naming the vendors.
The CRM is the larger exposure, because that is where data accumulates. Map it once: which forms feed it, which tools sync from it, who can export, and which of those tools hold data outside Malaysia. Check that each vendor agreement obliges the processor to secure the data and report a breach quickly, because your 72 hours begin when you become aware, and you become aware only if the vendor tells you. Then set retention rules and delete. A dormant list of enquiries from four years ago carries all of the liability and none of the value. This is a practitioner checklist rather than legal advice.
The practical minimum for an SME site
- A bilingual notice at the point of collection. Publish the personal data protection notice in Bahasa Malaysia and English, and surface it at every form, not only as a footer link. Name the purposes you will actually use it for, including marketing, before you use it that way.
- Consent you can evidence. Unticked opt-in boxes, separate consent for marketing, and a stored record of what was agreed, when, and against which version of the notice.
- A one-page data map. List every place personal data enters, every system it lands in, every vendor that touches it and every country it sits in. One page is enough.
- Vendor and cross-border review. Check that processor agreements cover security and breach notification, and that transfers abroad can be justified under the substantially similar protection test set out in the Commissioner's cross-border guidelines.
- A breach plan rehearsed before you need it. Who is called, who assesses significant harm, who drafts the notification, and who owns the 72-hour clock. The obligations took effect on 1 June 2025, so an untested plan is a business risk.
- Retention and deletion that run on a schedule. Decide how long enquiries, applications and customer records live, then automate the deletion. Data you no longer hold cannot be breached.
PDPA compliance for Malaysian websites: common questions
- Does the PDPA apply to a small company website? — Yes. It applies to personal data processed in commercial transactions regardless of company size, so a contact form or a newsletter signup brings you within it. The thresholds that vary by size govern appointing a data protection officer, not whether the law applies.
- Do I need a cookie banner in Malaysia? — There is no cookie-specific rule, and the Chambers Data Protection and Privacy 2026 guide for Malaysia notes the absence of dedicated requirements for tracking technologies. Where cookies process personal data the consent and notice principles still apply, so a banner that holds advertising and analytics tags until the visitor chooses is the defensible position.
- Does my business need to appoint a data protection officer? — The 2025 guidelines set thresholds based on processing volume, broadly the personal data of more than 20,000 individuals or the sensitive personal data of more than 10,000, plus activities requiring regular and systematic monitoring. Appointments are notified to the Commissioner and a contact point published.
- What happens if we have a data breach? — Notify the Commissioner within 72 hours of becoming aware, and inform affected individuals within seven days of that notification where significant harm is likely. Failure to notify carries a fine of up to RM250,000, which is why the plan must exist before the incident.
Keep reading
Build something
worth trusting.
Tell us what's slowing your business down. We'll show you the system that fixes it — and how fast.