PDPA applies to almost every Malaysian business website that collects personal data. That includes contact forms, checkout pages and tracking cookies. You need a written privacy notice in English and Bahasa Malaysia, and a lawful basis for anything you collect. Since 2025 you may also need a Data Protection Officer and a 72-hour breach plan. This is general information, not legal advice. Check your specific obligations with an adviser.

Quick Takeaways

  • PDPA applies to any website that processes personal data in a commercial transaction, with very few exceptions.
  • Your privacy notice must be in writing, in English and Bahasa Malaysia, and must list what you collect and why.
  • Cookies and trackers that can identify a visitor count as personal data under the Act, even without a name attached.
  • Since June 2025, a data breach must reach the Commissioner within 72 hours, and some businesses must now appoint a Data Protection Officer.
  • Fines for breaching the core data protection principles now reach RM1,000,000; a separate registration rule applies to 13 specific business classes.

I’ve sat through enough client kickoff calls to know how this usually goes.

Someone asks about the privacy policy. Someone else says “just copy one from another website.”

That’s the moment I jump in. A copied privacy policy describes a different company’s data practices, not yours.

If the Commissioner ever asks, that mismatch is the first thing that gets flagged.

PDPA sits alongside the other legal requirements every Malaysian website owner must follow. It gets far less attention than company registration disclosures do.

Here’s what the Personal Data Protection Act 2010 actually requires. Section by section, for a Malaysian business website in 2026.

Is PDPA Mandatory for Your Website?

Yes, if your website collects personal data as part of a commercial transaction.

Act 709 covers any person or business that processes personal data for a commercial activity (Source: Department of Personal Data Protection Malaysia, Act 709 (2010)).

That includes anyone who “controls or authorizes” that processing too, under the Act’s own definition of a data controller (Source: mylaw.my, Act 709 Section 4 (2010)).

A contact form counts. So does a checkout page.

So does a newsletter signup box, or a WhatsApp button that logs a phone number.

The main carve-outs are the Federal and State governments (Source: mylaw.my, Act 709 Section 3 (2010)). Also exempt: data handled purely for personal or household use (Source: mylaw.my, Act 709 Section 45 (2010)).

There’s no small-business exemption. A one-page site with a single enquiry form sits under the same Act as a 500-SKU online store.

If your website talks to customers in Malaysia, assume PDPA applies. Then work out what that means for your specific setup.

What Counts as Personal Data on Your Site

Malaysian business owner reviewing customer data on a laptop in the office

Personal data is any information that can identify a living person. Directly or indirectly.

On a typical Malaysian business website, that includes names and IC numbers. Email addresses, phone numbers, delivery addresses and payment details too.

It also includes things owners don’t think of as “data.” An IP address. A device ID. A browsing pattern tied to a cookie.

Some data gets a stricter category. Health records, religion, sexual orientation and political opinions are all sensitive personal data.

The 2024 amendment added one more to that list: biometric data (Source: GLT Law, 2024).

We built a compliance-focused online pharmacy platform for MSH ePharma, with pharmacist verification built into the purchase flow.

A prescription upload is sensitive personal data. A delivery address isn’t, but it still needs protecting.

Sensitive personal data needs its own explicit consent, separate from the general consent covering an email address. Treat the two differently from the first form field you design.

What Your Privacy Notice Must Say

Section 7 of the Act is the Notice and Choice Principle. It’s the one your website actually has to publish.

It requires a written notice telling visitors what data you collect, and why.

It must also say who you disclose it to. And how they can access or correct it.

Section 7(3) of the Act sets the language rule. The notice “shall be in the national and English languages” (Source: mylaw.my, Act 709 Section 7(3) (2010)).

An English-only privacy policy doesn’t meet that bar. Not even if every visitor on your site reads English fine.

The notice has to reach people before or at the point you collect their data. Not buried three clicks deep in a footer link.

Link it directly from the form itself.

PDPA checklist for Malaysian websites covering notice, consent, security and breach response

Five things belong on every Malaysian business website because of this. A bilingual privacy notice. A described lawful basis for each form.

A stated retention period. Visible security practices. A named contact for access requests.

Skip any one of them and your notice reads like a template. Because it is one.

If you’re launching a new site, fold this into your pre-launch review. It belongs alongside the rest of our website launch checklist, not patched in after you go live.

Person browsing a website on a phone in a casual cafe setting

Cookies fall under the General Principle in Act 709. Personal data may only be processed with consent, for a purpose the data subject knows about.

The Act has no section titled “cookies,” unlike the EU’s rules. Malaysia handles the same ground through this one general rule instead.

A cookie or tracking script that ties browsing behavior to an identifiable visitor is processing personal data.

The General Principle applies to it the same way it applies to a signup form.

My own reading of it, having built sites under this Act for years: a banner that only says “we use cookies” is doing the bare minimum.

It gives no real choice, which falls short of the actual job.

Consent has to be tied to a stated purpose a visitor actually understood. A vague cookie notice at the bottom of the screen falls short of that bar.

Analytics, retargeting pixels and chat widgets all fall under this same logic. Name the tool in your notice if it identifies a visitor.

Then give people a real way to decline.

Breach Notification and Data Protection Officer Rules

The Personal Data Protection (Amendment) Act 2024 added two obligations. Neither existed before 2025.

First, mandatory breach notification. A data breach must reach the Commissioner within 72 hours of the breach occurring (Source: DLA Piper, 2025).

If the breach is likely to cause significant harm, affected individuals hear about it too. Within 7 days of that Commissioner notice (Source: DLA Piper, 2025).

72 hours is 3 days. The clock starts at the breach itself, not the moment you notice it.

If your web host and your marketing team don’t already know who calls who first, you’ll lose most of that window just figuring it out.

Second, a mandatory Data Protection Officer. It kicks in past 20,000 data subjects.

Or past 10,000 data subjects for sensitive or financial data.

It also applies to any activity needing regular, systematic monitoring (Source: DLA Piper, 2025).

A busy ecommerce store can cross 20,000 customer records faster than the owner expects. Check your actual database count, not your gut feeling about company size.

The penalties went up alongside these new duties. Breaching the core data protection principles now carries a fine of up to RM1,000,000.

Plus up to 3 years in prison. That’s up from RM300,000 and 2 years before the amendment (Source: GLT Law, 2024).

Failing to notify a breach carries its own fine, up to RM250,000 and 2 years (Source: GLT Law, 2024).

Do You Need to Register as a Data User?

Registration is a separate requirement, on top of the Notice and Choice duties above. It catches more Malaysian businesses off guard than it should.

Under the Personal Data Protection (Class of Data Users) Order, 13 classes of business must register with the Commissioner.

Registration comes on top of the usual Act compliance.

The list covers communications, banking, insurance and health. Tourism, transport, education, utilities, pawnbrokers and moneylenders too.

It also covers “direct sales and services,” a class that includes retail and wholesale dealing. Plus legal, audit, accounting, engineering and architecture firms (Source: Free Malaysia Today, 2023).

Retail and wholesale dealing sits inside that list. A fair number of online sellers assume registration is only for banks and hospitals.

That assumption is wrong for some of them.

Most small, single-founder websites outside these 13 classes don’t need to register.

If you’re in one of them, or close enough to argue about it, get a straight answer from an adviser. Don’t guess.

Operating in a registered class without a valid certificate is its own offense. It’s separate from a Data Protection Principles breach.

If your business already tracks deadlines for things like e-invoicing, add PDPA registration to the same calendar. Our e-invoice compliance checklist for online sellers follows the same approach.

ViolationMaximum fineMaximum imprisonment
Breach of the core Data Protection PrinciplesRM1,000,0003 years
Failure to notify a data breachRM250,0002 years
Processing data without registering in a required classRM500,0003 years

That registration penalty traces to the same Act (Source: Free Malaysia Today, 2023).

These are the three ways a Malaysian business website actually gets fined under this Act.

FAQ

Do I need a cookie consent banner on my Malaysian website?

PDPA has no section specifically about cookies. But a cookie that identifies a visitor is personal data. The General Principle requires consent for a stated purpose before you process it.

Does PDPA apply to a sole proprietor or small business website?

Yes. The Act applies to any commercial transaction. There’s no exemption based on company size, revenue or number of employees.

What happens if my website has no privacy policy at all?

You’re in breach of the Notice and Choice Principle from the moment you collect data without one. Fines for Data Protection Principles breaches reach RM1,000,000.

Do I need to appoint a Data Protection Officer?

Only past 20,000 data subjects, or past 10,000 for sensitive or financial data. Or if you run activities needing regular, systematic monitoring.

Most small sites fall under these thresholds. Check your actual customer count to be sure.

Is Malaysia’s PDPA the same as the EU’s GDPR?

PDPA and GDPR are different laws. PDPA is Malaysia’s own law under Act 709, narrower in scope and focused on commercial transactions.

The 2024 amendment brought it closer to GDPR on breach notification and accountability. The two still run as separate legal regimes, with separate registration and penalty structures.

The Bottom Line

PDPA rewards a recurring routine, checked whenever your forms or tracking scripts change.

It’s a bilingual notice that matches what your forms actually do. A cookie policy with a real choice behind it.

And a breach plan you’ve actually written down, before you need it.

Start this week with one audit. List every form and tracker on your site.

Match each one to a line in your privacy notice. Fix the gaps you find.

If you’re in one of the 13 registered classes, confirm that separately. It’s a different question from whether your privacy policy is any good.

PDPA compliance belongs in the same routine as the rest of your website maintenance.

At Jumix, we build this into the site structure from the start, as part of how we plan every build.

A website built the right way makes compliance a feature from day one.