The amended Personal Data Protection Act asks every Malaysian SME that holds customer data to do four things: report serious data breaches within 72 hours, treat fingerprint and face data as sensitive, bind its service providers to the same security standard, and be ready to hand a customer’s data to another business on request. Larger data handlers must also appoint a Data Protection Officer. All of it was in force by June 2025, and the maximum fine for breaking the core principles rose to RM1 million.

The PDPA Malaysia SME owners have worked under for years changed in three steps during 2025, under the Personal Data Protection (Amendment) Act 2024. This guide sets out what each step means for a small business, in the order you are likely to need it. It explains the rules; for advice on your own situation, speak to a lawyer or the Personal Data Protection Department (JPDP).

What changed, and when

The Minister fixed the dates in a gazette notice, P.U. (B) 522, published on 24 December 2024, which brings each section of the amending Act into force on one of three dates. The law firm Christopher & Lee Ong summarised at the time which changes fall on each date, and the ones most relevant to an SME are below.

Source: P.U. (B) 522 and Act A1727; Christopher & Lee Ong, news alert, December 2024.

The penalty change raises the stakes on everything else. A breach of the Personal Data Protection Principles can bring a fine of up to RM1 million or up to three years in prison, or both, under section 4 of the amending Act. The old ceiling was a fine of RM300,000 or two years in prison.

1. Build a 72-hour breach routine

This is the change that applies to almost every business, because it rests on the data controller, not on size. Under the Commissioner’s circulars on DPO appointment and breach notification, a controller must notify the Commissioner as soon as practicable, and no later than 72 hours, when a breach causes or is likely to cause significant harm.

The circular treats a breach as causing significant harm where it could lead to physical harm, financial loss, damage to a credit record or loss of property, could be misused for unlawful purposes, involves sensitive personal data, could enable identity fraud when combined with other information, or is of significant scale. In the circular’s definition, significant scale means more than 1,000 affected individuals.

Affected customers must then be told without unnecessary delay, and no later than seven days after you notify the Commissioner. You can notify through the JPDP’s online portal, by email using the DBN form, or by delivering the form in person.

Two details are easy to miss. If you cannot notify within 72 hours, the circular says you must give the reasons for the delay with supporting evidence, and you may send missing information in stages within 30 days. You must also keep a record of each notification, in physical and electronic form, for at least two years from the breach.

Failing to notify the Commissioner can bring a fine of up to RM250,000, imprisonment of up to two years, or both, the circular states. A breach routine written in advance is cheaper than working it out at midnight: who decides whether harm is significant, who files the notice, and who drafts the message to customers.

2. Check whether you need a Data Protection Officer

Not every SME has to appoint a DPO. The Commissioner’s DPO circular requires one where a controller or processor handles personal data of more than 20,000 individuals, sensitive personal data, including financial information, of more than 10,000 individuals, or carries out regular and systematic monitoring such as tracking or profiling.

Count before you decide. A customer database, a loyalty programme, e-commerce accounts and staff records all hold personal data, and a growing online shop can pass the first threshold without noticing.

If you are over a threshold, the rules are practical rather than heavy: the DPO can be an existing employee or an outsourced service, part-time or full-time, and the same person can serve more than one business. They must be resident in Malaysia or easily reachable, proficient in Bahasa Malaysia and English, and given a dedicated official business email.

Under the same circular, you must notify the Commissioner within 21 days of the appointment and publish the DPO’s contact details, for example on your website or in your privacy notice.

3. Treat fingerprint and face data as sensitive

From 1 April 2025, biometric data joined health, political opinions, religious beliefs and criminal offences as sensitive personal data. The Christopher & Lee Ong analysis gives facial recognition, fingerprint verification and voice recognition as examples, and notes that sensitive data carries stricter consent and security requirements.

If you use a fingerprint or face-scan attendance machine or door lock, that system processes biometric data. Check that your privacy notice to employees describes it, that consent is collected properly, and that the vendor storing the templates protects them to the same standard as the rest of your data.

4. Put your service providers under contract

Before April 2025, the PDPA regulated data users directly but reached data processors only through their contracts. The amendment made processors, such as your payroll bureau, IT support firm, cloud CRM or delivery partner, directly responsible for the Security Principle, with the same maximum penalties, according to the Christopher & Lee Ong analysis.

That does not move your own responsibility. The breach circular expects the controller to oblige its processors, by contract or other reasonable means, to tell it about a breach and to give reasonable help. A vendor that sits on a breach for days leaves you no time to meet your own deadline.

List every outside party that touches your customer or staff data, check what each contract says about security and breach reporting, and add a short clause where it says nothing. If your business is itself a processor for clients, expect the same request from them.

5. Be ready for a portability request

From June 2025, a customer can ask you to transmit their personal data directly to another business they choose, under the new section 43A. The right is subject to technical feasibility and data format compatibility, Mayer Brown notes, so it is not absolute.

The practical test is whether you can find and export one customer’s records quickly. If they are spread across a POS system, a spreadsheet, an email inbox and a WhatsApp account, a portability request becomes a search party, so know where each kind of data lives before anyone asks.

6. Check where your data goes abroad

Customer data can leave Malaysia without anyone calling it a transfer, for example in a foreign-hosted CRM, email service or accounting system. The amendment removed the Minister’s whitelist of approved countries from 1 April 2025, and the Commissioner issued Cross Border Personal Data Transfer Guidelines on 29 April 2025.

Under those guidelines, as Mayer Brown summarises them, a transfer needs one legal basis, such as a transfer impact assessment showing the destination’s law is similar or adequate, the individual’s consent, contractual necessity, or contractual clauses and similar safeguards. The controller must also keep a record of each transfer, covering the recipient, country, type of data, purpose and evidence of compliance.

Where to start

1. Write the breach routine. One page: who assesses harm, who notifies the Commissioner within 72 hours, who tells customers, and where the record is kept.
2. Count your data subjects. Customers, members, leads and staff, against the DPO thresholds. If you are over, appoint and notify the Commissioner within 21 days.
3. Review biometric systems. Update the employee privacy notice and consent for any fingerprint or face-scan device.
4. Update vendor contracts. Add security and breach-reporting duties for every processor.
5. Map your data. Where it sits, including overseas services, so portability requests and transfer records are manageable.

For the security controls that help prevent a breach in the first place, see our guide to cybersecurity practices for Malaysian SMEs. The amended PDPA does not ask a small business to build a compliance department; it asks for a plan you can follow on the worst day of the year.