What Is Personal Data Protection Act 2010 (Act 709), as amended in 2024?

The Personal Data Protection Act 2010, Act 709, is Malaysia’s principal personal-data statute for processing connected with commercial transactions. The framework was amended in 2024, with the official commencement notice putting amendment provisions into operation in stages during 2025.

It applies to people or organizations that process or control processing of personal data in connection with commercial transactions in Malaysia. It can also cover a non-Malaysian person using equipment in Malaysia for processing, other than equipment used only for transit. Exclusions and sector-specific rules still matter.

Current JPDP public guidance describes rights to be told the processing purpose, access personal data, request correction, withdraw permission in applicable circumstances, prevent harmful or distressing processing, object to direct marketing, and receive protections around automated decision-making. The exact right and exceptions depend on the Act and applicable sector rules.

Use the organization’s current personal-data or privacy-notice contact and identify the inaccurate, incomplete, misleading, or outdated information. The reviewed Act text includes a 21-day period for responding to a data-correction request, together with an explanation and limited extension mechanism when the request cannot be completed within that period.

You can ask the organization to correct or delete inaccurate or unfair information and can invoke applicable withdrawal, retention, or direct-marketing rights. The public JPDP guidance and Act do not establish one universal people-search deletion form or guarantee that every public-record listing must be removed. Check the broker’s current route and preserve proof of the request.

Yes. JPDP’s current public rights guidance describes a right to prevent processing for direct marketing and to refuse direct-marketing calls or mail. Use the organization’s current opt-out or privacy contact, state that the request concerns direct marketing, and keep a record of delivery.

An individual who believes personal data was processed contrary to the Act may complain to the Commissioner. JPDP provides an official individual complaint form that asks the complainant to identify the organization and describe the complaint, and the form states that JPDP may forward the complaint and supporting documents to that organization; the Act’s complaint provisions allow the Commissioner to investigate. Check the live form and JPDP instructions before submitting.

The official amendment and commencement materials changed most statutory references from data user to data controller and introduced additional requirements and rights. The official commencement notice sets different dates in January, April, and June 2025; the JPDP Act index also lists current DPO, breach-notification, registration, and guidance materials that should be checked with the consolidated framework.

The official JPDP pages link to an eight-page PDF, but its text was not readable in the reviewed primary-source pass. Its controller classes, deadlines, fees, exemptions, operative provisions, and precise effective-date wording therefore remain unresolved; do not treat secondary commentary about the circular as verified law.