Jurisdiction - Malaysia
Malaysia – Personal Data Protection.

8 April, 2014


Legal News & Analysis – Asia Pacific – Malaysia – Labour & Employment


Malaysia’s Personal Data Protection Act came into force on the 15th November 2013. Although it is still not clear whether the Act was intended to cover the employment relationship (it applies to a ‘commercial transaction’), prudent employers will already have taken steps to ensure compliance. 

The Seven Principles 

The PDPA establishes seven basic principles covering the collection, storage, use and destruction of personal information. Similar to other jurisdictions, the underlying principle is that of consent: employees should know what information is being held, the purpose it is used for, who else will see it and how they may access and correct any inaccuracies. 


Under the Notice and Choice Principle, information must be given, in writing, as to whether the supply of data is voluntary or obligatory, and what consequences are attached with not providing the information. This notice must be in both English and Malay.


As the grace period of three months for existing data has now expired, it is important that employers review their data protection processes and ensure that they have clear, consent based procedures in places for handling personal information. 


herbert smith Freehills


For further information, please contact:


Fatim Jumabhoy, Herbert Smith Freehills

[email protected]


Labour & Employment Law Firms in Malaysia

Comments are closed.