Need Help With Overall Corporate Compliance?
Talk to our team about your company’s compliance requirements as a whole.
Many SME owners assume PDPA Malaysia (the Personal Data Protection Act) only applies to large tech companies. In reality, if your business stores customer phone numbers, staff emails, or any personal information in a spreadsheet – including payroll and employee leave records managed internally, you are already covered by this Act. Since the Personal Data Protection (Amendment) Act 2024 took effect in phases from June 2025, compliance requirements have tightened and penalties have become significantly heavier.
What Changed Under PDPA Malaysia’s 2024/2025 Amendment?
Key changes SMEs should know about:
- The term “data user” is replaced with “data controller” throughout the Act.
- Biometric data is now included under “sensitive personal data”.
- A new duty to notify the Commissioner of personal data breaches as soon as practicable.
- Maximum penalties increased from RM300,000 to RM1 million, and maximum imprisonment from 2 years to 3 years.
- A new risk-based framework for cross-border data transfers replaces the old whitelist system.
When Must an SME Appoint a Data Protection Officer (DPO)?
The mandatory DPO appointment requirement only applies if your company:
- Processes personal data of 20,000 or more individuals, OR
- Processes sensitive personal data (health, biometric, financial, religious belief) of 10,000 or more individuals.
Most small and medium SMEs don’t hit this threshold, so mandatory DPO appointment may not apply to you yet. That doesn’t mean you’re exempt from the PDPA altogether — the seven Personal Data Protection Principles still apply to every company that processes personal data, regardless of size.
What SMEs Still Need to Do Even Below the DPO Threshold
Basic practices every SME should have in place:
- A clear privacy notice — tell customers/staff what data is collected, for what purpose, and who it’s shared with.
- Obtain consent before using data for purposes beyond what was disclosed.
- Data security measures — restricted access, strong passwords, secure physical/digital storage.
- A retention policy — don’t keep data longer than needed for its original purpose.
- Basic staff training on handling customer data properly.
What to Do If a Data Breach Happens
Under the new Section 12B, companies must notify the Personal Data Protection Commissioner as soon as practicable once there is reason to believe a breach has occurred. If the breach is likely to cause significant harm to affected individuals, they must also be notified without unnecessary delay.
Penalties for Non-Compliance
Breaching the Data Protection Principles (Sections 6–12) can now result in a fine of up to RM1 million and/or imprisonment of up to 3 years — up from RM300,000 and 2 years before the amendment. Data processors are also now directly subject to security obligations for the first time.
The 7 Personal Data Protection Principles Every SME Must Follow
Under the PDPA 2010 (including after the 2024 Amendment), every company that processes personal data – regardless of size – must comply with these 7 principles:
- General Principle — don’t process personal data without consent, unless permitted under the Act.
- Notice and Choice Principle — inform individuals in writing about the purpose of data collection and give them an opt-out choice.
- Disclosure Principle — data cannot be disclosed for other purposes without additional consent.
- Security Principle — technical and organisational measures to prevent unauthorised access, loss, or damage to data.
- Retention Principle — don’t keep data longer than needed for its original purpose; destroy it once no longer relevant.
- Data Integrity Principle — ensure data is accurate, complete, and up to date.
- Access Principle — individuals have the right to request access to and correction of their own personal data.
An SME can be fined for breaching even one of these principles — not just for failing to appoint a DPO.
PDPA Malaysia vs GDPR: Don’t Copy a European Template Directly
Many SMEs try to copy-paste a privacy policy from a European GDPR template because it’s easy to find online. This is risky because the PDPA has several fundamental differences from the GDPR:
- The PDPA has no concept of “legitimate interest” as a lawful basis for processing data like the GDPR does — in Malaysia, consent is the primary basis.
- There’s no explicit “right to be forgotten” in the PDPA the way there is under GDPR Article 17.
- The PDPA’s scope is limited to data processed “in and in relation to Malaysia”, while the GDPR has much broader extraterritorial reach.
- PDPA’s maximum fine (RM1 million) is fixed, compared to GDPR which can reach up to 4% of a company’s global turnover.
If your company has operations or customers in Europe, you may need to comply with both frameworks simultaneously — consult a lawyer familiar with both.
PDPA Compliance Checklist 2026: 8 Basic Steps for SMEs
- Conduct a data audit – identify what personal data your company collects, stores, and processes.
- Prepare a clear privacy notice for customers and staff.
- Review existing consent forms – make sure the language is clear and the purpose is specific.
- Establish a data security policy – access controls, basic encryption, strong passwords.
- Set a data retention period and a process for destroying data that’s no longer relevant.
- Give basic PDPA briefings to staff who handle customer data (e.g. sales, HR, finance).
- Prepare a data breach response plan, even a simple one.
- Determine whether your company meets the mandatory DPO threshold (20,000 individuals for general data / 10,000 for sensitive data).
Hiring an external PDPA consultant typically costs around RM3,000–RM8,000 for a basic audit and documentation for an SME, depending on how complex your operations are. If you’re just starting out, working through the 8 steps above internally is a solid foundation before investing in outside consultants.
How SASCO Can Help
While our core focus is company secretarial, accounting and tax services, PDPA compliance is part of broader corporate governance. We’re happy to discuss your SME’s overall compliance needs and, where necessary, point you to a qualified lawyer or PDPA consultant for specialised requirements.
Note: This article is general guidance, not legal advice. For PDPA Malaysia compliance specifics, refer to the Department of Personal Data Protection (JPDP) or a qualified lawyer for your company’s specific compliance needs.
Frequently Asked Questions
Does the PDPA apply to small SMEs?
Yes. The PDPA applies to any company processing personal data in commercial transactions, regardless of company size. Only the mandatory DPO appointment requirement has a specific threshold.
What’s the threshold for mandatory Data Protection Officer appointment?
20,000 or more individuals for general personal data, or 10,000 or more individuals for sensitive personal data such as health or biometric data.
What should I do if there’s a customer data breach?
Notify the Personal Data Protection Commissioner as soon as practicable, and notify affected individuals without delay if the breach risks significant harm.
What are the penalties for failing to comply with the PDPA?
Fines of up to RM1 million and/or imprisonment of up to 3 years for breaching the Data Protection Principles, depending on severity.
Can an SME use a foreign privacy policy template?
Not recommended without local legal review. GDPR templates use different concepts and terminology from the Malaysian PDPA – have a local lawyer adapt any template before use.
Who should receive PDPA training in a company?
Any staff who directly handle customer data – sales, HR, finance, and customer service – should get basic PDPA briefings even if the company isn’t required to appoint a DPO.
Does a dormant or inactive company still need to comply with the PDPA?
Yes, as long as the company still holds old personal data (e.g. former customer or staff records), PDPA principles still apply until that data is securely destroyed under a retention policy.
How much does an external PDPA consultant cost for an SME?
Roughly RM3,000 to RM8,000 for a basic audit and documentation, depending on the size and complexity of the business. Costs can rise if more complex IT systems or security policies are needed.