{
 "jurisdiction_id": "MY",
 "jurisdiction": "Malaysia",
 "url": "https://dataprotection.gi/jurisdictions/malaysia/",
 "generator": "render_jid v13-gdpri-1.0.0",
 "date_modified": "2026-08-05",
 "schema_version": "gdpri-v2",
 "counts": {
  "categories": 10,
  "claims": 64,
  "sub_modules": 57,
  "source_register": 12
 },
 "categories": [
  {
   "code": "regulator_and_framework",
   "name": "Regulator & Framework",
   "traffic_light": "green",
   "sub_modules": [
    "act_and_instruments",
    "material_scope",
    "regulator_and_authority",
    "regulator_registration_and_filing",
    "territorial_scope"
   ],
   "url": "https://dataprotection.gi/jurisdictions/malaysia/#regulator-and-framework-regulator-framework",
   "traffic_light_rationale": "Comprehensive statute in force with a fully commenced modernising amendment; core institutional architecture (Commissioner + PDP) is stable and actively issuing implementing guidance.",
   "claims": [
    {
     "statement": "The PDPA confers powers to the Personal Data Protection Commissioner, who is assisted by the Department of Personal Data Protection (PDP) to administer and enforce the provisions of the PDPA.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-enforcement-and-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Personal Data Protection (Amendment) Act 2024 was published in the Gazette on 17 October 2024 after receiving Royal Assent on 9 October 2024, following passage by the Senate (31 July 2024) and House of Representatives (16 July 2024).",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/malaysia-pdpa-amendment-act-receives-royal-assent",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Amendment Act's provisions were implemented in stages, with sections coming into effect on 1 January, 1 April, and 1 June 2025, covering biometric data, controller/processor terminology, cross-border transfer rules, DPO appointment, breach notification and portability respectively.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/malaysia-pdpa-amendment-act-receives-royal-assent",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The PDPA regulates the processing of personal data in commercial transactions either by an establishment in Malaysia or with equipment in Malaysia, unless the personal data only transits through Malaysia.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-enforcement-and-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Extraterritorial application of the PDPA turns on use of equipment located in Malaysia (an equipment-based test), rather than a GDPR-style establishment/targeting test; data merely transiting Malaysia is expressly excluded.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-enforcement-and-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "PDP mandates registration for 13 designated classes/groups of data controllers under the PDPA, with penalties for non-compliance with the registration requirement.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/malaysia-pdp-reminds-13-groups-controllers-register",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Controllers and processors must notify the Commissioner of DPO appointments; PDP's DPO registration manual requires such notification within 21 days of appointment.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/malaysia-pdp-publishes-dpo-registration-manual",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "lawful_processing_and_special_data",
   "name": "Lawful Processing & Special Data",
   "traffic_light": "amber",
   "sub_modules": [
    "consent_thresholds",
    "lawful_bases",
    "pseudonymisation_and_anonymisation",
    "special_categories"
   ],
   "url": "https://dataprotection.gi/jurisdictions/malaysia/#lawful-processing-and-special-data-lawful-processing-special-data",
   "traffic_light_rationale": "Core consent/sensitive-data architecture is well evidenced and in force, but consent-threshold specifics (freely-given/withdrawal standard) and pseudonymisation/anonymisation treatment were not confirmed via primary-source retrieval in this run.",
   "claims": [
    {
     "statement": "Under section 6(1) of the PDPA, a data user must not process personal data unless the data subject has given consent, or, for sensitive personal data, unless processing accords with section 40.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Notwithstanding the general consent requirement, section 6(2) permits processing necessary for performance of, or steps toward, a contract with the data subject, or for compliance with a legal obligation.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Malaysia is identified, alongside China, India and Vietnam, as one of the reviewed Asia-Pacific jurisdictions that presently lacks a distinct legitimate-interest lawful basis for processing personal data.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "PDPC Singapore",
     "source_url": "https://www.pdpc.gov.sg/comparing-consent-rules-in-general-data-protection-laws-across-asia-pacific",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Amendment Act recognises biometric data as sensitive personal data, defined as personal data resulting from technical processing relating to the physical, physiological or behavioural characteristics of a person.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/malaysia-s-pdpa-amendments-delivering-enhanced-data-governance-and-transparency",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Data of deceased persons is excluded from the Amendment Act and placed expressly outside the PDPA's application.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/malaysia-s-pdpa-amendments-delivering-enhanced-data-governance-and-transparency",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No confirmed primary-source detail was retrieved in this research pass specifying the PDPA's precise consent-validity thresholds (e.g., freely-given, specific, withdrawal mechanics) as amended.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No express PDPA provision defining pseudonymisation or providing an anonymisation safe-harbour was identified in the reviewed Act text or Amendment Act commentary.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "data_subject_rights",
   "name": "Data Subject Rights",
   "traffic_light": "amber",
   "sub_modules": [
    "access_right",
    "data_portability",
    "deadlines_and_response_windows",
    "rectification_and_erasure",
    "restriction_and_objection"
   ],
   "url": "https://dataprotection.gi/jurisdictions/malaysia/#data-subject-rights-data-subject-rights",
   "traffic_light_rationale": "Access, correction and (newly) portability rights are well evidenced and in force; restriction/objection rights and precise response deadlines remain unconfirmed gaps.",
   "claims": [
    {
     "statement": "Under the Access Principle (section 12) and Division 4 of the PDPA, a data subject shall be given access to his personal data held by a data user, except where compliance with the access request is refused under the Act.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The PDPA provides a statutory right to correct personal data (sections 34-37), including circumstances in which a data user may refuse a correction request and must notify the data subject of such refusal.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Amendment Act grants data subjects a right to data portability, allowing transfer of their data between controllers, subject to the technical feasibility and compatibility of the data format.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/malaysia-s-pdpa-amendments-delivering-enhanced-data-governance-and-transparency",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No explicit standalone right to restrict processing or to object to processing/profiling (analogous to GDPR Arts 18/21) was identified in the reviewed PDPA text or Amendment Act commentary.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No confirmed Malaysia-specific statutory response-window (day count) for access or correction requests under PDPA sections 31/35 was retrieved in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://legacy.dataguidance.com/notes/malaysia-data-subject-rights",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "controller_processor_duties",
   "name": "Controller/Processor Duties",
   "traffic_light": "amber",
   "sub_modules": [
    "accountability_and_dpia",
    "breach_notification",
    "dpo_requirements",
    "joint_controller_arrangements",
    "retention_and_disposal",
    "ropa_requirements",
    "security_measures"
   ],
   "url": "https://dataprotection.gi/jurisdictions/malaysia/#controller-processor-duties-controller-processor-duties",
   "traffic_light_rationale": "DPO, breach-notification, security and retention duties are strongly evidenced and in force; DPIA/ROPA/joint-controller equivalents remain unconfirmed gaps versus the GDPR baseline.",
   "claims": [
    {
     "statement": "The Amendment Act introduces a mandatory Data Protection Officer appointment obligation for qualifying data controllers and processors.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/malaysia-personal-data-protection-amendment-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Controllers and processors must notify the Data Protection Commissioner of DPO appointments, via a registration manual requiring notification within 21 days of appointment.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/malaysia-pdp-publishes-dpo-registration-manual",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Data controllers must notify the Commissioner of a data breach within 72 hours after becoming aware of the breach, and must also notify affected data subjects within specified time frames.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/malaysia-personal-data-protection-amendment-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Enhanced enforcement powers under the Amendment Act increase fines for PDPA violations to up to MYR1 million, extend the maximum imprisonment term to three years, and empower the Commissioner to conduct proactive compliance audits.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/malaysia-s-pdpa-amendments-delivering-enhanced-data-governance-and-transparency",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The amended PDPA enhances data subjects' rights to data portability and requires data processors, not just controllers, to adhere to the security principle.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/news/malaysia-pdpa-amendment-act-receives-royal-assent",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "It is the duty of a data user to take all reasonable steps to ensure that all personal data is destroyed or permanently deleted if it is no longer required for the purpose for which it was processed.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No PDPA/Amendment-Act provision imposing a formal Data Protection Impact Assessment obligation (analogous to GDPR Art 35) was confirmed in the reviewed Malaysia-specific materials.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/malaysia-personal-data-protection-amendment-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No PDPA/Amendment-Act obligation to maintain formal records of processing activities (analogous to GDPR Art 30) was confirmed in the reviewed Malaysia-specific materials.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/malaysia-personal-data-protection-amendment-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No PDPA provision establishing a joint-controller regime analogous to GDPR Art 26 was identified in the reviewed Act text or Amendment Act commentary.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "cross_border_and_adequacy",
   "name": "Cross-Border & Adequacy",
   "traffic_light": "amber",
   "sub_modules": [
    "adequacy_granted",
    "adequacy_received",
    "data_localisation",
    "sccs_and_bcrs",
    "transfer_impact_assessment",
    "transfer_mechanisms"
   ],
   "url": "https://dataprotection.gi/jurisdictions/malaysia/#cross-border-and-adequacy-cross-border-adequacy",
   "traffic_light_rationale": "Transfer mechanism and TIA obligation are well evidenced and in force; the specific whitelist, adequacy-received status, and SCC/BCR/localisation architecture remain unconfirmed.",
   "claims": [
    {
     "statement": "The PDPA permits international transfers of personal data where the receiving country has adequate data protection laws (a 'whitelisted' jurisdiction) or under circumstances of public interest; consent-based transfer remains an available mechanism.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/malaysia-s-pdpa-amendments-delivering-enhanced-data-governance-and-transparency",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The Amendment Act revises cross-border transfer mechanisms to require Transfer Impact Assessments (TIAs) by data controllers, including a more rigorous assessment of the receiving country's data protection framework.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/malaysia-personal-data-protection-amendment-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "PDP published cross-border data transfer guidelines in April 2025 implementing the amended transfer regime, though the specific countries treated as having 'adequate' protection were not enumerated in the retrieved sources.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-data-transfers",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No evidence was located in this research pass that Malaysia has received a formal adequacy determination from the EU, UK or another comprehensive-regime regulator.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-data-transfers",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "Malaysia's cross-border transfer regime is structured around whitelisted-country adequacy and consent-based mechanisms rather than a distinct SCC or BCR instrument comparable to the EU model.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Probable",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/malaysia-s-pdpa-amendments-delivering-enhanced-data-governance-and-transparency",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No general data-localisation mandate applicable to commercial personal data was identified in the reviewed PDPA/Amendment Act materials.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-data-transfers",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "sectoral_watch",
   "name": "Sectoral Watch",
   "traffic_light": "amber",
   "sub_modules": [
    "credit_and_scoring",
    "education",
    "employment_data",
    "financial_sector_overlay",
    "health_sector_overlay",
    "insurance",
    "telecoms_and_eprivacy"
   ],
   "url": "https://dataprotection.gi/jurisdictions/malaysia/#sectoral-watch-sectoral-watch",
   "traffic_light_rationale": "Financial-sector overlay mechanism is evidenced; other sectoral overlays are unconfirmed gaps in this research pass.",
   "claims": [
    {
     "statement": "PDP can designate the industry classes and business entities required to register, and approve and register Personal Data Protection Codes of Practice for various industry sectors, including the financial sector.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Probable",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-data-protection-financial-sector",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No confirmed Malaysia-specific health-sector data-protection overlay statute or Code of Practice was located in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-data-protection-financial-sector",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No confirmed Malaysia-specific telecoms/ePrivacy overlay statute was located in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-data-protection-financial-sector",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No confirmed Malaysia-specific employment-data overlay was located in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-data-protection-financial-sector",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No confirmed Malaysia-specific credit-scoring overlay was located in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-data-protection-financial-sector",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No confirmed Malaysia-specific education-sector overlay was located in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-data-protection-financial-sector",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No confirmed Malaysia-specific insurance-sector overlay was located in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-data-protection-financial-sector",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "adtech_and_commercial_privacy",
   "name": "AdTech & Commercial Privacy",
   "traffic_light": "red",
   "sub_modules": [
    "clean_rooms_and_dcr",
    "cookies_and_trackers",
    "cross_context_advertising",
    "dark_patterns",
    "direct_marketing",
    "opt_out_signals"
   ],
   "url": "https://dataprotection.gi/jurisdictions/malaysia/#adtech-and-commercial-privacy-adtech-commercial-privacy",
   "traffic_light_rationale": "No comprehensive adtech/commercial-privacy regime was confirmed for Malaysia in this research session; this is treated as an explicit evidentiary gap rather than a substantive finding of 'no regulation'.",
   "claims": [
    {
     "statement": "No Malaysia-specific cookie/tracker consent regime was identified in the sources reviewed in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-enforcement-and-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No Malaysia-specific dark-pattern prohibition was identified in the sources reviewed in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-enforcement-and-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No Malaysia-specific recognition of technical opt-out signals (e.g., Global Privacy Control, DAA) was identified in the sources reviewed in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-enforcement-and-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No Malaysia-specific clean-room or data-collaboration-room rule was identified in the sources reviewed in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-enforcement-and-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No Malaysia-specific cross-context-advertising rule analogous to CPRA 'sale'/'share' concepts was identified in the sources reviewed in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-enforcement-and-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "A targeted search for a Malaysian PDPA direct-marketing/consent-suppression provision (analogous to a 'section 43' Do-Not-Call regime) returned only Singapore PDPA materials; no Malaysia-specific direct-marketing suppression mechanism was confirmed in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "algorithmic_biometric_and_surveillance_governance",
   "name": "Algorithmic, Biometric & Surveillance Governance",
   "traffic_light": "amber",
   "sub_modules": [
    "ai_risk_assessments",
    "automated_decision_making_transparency",
    "biometric_regime",
    "genetic_data",
    "profiling_restrictions",
    "state_surveillance_carveouts"
   ],
   "url": "https://dataprotection.gi/jurisdictions/malaysia/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill",
   "traffic_light_rationale": "Biometric-data governance is confirmed and in force; all other sub-modules in this space remain unconfirmed gaps.",
   "claims": [
    {
     "statement": "Biometric data is now recognised as sensitive personal data under the Amendment Act, subject to stricter processing requirements than general personal data.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/malaysia-personal-data-protection-amendment-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No PDPA/Amendment-Act provision restricting automated profiling analogous to GDPR Article 22 was identified in the reviewed materials.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/malaysia-personal-data-protection-amendment-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No PDPA/Amendment-Act automated-decision-making transparency or explanation right was identified in the reviewed materials.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/malaysia-personal-data-protection-amendment-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No AI-specific risk-assessment obligation interfacing with the PDPA was identified in the reviewed materials.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/opinion/malaysia-personal-data-protection-amendment-act",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No Malaysia-specific genetic-data-specific processing regime distinct from the general sensitive-personal-data category was confirmed in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No PDPA provision on national-security/state-surveillance carveouts and their limits was confirmed in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "children_and_vulnerable_groups",
   "name": "Children & Vulnerable Groups",
   "traffic_light": "red",
   "sub_modules": [
    "age_verification",
    "dependent_adults",
    "education_settings",
    "minor_profiling_bans",
    "parental_consent"
   ],
   "url": "https://dataprotection.gi/jurisdictions/malaysia/#children-and-vulnerable-groups-children-vulnerable-groups",
   "traffic_light_rationale": "No comprehensive children/vulnerable-groups regime was confirmed for Malaysia in this research session; this is an explicit evidentiary gap requiring primary-source escalation, not a substantive finding of 'no protection exists'.",
   "claims": [
    {
     "statement": "No express age-of-consent threshold for personal-data processing was identified in the reviewed PDPA/Amendment Act materials.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No express parental/guardian-consent mechanism for processing a minor's personal data was identified in the reviewed PDPA/Amendment Act materials.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No minor-specific profiling ban was identified in the reviewed PDPA/Amendment Act materials.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No education-settings-specific data-protection rule was identified in the reviewed PDPA/Amendment Act materials.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No dependent-adult (elderly/mentally-incapacitated) protection provision was identified in the reviewed PDPA/Amendment Act materials.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  },
  {
   "code": "enforcement_and_redress",
   "name": "Enforcement & Redress",
   "traffic_light": "amber",
   "sub_modules": [
    "collective_redress_and_class_actions",
    "enforcement_activity_index",
    "private_right_of_action",
    "recent_developments_180d",
    "regulator_funding_and_capacity",
    "regulator_powers_and_penalties"
   ],
   "url": "https://dataprotection.gi/jurisdictions/malaysia/#enforcement-and-redress-enforcement-redress",
   "traffic_light_rationale": "Statutory powers and penalties are well evidenced and in force; enforcement-activity, funding, collective-redress, private-right-of-action and within-180-day developments remain unconfirmed gaps.",
   "claims": [
    {
     "statement": "The Amendment Act increases maximum fines for PDPA violations to MYR1 million, extends the maximum imprisonment term to three years, and empowers the Commissioner to conduct proactive audits of organisations.",
     "regulatory_stage": "in_force",
     "is_binding": true,
     "confidence": "Confirmed",
     "source_publisher": "IAPP",
     "source_url": "https://iapp.org/news/a/malaysia-s-pdpa-amendments-delivering-enhanced-data-governance-and-transparency",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No specific record of Malaysia PDPC enforcement decisions or imposed fines within the last 12 months was located in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-enforcement-and-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No confirmed data on PDP's operating budget or headcount was located in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-enforcement-and-breach",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No confirmed collective-redress or class-action mechanism available to data subjects under the PDPA was located in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "No confirmed private right of action allowing data subjects direct court recourse (independent of Commissioner enforcement) under the PDPA was located in this research pass.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance (hosted copy of official Act text)",
     "source_url": "https://www.dataguidance.com/sites/default/files/personal_data_protection_act_2010.pdf",
     "source_tier": null,
     "observed_at": "2026-08-05"
    },
    {
     "statement": "The most recent confirmed dated Malaysia development in this research pass is PDP's cross-border data transfer guidance dated October 2025, which precedes the 180-day window measured from this run's date (2026-08-05); no confirmed developments from February-August 2026 were retrieved.",
     "regulatory_stage": null,
     "is_binding": false,
     "confidence": "Uncertain",
     "source_publisher": "DataGuidance",
     "source_url": "https://www.dataguidance.com/notes/malaysia-data-transfers",
     "source_tier": null,
     "observed_at": "2026-08-05"
    }
   ]
  }
 ]
}