PDPA Rules for Online Stores Collecting Customer Data in Malaysia

The Personal Data Protection Act 2010 (Act 709) covers personal data processed in commercial transactions, which includes customer names, phone numbers, addresses and order history.

Core duties for a seller

• Tell customers what data is collected, why, and who it is shared with (for example couriers), and get consent where needed.
• Keep data secure, and use only the courier, payment and software providers who protect it.
• Do not keep data longer than necessary.
• Let customers see and correct their data.
• Use data for marketing only in line with what customers were told.

2024 amendment. The Personal Data Protection (Amendment) Act 2024 (Act A1727):

• received Royal Assent on 9 October 2024 and was published on 17 October 2024;
• adds a duty for data controllers and processors to appoint a data protection officer (section 12A);
• adds a duty to notify the Commissioner of a personal data breach (section 12B), and to notify affected people where significant harm is likely;
• is brought into force by gazette notice, possibly on different dates.

The Personal Data Protection Commissioner has issued circulars 1/2025 on breach notification and 2/2025 on DPO appointment, and the breach form asks whether notice was given within 72 hours of awareness.

Whether a particular small seller needs a DPO depends on the Commissioner's thresholds in circular 2/2025. (Thresholds and penalties: needs research.)