Malaysia PDPA

Malaysia Personal Data Protection Act - data subject rights, processor obligations, consent, transfers.


Short name	MY PDPA
Region	Asia-Pacific
Country or scope	Malaysia
Sector	Privacy
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers MY PDPA

Scan requirements: 6, all decided by a scan.
Controls: the scan requirements below, plus 9 controls from Safeguard's control catalog for MY PDPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 25: 3 written for MY PDPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 6 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`MY-PDPA-9` Security Principle	A data user must take practical steps to protect personal data from loss, misuse, modification, or unauthorized access, having regard to the technical measures available, which implies integrity verification for the software processing the data (Act 709, s.9)	Scan
`MY-PDPA-9-2` Data Processor Guarantees	Where processing is carried out by a data processor, the data user must ensure the processor provides sufficient guarantees of security measures and takes reasonable steps to ensure compliance, which requires knowing the suppliers behind the processing stack (Act 709, s.9(2))	Scan
`MY-PDPA-11` Data Integrity Principle	Personal data and the records surrounding it must be accurate, complete, not misleading, and kept up to date; applied to processing-system records this means each software component entry carries both a name and a version (Act 709, s.11)	Scan
`MY-PDPA-7` Notice and Documentation Duty	The Notice and Choice Principle obliges the data user to inform data subjects about the processing being carried out, which is supported by formally identified, timestamped documentation of the processing systems (Act 709, s.7)	Scan
`MY-PDPA-12` Access-Readiness of Processing Systems	The Access Principle entitles data subjects to access and correct their personal data, which requires the data user to be able to locate where data lives across identifiable system components (Act 709, s.12)	Scan
`MY-PDPA-129` Cross-Border Transfer Control	Personal data may not be transferred outside Malaysia except to permitted jurisdictions or under specified conditions; controlling this requires knowing the provenance and operator of each component that moves data (Act 709, s.129)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`MY-PDPA-S6`	General Principle
`MY-PDPA-S7`	Notice and Choice Principle
`MY-PDPA-S8`	Disclosure Principle
`MY-PDPA-S9`	Security Principle
`MY-PDPA-S10`	Retention Principle
`MY-PDPA-S11`	Data Integrity Principle
`MY-PDPA-S12`	Access Principle
`MY-PDPA-S38-42`	Data Subject Rights: Access and Correction
`MY-PDPA-S129`	Cross-Border Transfer Restriction

Policy templates

Written for MY PDPA:

Personal Data Protection Principles Procedure (Malaysia Act 709)
Cross-Border Personal Data Transfer Policy (Malaysia Act 709 Section 129)
Personal Data Security Procedure (Malaysia Act 709 Section 9)

And 22 from the standard set, adapted to MY PDPA.