Malaysia’s Personal Data Protection Act 2010 (Act 709) has changed more in the past two years than in the previous decade. The Personal Data Protection (Amendment) Act 2024 came into force in stages during 2025. It brought mandatory data protection officers, mandatory notification for qualifying personal data breaches, a data portability right and much higher penalties.
For employers, two questions follow. What do we owe our employees under the amended law? And when an HR vendor shows us its certificates, what do they actually prove?
What the amended PDPA asks of employers
Higher penalties. The maximum penalty for breaching the personal data protection principles rose from RM300,000 to RM1,000,000, and the maximum prison term from two to three years.
Biometric data is sensitive. Fingerprint and facial recognition attendance data now falls within sensitive personal data, which carries stricter processing conditions.
A data protection officer. Since 1 June 2025, organisations must appoint a DPO where they process personal data of more than 20,000 data subjects, sensitive personal data, including financial information, of more than 10,000 data subjects, or carry out regular and systematic monitoring. The Commissioner must be notified within 21 days of the appointment. Note that the thresholds count all data subjects, not only employees.
Breach notification. Where a personal data breach causes, or is likely to cause, significant harm, or affects more than 1,000 data subjects, the data controller must notify the Personal Data Protection Commissioner as soon as practicable and within the 72-hour period prescribed by the Commissioner’s Data Breach Notification Guideline. Record both when the breach occurred and when you became aware of it, and follow the Commissioner’s current guidance on calculating the deadline. Where significant harm is likely, affected individuals must be told within seven days of the notice to the Commissioner. A breach register must be kept for at least two years.
Data portability. Individuals can ask for their personal data to be transmitted to another data controller, subject to technical feasibility.
Cross-border transfers. The former whitelist mechanism was removed. Cross-border transfers now depend on the conditions in the amended section 129, including a substantially similar law or an equivalent level of protection, or another statutory exception, read with the Commissioner’s April 2025 cross-border transfer guideline.
Where HR feels it most
HR holds some of the most sensitive data in any organisation: identity numbers, bank details, salary, health information, biometric attendance records and disciplinary files. Where payroll processing includes financial information, those records may count toward the higher DPO threshold for sensitive personal data and financial information. And a significant amount of HR data is often hosted or processed by external HR, payroll and cloud vendors.
What certification actually proves
Vendor certifications are valuable evidence. But each proves something specific, and none proves that your organisation complies with the PDPA.
ISO/IEC 27001 certifies that an organisation operates an information security management system, assessed by a certification body against the standard, for a defined scope.
ISO/IEC 27701 certifies a privacy information management system. The 2025 edition, published on 14 October 2025, is a standalone management system standard that can be certified without ISO/IEC 27001, although it remains aligned with it.
SOC 2 Type II is not a certificate. It is an independent auditor’s report on whether a service organisation’s controls were suitably designed and operated effectively over a defined period, measured against the AICPA Trust Services Criteria. A Type I report covers design at a single point in time.
What certification does not prove
A vendor’s certificate does not transfer your duties. For core employment-data processing, the employer will usually remain the data controller, and using an HR vendor does not transfer the employer’s own PDPA obligations. Confirm each party’s role for each processing activity. Your grounds for processing, employee notices, compliance with the PDPA principles, retention periods, DPO obligations and breach-notification duties remain yours.
Certificates also have limits of their own. Scope may cover one country, one data centre or one product, not the service you are buying. Certificates expire. And SOC 2 reports often list complementary user entity controls: things the customer must do for the vendor’s controls to work.
Six questions for your HR vendor
1. What is in scope? Ask for the scope statement on each certificate.
2. Is it current? Check the certificate dates and the certification body.
3. What period does the SOC 2 Type II report cover, and were there exceptions?
4. Which controls depend on us? Read the complementary user entity controls.
5. Where is our data hosted, and which sub-processors handle it?
6. What will you tell us after a breach, and how fast? Your own notification deadline depends on it.
How MiHCM approaches it
MiHCM publishes its assurance position on its Trust Centre. It holds ISO/IEC 27001:2022 and ISO/IEC 27701:2025 certifications for its Malaysia and Sri Lanka operations, and has a SOC 2 Type II report available to customers on request. We encourage every customer to ask for the scope statements and the report, and to read them with the questions above.
Frequently Asked Questions
Who must appoint a data protection officer in Malaysia?
Organisations that process personal data of more than 20,000 data subjects, sensitive personal data including financial information of more than 10,000 data subjects, or that carry out regular and systematic monitoring. The Commissioner must be notified within 21 days of the appointment.
How quickly must a data breach be reported in Malaysia?
Where a breach causes or is likely to cause significant harm, or affects more than 1,000 data subjects, the Commissioner must be notified as soon as practicable and within the 72-hour period prescribed by the Commissioner’s guideline. Affected individuals must be told within seven days of the notice to the Commissioner where significant harm is likely.
What is the maximum PDPA penalty in Malaysia?
For breaching the personal data protection principles, a fine of up to RM1,000,000, imprisonment of up to three years, or both.
Does ISO 27001 certification mean a vendor complies with the PDPA?
No. ISO/IEC 27001 certifies an information security management system for a defined scope. PDPA duties such as grounds for processing, notices, compliance with the PDPA principles, retention and breach notification remain with the data controller.
What is the difference between SOC 2 Type I and Type II?
A Type I report assesses whether controls are suitably designed at a point in time. A Type II report assesses whether they operated effectively over a defined period.
Sources
• DFDL, Malaysia: Implementation of the Personal Data Protection (Amendment) Act 2024
• DLA Piper, Malaysia: Guidelines issued on data breach notification and DPO appointment (March 2025)
• DLA Piper, Data protection laws in Malaysia
• Personal Data Protection Commissioner, Guideline on Data Breach Notification (25 February 2025), Guideline on Appointment of Data Protection Officer and DPO FAQ, and Cross-Border Personal Data Transfer Guideline (29 April 2025)
• DNV, Updated version of ISO/IEC 27701 standard released
• ISO, ISO/IEC 27701:2025 (official standard page) – publication date 14 October 2025
• Microsoft Learn, SOC 2 Type 2 overview (AICPA Trust Services Criteria)
