If your website collects a name, phone number, or email address, Malaysia's Personal Data Protection Act applies to you — and since amendments took effect in mid-2025, a confirmed breach must be reported to the Commissioner within 72 hours, with no exemption for small businesses. The law doesn't check headcount before it applies; it checks whether you process personal data in a commercial transaction, and a contact form or a booking page already does that.
Most business owners hear "data protection law" and assume it's a large-company problem — the kind of thing a bank or telco has a compliance team for. That assumption has never been correct under the PDPA, and the 2024 amendment closed the last soft edges: a mandatory breach-notification regime and a data protection officer requirement for larger-scale processing both took effect through commissioner circulars, tightening obligations that used to sit as guidance rather than a hard clock.
What actually changed
Two obligations now carry real teeth. First, a mandatory breach notification: if personal data is accessed, lost, or disclosed without authorisation in a way likely to cause significant harm, the business must notify Malaysia's Personal Data Protection Commissioner within 72 hours of becoming aware of it, and notify the affected individuals too. Missing that window is itself a separate offence — a fine of up to RM250,000 and up to two years' imprisonment, on top of whatever the breach itself already cost the business.
Second, a formal Data Protection Officer requirement for data controllers and processors carrying out data processing at scale — judged by how many people's data you hold, how sensitive it is, and how long and widely you process it, not by how many staff you employ. A five-person shop with a short customer list is unlikely to cross that threshold; a business running an ongoing marketing database or handling health or financial records at volume should actually check rather than assume the DPO rule doesn't apply to them.
What it means for an ordinary business website
The parts of the PDPA that touch a typical SME site sit well before the breach-response stage:
- Every collection point needs real notice. A contact form, a booking widget, a WhatsApp-click button that captures a number, a newsletter signup — each one is a point where personal data is collected, and the law's Notice and Choice principle expects a clear notice at that point, in both English and Malay, explaining what's collected and why. A checkbox with no notice text nearby, or a notice that only exists buried in a separate privacy-policy page nobody sees while filling the form, misses the actual requirement.
- Consent has to be real, not assumed. Pre-ticked boxes and "by using this site you agree" footer text without an actual notice don't meet the bar — consent means the person saw what they were agreeing to before they agreed to it.
- You need to know where the data goes. If form submissions flow to a third-party CRM, an email marketing tool, or a server outside Malaysia, the amended cross-border transfer rules ask whether that destination offers comparable protection — worth knowing before picking a vendor, not after.
- Someone has to own the breach-response clock. Even a business well under the DPO threshold still owns the 72-hour notification duty the moment a breach happens — that means knowing today who gets told first, not figuring it out while the clock is already running.
None of this requires expensive tooling. It requires a privacy notice that actually says something concrete, placed where data is actually collected, and a plan — even a short one — for who does what in the first 72 hours if something goes wrong. Both are usually missing not because they're hard to write, but because nothing about running a website prompts a business owner to write them.
Frequently asked questions
My business is small, or I'm a sole proprietor — does PDPA even apply to me?
Yes. There is no size-based exemption. The Act applies to anyone processing personal data in the course of a commercial transaction — a five-person shop collecting names and phone numbers through a contact form is a data controller in exactly the same sense as a large enterprise. Business size affects how much processing you're likely doing, not whether the law applies to you.
What actually counts as a data breach I'd need to report?
Any unauthorised access, loss, or disclosure of personal data — a hacked contact-form database, a leaked customer spreadsheet, an email sent to the wrong recipient with attached records. The reporting duty is triggered specifically when the breach causes, or is likely to cause, significant harm to the people whose data it was; not every minor incident meets that bar, but the notification clock to the Commissioner starts regardless, within 72 hours of becoming aware of it.
Do I need to formally appoint a Data Protection Officer?
It depends on scale, not on being a certain type of business. The requirement applies to data controllers and processors carrying out "large scale" processing, judged by factors like the number of people whose data you hold, the sensitivity and volume of that data, and how long and widely you process it. A small business with a short customer list is unlikely to cross that line; one running ongoing marketing databases, loyalty programmes, or health/financial data at volume should check where it actually sits rather than assume it's exempt by headcount.
What does a website actually need for consent — is a checkbox enough?
A checkbox is the mechanism, not the whole requirement. The law's Notice and Choice principle expects a clear notice — in both English and Malay — at the point data is collected, explaining what's being collected, why, and who it might be disclosed to, before the person agrees. A contact form that only says "submit" with no notice text nearby, or a notice that exists only buried in a separate privacy policy nobody is shown at the collection point, misses the actual requirement even if a checkbox is technically present.
How is this different from the secure website checklist guide?
That guide is about the technical controls that keep data from being stolen in the first place — HTTPS, safe input handling, patched software, tested backups. This one is about the legal obligations that start the moment you collect personal data at all, breach or no breach: giving proper notice, getting real consent, and knowing what you'd have to do and by when if something did go wrong. A site can have every technical control in place and still be non-compliant on the consent and notification side, and vice versa — they're separate obligations that both apply at once.