PDPA (Malaysia): What It Means for Shops and Loyalty Programs

By Alva Chew · Updated 2026-11-07

Definition The PDPA, or Personal Data Protection Act 2010 (Act 709), is Malaysia's data protection law for personal data processed in commercial transactions. A shop that records customer emails for a loyalty program is in scope, and the Act has seven principles from consent to access. Since 1 April 2025 the maximum fine for breaching a principle is RM1 million, up to three years in prison, or both.

What is the PDPA in Malaysia?

The Personal Data Protection Act 2010 (Act 709) is Malaysia’s law on how personal data is handled in commercial transactions. The Personal Data Protection Department (JPDP) publishes it and the Commissioner’s guidelines. The Act was amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727), which received Royal Assent on 9 October 2024 and was published in the Gazette on 17 October 2024.

This page defines the term. For what to do at sign-up, see our guide to loyalty programs and Malaysia’s PDPA.

Who does the PDPA apply to?

According to the JPDP, the Act applies to any person who processes personal data, or who controls or authorises its processing, in connection with commercial transactions. A person established in Malaysia is covered. So is a person outside Malaysia who uses equipment in Malaysia to process personal data, other than for transit, and that person must nominate a representative established in Malaysia.

The JPDP lists these exclusions:

The Federal Government and State Governments
Credit reporting businesses run by a Credit Reporting Agency under the Credit Reporting Agency Act 2010
Personal data processed by individuals for personal, family or household affairs, including recreation
Personal data processed outside Malaysia, unless it is intended for further processing in Malaysia

Source: JPDP, Application and Non-Application of the Act. The page lists no exclusion for small businesses.

What are the seven principles?

Section 5(1) sets seven Personal Data Protection Principles. The JPDP summarises them like this.

Principle	What the JPDP says
General	Personal data may not be processed without the individual’s consent
Notice and Choice	Individuals must be told beforehand what is collected and why
Disclosure	Data may be disclosed only for the purposes identified
Security	Protect data from loss, modification, misuse and unauthorised access
Storage (retention)	Do not keep data longer than necessary
Data Integrity	Keep data accurate, complete, clear and up to date
Access	Individuals may access and correct their data

Source: JPDP, Principles of Personal Data Protection. The Act itself adds exceptions, for example to the consent rule, so read the text or ask a lawyer.

What changed in the 2024 amendments?

Act A1727 made these changes, among others.

Change	Section	In force
“Data user” becomes “data controller”	2	1 April 2025
Biometric data added to sensitive personal data	4	1 April 2025
Data processors must comply with the Security Principle	5	1 April 2025
Data controllers must appoint a data protection officer	12A	1 June 2025
Data controllers must notify breaches to the Commissioner	12B	1 June 2025
Data subjects may request data portability	43A	1 June 2025

Sources: Act A1727 and Gazette P.U. (B) 522, 24 December 2024. The Gazette commences sections of the amending Act by number. The “In force” column is our reading of which section of the amending Act holds each change.

What is the penalty for breaching the PDPA?

The amendment raised the maximum penalty for breaching a principle.

Item	Before	After
Fine	RM300,000	RM1 million
Imprisonment	Up to 2 years	Up to 3 years
Failure to notify a breach (section 12B)	Not applicable	Up to RM250,000, up to 2 years, or both

Source: Act A1727, sections 4 and 6. A fine and imprisonment can be imposed together.

How does a points program keep PDPA work small?

Most duties scale with the data you hold. A points-based program can run on an email address and a purchase record, which is also first-party data you collect directly. A schedule for points expiry gives you a point at which to review inactive accounts under the retention rule. Compare the Singapore law in our entry on the PDPA (Singapore) if you trade in both markets.

This page is a plain-language summary and not legal advice. We did not read the full text of Act 709. Check the current Act and Commissioner guidelines before you write your member notice.

How Gimify fits

Gimify members join with an email address through a QR code, with no form or app download. The Malaysian price is about RM199 a month for unlimited outlets, and the free plan covers one outlet. What members are told about why you hold their email is the decision of the business running the program.

Questions owners ask

What does PDPA stand for in Malaysia?

Personal Data Protection Act 2010, numbered Act 709 in the Laws of Malaysia. Its stated objective on the Personal Data Protection Department (JPDP) website is to regulate the processing of personal data in commercial transactions.

Does the PDPA apply to a small shop?

The JPDP says the Act applies to any person who processes personal data, or controls or authorises its processing, in connection with commercial transactions. The pages we read list exemptions for federal and state governments, credit reporting agencies and personal or household use, and none for small businesses.

What is the difference between a data user and a data controller?

Nothing in substance. Act A1727 replaced the words data user with data controller throughout the 2010 Act, with a few exceptions, and the change took effect on 1 April 2025.

Does the Act apply to a business outside Malaysia?

It can. The JPDP says a person not established in Malaysia is covered if they use equipment in Malaysia to process personal data, and must then nominate a representative established in Malaysia. Data processed outside Malaysia is excluded unless it is intended for further processing in Malaysia.

Do I have to report a leak of customer data?

Section 12B, in force since 1 June 2025, requires a data controller who has reason to believe a personal data breach occurred to notify the Commissioner as soon as practicable. Failing to do so carries a fine of up to RM250,000, up to two years in prison, or both.

Can customers ask me to move their data elsewhere?

Yes, in principle. New section 43A lets a data subject request in writing, by electronic means, that you transmit their data to another data controller, subject to technical feasibility and data format compatibility.