Loyalty Programs and Malaysia's PDPA: What Customer Data You Can Collect
By Alva Chew · Updated
In short Malaysia's Personal Data Protection Act 2010 covers a loyalty program because member details are personal data processed in commercial transactions. You need the member's consent, a written notice of purposes, data that is adequate but not excessive, and a retention limit. Since 2025 the Act also requires breach notification, and the Commissioner's guideline says a loyalty program run only to manage accounts may not need a data protection officer. Check your own case with a lawyer.
Does Malaysia’s PDPA apply to a loyalty program?
Yes, in general. Section 2(1) of the Personal Data Protection Act 2010 (Act 709) applies to any person who processes, or controls or authorises the processing of, personal data in respect of commercial transactions. The Act defines a commercial transaction as any transaction of a commercial nature, including matters relating to the supply or exchange of goods or services. A customer who gives you an email address to earn points on café or shop purchases fits that description.
The text has no small-business carve-out. The Act was amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727), published in the Gazette on 17 October 2024. This page uses the amended term “data controller”.
This page summarises the Act and the Commissioner’s guidelines for shop owners. It is not legal advice, and we are not lawyers. Check your own situation with a Malaysian lawyer before you finalise your sign-up notice.
When did the 2024 amendments take effect?
The Minister of Digital appointed three commencement dates in a Gazette notice (P.U. (B) 522) dated 24 December 2024.
| Date | Sections of Act A1727 in force | Examples of what they cover |
|---|---|---|
| 1 January 2025 | 7, 11, 13, 14 | Administrative and saving provisions |
| 1 April 2025 | 2, 3, 4, 5, 8, 10, 12 | “Data controller” wording, biometric data as sensitive data, higher penalty in section 5(2) |
| 1 June 2025 | 6, 9 | New DPO and breach notification duties (sections 12A and 12B), data portability (section 43A) |
Source: Attorney General’s Chambers, P.U. (B) 522, 24 December 2024, and Act A1727, both hosted by the Personal Data Protection Department (JPDP). The third column is our reading of which amendment each section number contains.
What customer data can you collect?
The Act does not list permitted fields. Section 6(3) sets a test. Personal data may be processed only if all three of these hold:
- It is processed for a lawful purpose directly related to an activity of the data controller.
- The processing is necessary for or directly related to that purpose.
- The data is adequate but not excessive in relation to that purpose.
For a points program the purpose is to credit points for purchases and let the member redeem them. Data that serves that purpose is easy to defend:
- An email address or phone number to identify the member and let them sign in
- A name, if staff greet members by name
- The date, amount and outlet of each purchase
- The points balance and redemption history
A birth date, home address or income does not help you credit points. Asking for it invites the “excessive” question. If you collect it, write down the purpose and decide whether you would act on the answer.
A points program has no reason to hold sensitive personal data such as health information or, since the 2024 amendment, biometric data.
Do you need consent, and what must the notice say?
Section 6(1)(a) says you must not process personal data other than sensitive data unless the data subject has given consent. Section 6(2) lists exceptions, for example where processing is necessary for the performance of a contract with the data subject. We have not seen guidance that says whether a free loyalty program falls under that exception, so do not assume it does. Ask a lawyer, and keep a record of how and when each member agreed.
Separately, section 7 requires a written notice. It must tell the member:
- That you process their data, with a description of it.
- The purposes of collection and further processing.
- The source, if you did not get it from them.
- Their right to request access and correction, and how to contact you.
- The classes of third parties you disclose it to.
- The choices you offer for limiting processing.
- Whether supplying the data is obligatory or voluntary, and the consequences if it is obligatory.
The notice is due as soon as practicable when you first ask for the data or first collect it (section 7(2)). Section 7(3) says it must be in the national language and English. If you scan a QR code sign-up flow, that means a two-language notice on the sign-up screen or a link from it.
Section 8 limits disclosure. Without consent you may not disclose data for another purpose, or to a party outside the classes of third parties you named in the notice.
What if a customer says “stop”?
Two provisions matter here. Section 43 lets a data subject, by written notice, require you to stop or not begin processing their data for direct marketing, after a period reasonable in the circumstances. The Act defines direct marketing as advertising or marketing material directed to particular individuals. If the member complains to the Commissioner and the Commissioner requires you to comply, ignoring that requirement is an offence with a fine of up to RM200,000, up to two years in prison, or both.
Section 12 gives members access to their data and a way to correct it. We did not review the detailed access procedure in sections 30 onward.
Singapore has a different law with its own withdrawal rule of thumb, which the Malaysian Act text does not repeat. See loyalty programs and the PDPA in Singapore if you also trade there.
How long can you keep member data?
Section 10 is the Retention Principle. Data processed for a purpose must not be kept longer than necessary to fulfil it, and you must take all reasonable steps to destroy or permanently delete data no longer required. The Act sets no number of years.
So you set your own rule. Decide when a member counts as inactive, such as no purchase for a stated number of months, and what you do then. If your points expire, the expiry date gives you a natural point to delete the account. Our glossary entry on points expiry covers that choice.
What must you do if the member list leaks?
Section 12B, in force since 1 June 2025, has two duties:
- If you have reason to believe a personal data breach occurred, you must notify the Commissioner as soon as practicable, in the manner the Commissioner determines.
- If the breach causes or is likely to cause significant harm to the data subject, you must also notify the data subject without unnecessary delay.
Failing to notify the Commissioner is an offence, with a fine of up to RM250,000, up to two years in prison, or both. The Commissioner’s Data Breach Notification Guideline (version 1.0, 25 February 2025) adds the detail.
| Item | What the guideline says |
|---|---|
| Which breaches are notifiable | Those that cause or are likely to cause significant harm |
| Significant scale | More than 1,000 affected data subjects |
| Other triggers for significant harm | Sensitive data, misuse for illegal purposes, financial loss, or data that could enable identity fraud |
| Deadline to the Commissioner | As soon as practicable and no later than 72 hours from the occurrence of the breach |
| Deadline to members | Without unnecessary delay, no later than 7 days after notifying the Commissioner |
Source: JPDP, Personal Data Protection Guideline on Data Breach Notification v1.0, 25 February 2025, paragraphs 5.2, 5.3, 6.1 and 9.1.
A loyalty list of emails and purchase records could fall under either test, for example if it leaks after a hack and holds more than 1,000 members. Section 9 (Security Principle) is the duty beforehand: take practical steps to protect data from loss, misuse and unauthorised access. For a small shop that means individual staff sign-ins, not a shared spreadsheet or photographs of member cards.
Do you need a data protection officer?
Section 12A requires a data controller to appoint one or more data protection officers (DPOs), and to notify the Commissioner as the Commissioner determines. The Commissioner’s DPO Guideline (25 February 2025) sets the conditions. You must appoint if your processing involves any of these:
| Condition | Threshold |
|---|---|
| Personal data | More than 20,000 data subjects |
| Sensitive personal data including financial information | More than 10,000 data subjects |
| Regular and systematic monitoring of personal data | Any scale |
Source: JPDP, Personal Data Protection Guideline on the Appointment of Data Protection Officer v1.0, 25 February 2025, paragraph 4.2.
The guideline addresses loyalty programs directly. It says the management of a loyalty programme may not be considered regular and systematic monitoring if the purpose is strictly to manage the data subjects’ accounts and not to monitor their purchase behaviours. The wording is “may not”, so it is not a guarantee. If you use purchase history to profile members and target them, the answer could change. Where an appointment is required, the guideline asks you to register the DPO within 21 days of appointment.
What penalties apply?
Section 5(2), as amended and in force since 1 April 2025, sets the penalty for breaching a Personal Data Protection Principle: a fine of up to RM1 million, up to three years in prison, or both. Before the amendment it was RM300,000 and two years.
Which program design keeps your PDPA workload small?
Collect less. Most of the duties above scale with what you hold. A points program works on an email address and a purchase record, so you can stop there. A shorter list of fields means less to correct, delete or lose in a breach.
Practical steps for the counter:
- Put your section 7 notice, in the national language and English, on the sign-up screen.
- Keep any marketing consent separate and optional.
- Name a person or email address for access, correction and stop requests.
- Write down your retention rule for inactive members.
- Limit staff access to the member list and give each person their own sign-in.
See launching a program at the counter, a loyalty card with no app and best loyalty apps in Malaysia.
We did not review the Personal Data Protection Regulations 2013, any code of practice for retail, or the Commissioner’s circular on registration of data controllers, and these may add duties. This page is not legal advice. Check the current Act and guidelines with a lawyer before you finalise your notice.
How Gimify handles sign-up data
Gimify members join by scanning a QR code and entering their email, with no form, app download or password, and the points card sits in Google Wallet. Pricing for Malaysia is about RM199 a month for unlimited outlets, with a free plan for one outlet. What you tell members about why you hold their email remains your decision as the business running the program.
Questions owners ask
Does the Malaysian PDPA apply to a small shop's loyalty program?
Section 2(1) applies the Act to anyone who processes personal data in respect of commercial transactions, and the Act defines those as including the supply or exchange of goods or services. The text has no size exemption for small shops. A lawyer can confirm how it applies to you.
Do I need a customer's consent before collecting their email for a loyalty program?
Section 6(1)(a) says personal data other than sensitive data may not be processed without the data subject's consent, with listed exceptions in section 6(2) such as processing necessary for a contract. Whether the exceptions cover your program is a legal question, so ask a lawyer and keep a record of how you obtain consent.
What must my sign-up notice say?
Section 7 requires a written notice covering what data you process, the purposes, the source, the right to access and correct, who you may disclose it to, the choices to limit processing, and whether supplying the data is obligatory or voluntary. Section 7(3) says the notice must be in the national language and English.
Do I have to appoint a data protection officer for a loyalty program?
The Commissioner's DPO guideline (25 February 2025) applies when you process data of more than 20,000 data subjects, sensitive data of more than 10,000, or do regular and systematic monitoring. It says managing a loyalty programme may not count as monitoring if the purpose is strictly to manage accounts and not to monitor purchase behaviour.
How fast must I report a leak of my member list?
Section 12B requires notice to the Commissioner as soon as practicable once you have reason to believe a breach occurred. The Commissioner's guideline sets no later than 72 hours from the breach for notifiable breaches, and notice to affected members within 7 days after notifying the Commissioner where significant harm is likely.
Can a member tell me to stop sending them marketing?
Yes. Section 43 lets a data subject require you in writing to cease or not begin processing their personal data for direct marketing, after a period that is reasonable in the circumstances.
Read next
Start free
Gimify is free for one outlet with unlimited members and no time limit. Unlimited outlets are one flat monthly price.
See plans