The Adequacy of Data Protection Laws in Protecting Personal Data in Malaysia

Abstract

With the burgeoning technology, Malaysia has seen a staggering number of data breaches and data leaks within this past decade alone, with no signs of the trend decreasing. This has raised questions on whether the Personal Data Protection Act 2010 (PDPA) adequately protects the personal data of Malaysians. With the recent COVID-19 pandemic, data has been collected on a larger scale than before, with more frequent data leaks occurring. Hence, this study aims to analyse the adequacy of the PDPA by benchmarking it to the United Kingdom’s (UK) Data Protection Act 2018, which have seen a decrease in data breaches since the implementation of the new legislation. In this context, personal data refers to information processed or recorded that relates directly or indirectly to a data subject, who may be identified from the information and may include sensitive personal data. The study uses a doctrinal analysis methodology to best explore the ideas and concepts within the literature available regarding the protection of personal data. The study also employs a comparative analysis methodology by comparing the scope and application of Malaysian and UK legislation for benchmarking. The findings suggest that there are improvements to be made for the PDPA to be adequate.

Improving Data Governance and Personal Data Protection through ASEAN Digital Masterplan 2025

“…Malaysia, in addition to passing the PDPA 2010, published the PDPA Standard 2015 and the PDP (Class of Data Users) (Amendment) Order 2016 (Noor Sureani et al, 2021). As in other legal environments governing personal data in the region, it regulates fundamental elements of personal data protection, such as consent and the security obligations of platforms.…”

“…As in other legal environments governing personal data in the region, it regulates fundamental elements of personal data protection, such as consent and the security obligations of platforms. However, the PDPA does not explicitly include the right to be forgotten nor does it protect user data in social media, despite this being a vulnerable area for personal data in the country (Sureani et al, 2021). PDPA 2010 Article 1 paragraph 2 states the law applies to "…any personal data in respect of commercial transactions" in which "commercial transactions" is understood as "any transaction of a commercial nature…which includes any matters relating to the supply or The regulations in these four member states follow the general principle of the ASEAN PDP to varying degrees.…”