Does Your Business Need a Data Protection Officer Under Malaysia’s PDPA?

Written by

Short Answer
Since 1 June 2025, a business in Malaysia must appoint a Data Protection Officer (DPO) if it processes the personal data of more than 20,000 people, the sensitive personal data (including financial information) of more than 10,000 people, or carries out regular and systematic monitoring of personal data. The business must register its DPO with the Personal Data Protection Commissioner within 21 days.

What changed in Malaysia’s PDPA?
The Personal Data Protection (Amendment) Act 2024 updated the Personal Data Protection Act 2010. The changes came into force in three stages during 2025: 1 January, 1 April and 1 June. The biggest changes include:

  • Higher penalties for breaching the data protection principles, up to RM1,000,000 and/or up to three years in prison (from 1 April 2025).
  • Biometric data added to the definition of sensitive personal data.
  • Data processors, such as service providers that handle data for another company, now directly responsible for keeping that data secure.
  • Mandatory DPO appointment, mandatory data breach notification and a new right to data portability (from 1 June 2025).

Who must appoint a DPO?
Under the DPO guideline issued on 25 February 2025, both data controllers and data processors must appoint at least one DPO if their processing involves any one of these:

  1. Personal data of more than 20,000 people
  2. Sensitive personal data, including financial information, of more than 10,000 people
  3. Activities that require regular and systematic monitoring of personal data

Businesses that run calling campaigns can reach these numbers faster than they expect. Customer databases, CRM records, lead lists and call recordings all count as personal data.

Who can be a DPO?
A DPO can be an existing employee or an outsourced professional under a service contract. According to the guideline, the DPO must:

  • Have sound knowledge of the PDPA and the business’s data processing
  • Be proficient in both Malay and English
  • Be resident in Malaysia (physically present for at least 180 days in a calendar year) or easily contactable

What happens if there is a data breach?
If a personal data breach causes or is likely to cause significant harm, the business must notify the Commissioner within 72 hours. If the breach risks significant harm to the affected individuals, the business must tell them within seven days. The guideline treats a breach as significant in scale if it affects more than 1,000 people. Businesses must also keep a record of breaches for at least two years.

What should a business do this month?

  1. Count how many people’s data you hold across your CRM, lead lists and call recordings.
  2. Check whether you hold sensitive or financial data, and how much.
  3. If you cross a threshold, appoint a DPO and register them through the Personal Data Protection System within 21 days.
  4. Write a simple breach response plan so your team knows what to do in the first 72 hours.
  5. Check your service providers. If you outsource calling or data work, ask how they protect your customers’ data, since data processors now have their own legal duties.

How does CALLMARK Solutions fit in?
When a business outsources telemarketing, the call centre usually handles personal data on the business’s behalf. CALLMARK Solutions provides inbound and outbound call services in Malaysia and treats data protection as part of every campaign. If you are reviewing how your call team handles your customer data, we are happy to talk it through.

Frequently Asked Questions

Does every business in Malaysia need a DPO?
No. Only businesses that meet at least one of the thresholds above must appoint one. Smaller businesses below these thresholds do not have to appoint one, but they still have to follow the PDPA.

Does a DPO need to be a full-time employee?
No. Under the guideline, a business can give the role to an existing employee or hire an outside professional under a service contract.

How fast must a business report a data breach?
Within 72 hours to the Commissioner, if the breach causes or is likely to cause significant harm.

This article is general information, not legal advice. Please check the latest guidelines from the Personal Data Protection Department or speak to a legal professional for your situation.

Sources

#CALLMARKSolutions #PDPA #DataProtectionMalaysia

Tags: ,