PDPA 2024 amendments: what Malaysian social media marketers should know

Social media marketing runs on personal data: names and phone numbers from lead forms, contest entries, customer lists, direct messages and comments. In Malaysia, that data is protected by the Personal Data Protection Act 2010 (PDPA). In 2024, Parliament passed the Personal Data Protection (Amendment) Act 2024 (Act A1727), which made the most significant changes to the PDPA since it was introduced. The changes came into force in phases during 2025.

If you run social media for your own business or for clients, here is what changed and what it means in practice.

The changes in brief

1. "Data user" is now "data controller"

The PDPA now uses the term data controller for the person or business that decides how and why personal data is processed. The new term matches international usage, such as the EU's GDPR. If you run campaigns for your own business, you are usually the data controller for the data you collect.

2. Data processors now have direct security duties

A data processor handles personal data on behalf of a controller. A social media agency that manages a client's lead forms or customer lists is a typical example. Since 1 April 2025, processors are directly bound by the PDPA's Security Principle: they must take practical steps to protect the personal data they handle from loss, misuse, unauthorised access and similar risks.

For agencies, this means security is no longer only the client's problem. You are responsible for how your team stores, shares and deletes client data.

3. Mandatory data breach notification

Since 1 June 2025, data controllers must notify the Personal Data Protection Commissioner when a personal data breach causes, or is likely to cause, significant harm. Where the breach is likely to cause significant harm to individuals, the affected people must be told too.

The Commissioner's guideline on data breach notification sets out what counts as significant harm and the expected timelines: notification to the Commissioner within 72 hours of becoming aware of the breach, and to affected individuals without unnecessary delay, within 7 days of notifying the Commissioner. Check the current guideline for the details, including the records you must keep.

For marketers, a "breach" could be as ordinary as a spreadsheet of contest entries shared by public link, a lead-form export emailed to the wrong person, or a team member's account being taken over.

4. Data protection officers

Since 1 June 2025, organisations that meet thresholds set by the Commissioner must appoint a data protection officer (DPO) and register the appointment. According to the Commissioner's guideline, the thresholds include processing the personal data of more than 20,000 people, processing sensitive personal data of more than 10,000 people, or regular and systematic monitoring of personal data.

A small business with a modest customer list may not cross these thresholds. An agency handling campaigns for many clients, or a business with a large CRM, might. Check the guideline against your own numbers.

5. A new right to data portability

Since 1 June 2025, individuals can ask a data controller to transmit their personal data to another data controller, subject to conditions such as technical feasibility and compatible data formats. In practice, you should know where each customer's data lives and be able to export it in a usable format.

6. New rules for transfers abroad

Previously, personal data could only be transferred outside Malaysia to places approved on a ministerial list, with exceptions. That "whitelist" approach has been replaced. Since 1 April 2025, transfers are allowed where the destination has a law substantially similar to the PDPA or ensures an adequate level of protection, or where other conditions in the Act apply. The Commissioner has published a guideline on cross-border transfers.

This matters for marketers because many tools are hosted overseas: ad platforms, form builders, email tools, design apps and schedulers. When you upload customer data to them, you are often transferring it abroad.

7. Biometric data is sensitive personal data

Biometric data, meaning data from technical processing of physical or behavioural characteristics such as fingerprints or facial recognition templates, is now classed as sensitive personal data, which carries stricter rules. If any campaign or tool involves face recognition or similar processing, treat it with extra care.

8. Higher penalties

The maximum penalty for breaching the Personal Data Protection Principles rose from RM300,000 to RM1,000,000, and the maximum prison term from two to three years.

What this means for social media work

Know what you collect, and why

List the personal data your social media activity touches: lead-ad forms, contest entries, WhatsApp click-to-chat leads, customer lists uploaded for ad targeting, DMs and exported comments. For each, write down why you collect it, where it is stored, who can access it and when you delete it.

Give clear notice in both languages

The PDPA's Notice and Choice Principle requires you to tell people, in writing, how their data will be used, and the notice must be available in Bahasa Malaysia and English. A short notice on each lead form or contest page, with a link to your full privacy notice, is a good habit.

Collect less

Ask for what you need and nothing more. A giveaway rarely needs an IC number or a home address until you actually have a winner. Less data means less risk.

Respect marketing choices

Under the PDPA, people can ask you to stop using their data for direct marketing. Keep an opt-out list and honour it across every channel, including WhatsApp broadcasts.

Lock down access

• Use individual accounts with two-factor authentication rather than shared logins.
• Give team members only the access they need, and remove it promptly when they leave.
• Avoid public "anyone with the link" sharing for files containing personal data.
• Delete campaign data when the campaign and any legal retention period are over.

Agencies: put it in writing

If you process data for clients, agree a data processing agreement that covers what you process, the security measures you take, how you handle breaches and what happens to the data at the end of the contract. Under the amended Act, your security obligations apply to you directly.

Choose tools carefully

Before you put customer data into a tool, check where it is hosted, what security it offers (encryption, two-factor sign-in, access controls), whether it offers a data processing agreement and whether you can export and delete your data easily.

Have a breach plan before you need it

Decide now who does what if something goes wrong: who investigates, who decides whether the breach is notifiable, who drafts the notices and who talks to clients or customers. With a 72-hour window, there is no time to work this out during the incident.

Official sources

• Personal Data Protection Department (JPDP): the Commissioner's office, with the Act, regulations, codes of practice and guidelines, including those on data breach notification, data protection officers, data portability and cross-border transfers: pdp.gov.my (opens in a new tab)
• Laws of Malaysia (Attorney General's Chambers): the Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection (Amendment) Act 2024 (Act A1727): lom.agc.gov.my (opens in a new tab)

The short version

• Agencies acting as processors now have direct security duties.
• Serious breaches must be reported to the Commissioner, with tight timelines.
• Larger data handlers must appoint and register a DPO.
• People can ask for their data to be moved to another controller.
• Transfers abroad follow new rules, so check where your tools store data.
• Penalties are higher: up to RM1,000,000 and three years.

None of this should stop you from running great campaigns. It asks you to treat your customers' data with the same care you would want for your own. Once more, this is a general overview, not legal advice.