201906.25

Personal Data Protection Act 2010- Part 1

Share this article

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709

Incorporating all amendments up to 1 July 2010

Date of Royal Assent ... ... ... ... ... ...	2 June 2010
Date of publication in the Gazette ... ... ... ...	10 June 2010
Date of coming into operation ... ...	15 November 2013 [P.U.(B) 464/2013]

ACT 709
PERSONAL DATA PROTECTION ACT 2010

Part I PRELIMINARY

SECTION

1.Short title and commencement

2.Application

3.Non-application

4.Interpretation

Part II PERSONAL DATA PROTECTION

Division 1 Personal Data Protection Principles

SECTION

5.Personal Data Protection Principles

6.General Principle

7.Notice and Choice Principle

8.Disclosure Principle

9.Security Principle

10.Retention Principle

11.Data Integrity Principle

12.Access Principle

Part II PERSONAL DATA PROTECTION

Division 2 Registration

SECTION

13.Application of this Division

14.Registration of data users

15.Application for registration

16.Certificate of registration

17.Renewal of certificate of registration

18.Revocation of registration

19.Surrender of certificate of registration

20.Register of Data Users

Part II PERSONAL DATA PROTECTION

Division 3 Data user forum and code of practice

SECTION

21.Data user forum

22.Register of Data User Forums

23.Code of practice

24.Commissioner may issue code of practice

25.Applicable code of practice

26.Revocation, etc., of code of practice

27.Submission of new code of practice by data user forum

28.Register of Codes of Practice

29.Non-compliance with code of practice

Part II PERSONAL DATA PROTECTION

Division 4 Rights of data subject

SECTION

30.Right of access to personal data

31.Compliance with data access request

32.Circumstances where data user may refuse to comply with data access request

33.Notification of refusal to comply with data access request

34.Right to correct personal data

35.Compliance with data correction request

36.Circumstances where data user may refuse to comply with data correction request

37.Notification of refusal to comply with data correction request

38.Withdrawal of consent to process personal data

39.Extent of disclosure of personal data

40.Processing of sensitive personal data

41.Repeated collection of personal data in same circumstances

42.Right to prevent processing likely to cause damage or distress

43.Right to prevent processing for purposes of direct marketing

44.Record to be kept by data user

Part III EXEMPTION

SECTION

45.Exemption

46.Power to make further exemptions

Part IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER

SECTION

47.Appointment of Commissioner

48.Functions of Commissioner

49.Powers of Commissioner

50.Appointment of Deputy Commissioners and Assistant Commissioners

51.Appointment of other officers and servants

52.Loans and advances to officers and servants

53.Tenure of office

54.Revocation of appointment and resignation

55.Temporary exercise of functions and powers of Commissioner

56.Vacation of office

57.Remuneration and allowances

58.Delegation of Commissioner's functions and powers

59.Direction by Minister

60.Returns, reports, accounts and information

Part V PERSONAL DATA PROTECTION FUND

SECTION

61.Establishment of Fund

62.Expenditure to be charged on Fund

63.Conservation of Fund

64.Reserve fund

65.Financial year

66.Limitation on contracts

67.Bank accounts

68.Accounts and audit

69.Expenditure and preparation of estimates

Part VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE

SECTION

70.Establishment of Advisory Committee

71.Functions of Advisory Committee

72.Members of Advisory Committee

73.Tenure of office

74.Revocation of appointment and resignation

75.Temporary exercise of functions of Chairman

76.Vacation of office

77.Allowances

78.Time and place of meetings

79.Advisory Committee may invite others to attend meetings

80.Minutes

81.Procedure

82.Members to devote time to business of Advisory Committee

Part VII APPEAL TRIBUNAL

SECTION

83.Establishment of Appeal Tribunal

84.Powers of Appeal Tribunal

85.Members of Appeal Tribunal

86.Secretary to Appeal Tribunal and other officers, etc.

87.Tenure of office

88.Resignation and revocation of appointment

89.Temporary exercise of functions of Chairman

90.Vacation of office

91.Allowances

92.Disclosure of interest

93.Appeal to Appeal Tribunal

94.Record of decision of Commissioner

95.Stay of decision pending appeal

96.Composition of Appeal Tribunal

97.Sitting of Appeal Tribunal

98.Procedure of Appeal Tribunal

99.Decision of Appeal Tribunal

100.Enforcement of decision of Appeal Tribunal

Part VIII INSPECTION, COMPLAINT AND INVESTIGATION

SECTION

101.Inspection of personal data system

102.Relevant data user, etc., to be informed of result of inspection

103.Reports by Commissioner

104.Complaint

105.Investigation by Commissioner

106.Restriction on investigation initiated by complaint

107.Commissioner may carry out or continue investigation initiated by complaint notwithstanding withdrawal of complaint

108.Enforcement notice

109.Variation or cancellation of enforcement notice

Part IX ENFORCEMENT

SECTION

110.Authorized officers

111.Authority card

112.Power of investigation

113.Search and seizure with warrant

114.Search and seizure without warrant

115.Access to computerized data

116.Warrant admissible notwithstanding defects

117.List of computer, book, account, etc., seized

118.Release of computer, book, account, etc., seized

119.No cost or damages arising from seizure to be recoverable

120.Obstruction to search

121.Power to require production of computer, book, account, etc.

122.Power to require attendance of persons acquainted with case

123.Examination of persons acquainted with case

124.Admission of statements in evidence

125.Forfeiture of computer, book, account, etc., seized

126.Joinder of offences

127.Power of arrest

Part X MISCELLANEOUS

SECTION

128.Register

129.Transfer of personal data to places outside Malaysia

130.Unlawful collecting, etc., of personal data

131.Abetment and attempt punishable as offences

132.Compounding of offences

133.Offences by body corporate

134.Prosecution

135.Jurisdiction to try offences

136.Service of notices or other documents

137.Public Authorities Protection Act 1948

138.Public servant

139.Protection against suit and legal proceedings

140.Protection of informers

141.Obligation of secrecy

142.Things done in anticipation of the enactment of this Act

143.Power to make regulations

144.Prevention of anomalies

Part XI SAVINGS AND TRANSITIONAL PROVISIONS

SECTION

145.Personal data processed before the date of coming into operation of this Act

146.Registration of persons who process personal data before the date of coming into operation of this Act

1.LIST OF AMENDMENTS

An Act to regulate the processing of personal data in commercial transactions and to provide for matters connected therewith and incidental thereto.

ENACTED by the Parliament of Malaysia as follows:

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/1.Short title and commencement

Part I PRELIMINARY

1. Short title and commencement

(1) This Act may be cited as the Personal Data Protection Act 2010.

(2) This Act comes into operation on a date to be appointed by the Minister by notification in the Gazette, and the Minister may appoint different dates for different provisions of this Act.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/2.Application

2. Application

(1) This Act applies to--

(a) any person who processes; and

(b) any person who has control over or authorizes the processing of,

any personal data in respect of commercial transactions.

(2) Subject to subsection (1), this Act applies to a person in respect of personal data if--

(a) the person is established in Malaysia and the personal data is processed, whether or not in the context of that establishment, by that person or any other person employed or engaged by that establishment; or

(b) the person is not established in Malaysia, but uses equipment in Malaysia for processing the personal data otherwise than for the purposes of transit through Malaysia.

(3) A person falling within paragraph (2)(b) shall nominate for the purposes of this Act a representative established in Malaysia.

(4) For the purposes of subsections (2) and (3), each of the following is to be treated as established in Malaysia:

(a) an individual whose physical presence in Malaysia shall not be less than one hundred and eighty days in one calendar year;

(b) a body incorporated under the Companies Act 1965 [Act 125];

(d) any person who does not fall within paragraph (a), (b) or (c) but maintains in Malaysia--

(i) an office, branch or agency through which he carries on any activity; or

(ii) a regular practice.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/3.Non-application

3. Non-application

(1) This Act shall not apply to the Federal Government and State Governments.

(2) This Act shall not apply to any personal data processed outside Malaysia unless that personal data is intended to be further processed in Malaysia.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/4.Interpretation

4. Interpretation

In this Act, unless the context otherwise requires--

"credit reporting agency"

has the meaning assigned to it in the Credit Reporting Agencies Act 2010 [Act 710];

"this Act"

includes regulations, orders, notifications and other subsidiary legislation made under this Act;

"register"

means the Register of Data Users, Register of Data User Forums or Register of Codes of Practice;

"personal data"

means any information in respect of commercial transactions, which--

(a) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose;

(b) is recorded with the intention that it should wholly or partly be processed by means of such equipment; or

(c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system,

that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data user, including any sensitive personal data and expression of opinion about the data subject; but does not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under the Credit Reporting Agencies Act 2010;

"sensitive personal data"

means any personal data consisting of information as to the physical or mental health or condition of a data subject, his political opinions, his religious beliefs or other beliefs of a similar nature, the commission or alleged commission by him of any offence or any other personal data as the Minister may determine by order published in the Gazette;

"prescribed"

means prescribed by the Minister under this Act and where no mode is mentioned, means prescribed by order published in the Gazette;

"Advisory Committee"

means the Personal Data Protection Advisory Committee established under section 70;

"vital interests"

means matters relating to life, death or security of a data subject;

"Fund"

means the Personal Data Protection Fund established under section 61;

"use"

, in relation to personal data, does not include the act of collecting or disclosing such personal data;

"collect"

, in relation to personal data, means an act by which such personal data enters into or comes under the control of a data user;

"Minister"

means the Minister charged with the responsibility for the protection of personal data;

"disclose"

, in relation to personal data, means an act by which such personal data is made available by a data user;

"relevant person"

, in relation to a data subject, howsoever described, means--

(a) in the case of a data subject who is below the age of eighteen years, the parent, guardian or person who has parental responsibility for the data subject;

(b) in the case of a data subject who is incapable of managing his own affairs, a person who is appointed by a court to manage those affairs, or a person authorized in writing by the data subject to act on behalf of the data subject; or

(c) in any other case, a person authorized in writing by the data subject to make a data access request, data correction request, or both such requests, on behalf of the data subject;

"authorized officer"

means any officer authorized in writing by the Commissioner under section 110;

"correction"

, in relation to personal data, includes amendment, variation, modification or deletion;

"requestor"

, in relation to a data access request or data correction request, means the data subject or the relevant person on behalf of the data subject, who has made the request;

"data processor"

, in relation to personal data, means any person, other than an employee of the data user, who processes the personal data solely on behalf of the data user, and does not process the personal data for any of his own purposes;

"processing"

, in relation to personal data, means collecting, recording, holding or storing the personal data or carrying out any operation or set of operations on the personal data, including--

(a) the organization, adaptation or alteration of personal data;

(b) the retrieval, consultation or use of personal data;

(d) the alignment, combination, correction, erasure or destruction of personal data;

"registration"

means the registration of a data user under section 16;

"data user"

means a person who either alone or jointly or in common with other persons processes any personal data or has control over or authorizes the processing of any personal data, but does not include a data processor;

"relevant data user"

, in relation to--

(a) an inspection, means the data user who uses the personal data system which is the subject of the inspection;

(b) a complaint, means the data user specified in the complaint;

(i) in the case of an investigation initiated by a complaint, means the data user specified in the complaint;

(ii) in any other case, means the data user who is the subject of the investigation;

(d) an enforcement notice, means the data user on whom the enforcement notice is served;

"credit reporting business"

has the meaning assigned to it in the Credit Reporting Agencies Act 2010;

"Commissioner"

means the Personal Data Protection Commissioner appointed under section 47;

"third party"

, in relation to personal data, means any person other than--

(a) a data subject;

(b) a relevant person in relation to a data subject;

(d) a data processor; or

(e) a person authorized in writing by the data user to process the personal data under the direct control of the data user;

"relevant filing system"

means any set of information relating to individuals to the extent that, although the information is not processed by means of equipment operating automatically in response to instructions given for that purpose, the set of information is structured, either by reference to individuals or by reference to criteria relating to individuals, in such a way that specific information relating to a particular individual is readily accessible;

"data subject"

means an individual who is the subject of the personal data;

"appointed date"

means the relevant date or dates, as the case may be, on which this Act comes into operation;

"code of practice"

means the personal data protection code of practice in respect of a specific class of data users registered by the Commissioner pursuant to section 23 or issued by the Commissioner under section 24;

"commercial transactions"

means any transaction of a commercial nature, whether contractual or not, which includes any matters relating to the supply or exchange of goods or services, agency, investments, financing, banking and insurance, but does not include a credit reporting business carried out by a credit reporting agency under the Credit Reporting Agencies Act 2010.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/5.Personal Data Protection Principles

Part II PERSONAL DATA PROTECTION

Division 1 Personal Data Protection Principles

5. Personal Data Protection Principles

(1) The processing of personal data by a data user shall be in compliance with the following Personal Data Protection Principles, namely--

(a) the General Principle;

(b) the Notice and Choice Principle;

(d) the Security Principle;

(e) the Retention Principle;

(f) the Data Integrity Principle; and

(g) the Access Principle,

as set out in sections 6, 7, 8, 9, 10, 11 and 12.

(2) Subject to sections 45 and 46, a data user who contravenes subsection (1) commits an offence and shall, on conviction, be liable to a fine not exceeding three hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/6.General Principle

6. General Principle

(1) A data user shall not--

(a) in the case of personal data other than sensitive personal data, process personal data about a data subject unless the data subject has given his consent to the processing of the personal data; or

(b) in the case of sensitive personal data, process sensitive personal data about a data subject except in accordance with the provisions of section 40.

(2) Notwithstanding paragraph (1)(a), a data user may process personal data about a data subject if the processing is necessary--

(a) for the performance of a contract to which the data subject is a party;

(b) for the taking of steps at the request of the data subject with a view to entering into a contract;

(c) for compliance with any legal obligation to which the data user is the subject, other than an obligation imposed by a contract;

(d) in order to protect the vital interests of the data subject;

(e) for the administration of justice; or

(f) for the exercise of any functions conferred on any person by or under any law.

(3) Personal data shall not be processed unless--

(a) the personal data is processed for a lawful purpose directly related to an activity of the data user;

(b) the processing of the personal data is necessary for or directly related to that purpose; and

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/7.Notice and Choice Principle

7. Notice and Choice Principle

(1) A data user shall by written notice inform a data subject--

(a) that personal data of the data subject is being processed by or on behalf of the data user, and shall provide a description of the personal data to that data subject;

(b) the purposes for which the personal data is being or is to be collected and further processed;

(d) of the data subject's right to request access to and to request correction of the personal data and how to contact the data user with any inquiries or complaints in respect of the personal data;

(e) of the class of third parties to whom the data user discloses or may disclose the personal data;

(f) of the choices and means the data user offers the data subject for limiting the processing of personal data, including personal data relating to other persons who may be identified from that personal data;

(g) whether it is obligatory or voluntary for the data subject to supply the personal data; and

(h) where it is obligatory for the data subject to supply the personal data, the consequences for the data subject if he fails to supply the personal data.

(2) The notice under subsection (1) shall be given as soon as practicable by the data user--

(a) when the data subject is first asked by the data user to provide his personal data;

(b) when the data user first collects the personal data of the data subject; or

(i) uses the personal data of the data subject for a purpose other than the purpose for which the personal data was collected; or

(ii) discloses the personal data to a third party.

(3) A notice under subsection (1) shall be in the national and English languages, and the individual shall be provided with a clear and readily accessible means to exercise his choice, where necessary, in the national and English languages.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/8.Disclosure Principle

8. Disclosure Principle

Subject to section 39, no personal data shall, without the consent of the data subject, be disclosed--

(a) for any purpose other than--

(i) the purpose for which the personal data was to be disclosed at the time of collection of the personal data; or

(ii) a purpose directly related to the purpose referred to in subparagraph (i); or

(b) to any party other than a third party of the class of third parties as specified in paragraph 7(1)(e).

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/9.Security Principle

9. Security Principle

(1) A data user shall, when processing personal data, take practical steps to protect the personal data from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction by having regard--

(a) to the nature of the personal data and the harm that would result from such loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction;

(b) to the place or location where the personal data is stored;

(d) to the measures taken for ensuring the reliability, integrity and competence of personnel having access to the personal data; and

(e) to the measures taken for ensuring the secure transfer of the personal data.

(2) Where processing of personal data is carried out by a data processor on behalf of the data user, the data user shall, for the purpose of protecting the personal data from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction, ensure that the data processor--

(a) provides sufficient guarantees in respect of the technical and organizational security measures governing the processing to be carried out; and

(b) takes reasonable steps to ensure compliance with those measures.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/10.Retention Principle

10. Retention Principle

(1) The personal data processed for any purpose shall not be kept longer than is necessary for the fulfilment of that purpose.

(2) It shall be the duty of a data user to take all reasonable steps to ensure that all personal data is destroyed or permanently deleted if it is no longer required for the purpose for which it was to be processed.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/11.Data Integrity Principle

11. Data Integrity Principle

A data user shall take reasonable steps to ensure that the personal data is accurate, complete, not misleading and kept up-to-date by having regard to the purpose, including any directly related purpose, for which the personal data was collected and further processed.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/12.Access Principle

12. Access Principle

A data subject shall be given access to his personal data held by a data user and be able to correct that personal data where the personal data is inaccurate, incomplete, misleading or not up-to-date, except where compliance with a request to such access or correction is refused under this Act.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/13.Application of this Division

Part II PERSONAL DATA PROTECTION

Division 2 Registration

13. Application of this Division

(1) This Division shall apply to a data user who belongs to a class of data users as specified in the order made under subsection 14(1).

(2) A data user who belongs to a class of data users not specified in the order made under subsection 14(1) shall comply with all the provisions of this Act other than the provisions of this Division relating to the registration of data users and matters connected thereto.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/14.Registration of data users

14. Registration of data users

(1) The Minister may, upon the recommendation of the Commissioner, by order published in the Gazette, specify a class of data users who shall be required to be registered as data users under this Act.

(2) The Commissioner shall, before making his recommendation under subsection (1), consult with--

(a) such bodies representative of data users belonging to that class; or

(b) such other interested persons.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/15.Application for registration

15. Application for registration

(1) A person who belongs to the class of data users as specified in the order made under subsection 14(1) shall submit an application for registration to the Commissioner in the manner and form as determined by the Commissioner.

(2) Every application for registration shall be accompanied with the prescribed registration fee and such documents as may be required by the Commissioner.

(3) The Commissioner may in writing at any time after receiving the application and before it is determined, require the applicant to provide such additional documents or information within the time as specified by the Commissioner.

(4) If the requirement under subsection (3) is not complied with, the application for registration shall be deemed to have been withdrawn by the applicant and shall not be further proceeded with by the Commissioner, but without prejudice to a fresh application being made by the applicant.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/16.Certificate of registration

16. Certificate of registration

(1) After having given due consideration to an application under subsection 15(1), the Commissioner may--

(a) register the applicant and issue a certificate of registration to the applicant in such form as determined by the Commissioner; or

(b) refuse the application.

(2) The certificate of registration may be issued subject to such conditions or restrictions as the Commissioner may think fit to impose.

(3) Where the Commissioner refuses the application for registration in pursuance of subsection (1), he shall inform the applicant by a written notice that the application has been refused and the reasons for the refusal.

(4) A person who belongs to the class of data users as specified in the order made under subsection 14(1) and who processes personal data without a certificate of registration issued in pursuance of paragraph 16(1)(a) commits an offence and shall, on conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding three years or to both.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/17.Renewal of certificate of registration

17. Renewal of certificate of registration

(1) A data user may make an application for the renewal of the certificate of registration not later than ninety days before the date of expiry of the certificate of registration in the manner and form as determined by the Commissioner and the application shall be accompanied with the prescribed renewal fee and such documents as may be required by the Commissioner, but no application for renewal shall be allowed where the application is made after the date of expiry of the certificate of registration.

(2) When renewing a certificate of registration, the Commissioner may vary the conditions or restrictions imposed upon the issuance of the certificate of registration or impose additional conditions or restrictions.

(3) The Commissioner may refuse to renew a certificate of registration--

(a) if the data user has failed to comply with any of the provisions of this Act;

(b) if the data user has failed to comply with any conditions or restrictions imposed upon the issuance of the certificate of registration; or

(c) if he is satisfied that the data user is unable to continue the processing of personal data in accordance with this Act.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/18.Revocation of registration

18. Revocation of registration

(1) The Commissioner may revoke the registration of a data user if the Commissioner is satisfied that--

(a) the data user has failed to comply with any of the provisions of this Act;

(b) the data user has failed to comply with any conditions or restrictions imposed upon the issuance of the certificate of registration;

(d) the data user has ceased to carry on the processing of personal data.

(2) Notwithstanding subsection (1), the Commissioner shall not revoke the registration of a data user unless the Commissioner is satisfied that, after giving the data user an opportunity of making any representation in writing he may wish to make, the registration should be revoked.

(3) Where the registration of the data user is revoked, the Commissioner shall issue a notice of revocation of registration to the data user, and the certificate of registration issued in respect of such registration shall have no effect upon service of the notice of revocation of registration.

(4) A data user whose registration has been revoked under this section and who continues to process personal data thereafter commits an offence and shall, on conviction, be liable to a fine not exceeding five hundred thousand ringgit or to imprisonment for a term not exceeding three years or to both.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/19.Surrender of certificate of registration

19. Surrender of certificate of registration

(1) Where the certificate of registration is revoked in pursuance of section 18, the holder of the certificate shall, within seven days from the date of service of the notice of revocation of registration, surrender the certificate to the Commissioner.

(2) A person who fails to comply with subsection (1) commits an offence and shall, on conviction, be liable to a fine not exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/20.Register of Data Users

20. Register of Data Users

(1) The Commissioner shall maintain a Register of Data Users in accordance with section 128.

(2) The Register of Data Users shall contain the names of data users who have been registered in pursuance of this Division and any other particulars regarding such data users as may be determined by the Commissioner.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/21.Data user forum

Part II PERSONAL DATA PROTECTION

Division 3 Data user forum and code of practice

21. Data user forum

(1) The Commissioner may designate a body as a data user forum in respect of a specific class of data users for the purposes of this Act by notifying that body in writing, if the Commissioner is satisfied that--

(a) the membership of the body is open to all data users of that class;

(b) the body is capable of performing as required under the relevant provisions of this Act; and

(2) The body shall agree in writing to be a data user forum before the designation is registered by the Commissioner in the Register of Data User Forums.

(3) The Commissioner may decide that an existing body that was previously designated as a data user forum under subsection (1) is no longer a data user forum for the purposes of this Act, if he is satisfied that the body no longer meets the requirements as set out in that subsection.

(4) Where the Commissioner decides that an existing body which has been designated as a data user forum is no longer a data user forum for the purposes of this Act, he shall withdraw the designation and subsequently cancel the registration of the designation in the Register of Data User Forums.

(5) A designation or withdrawal of designation under this section shall take effect from the date of registration of the designation or the date of cancellation of the registration of the designation, as the case may be, or such later date as specified by the Commissioner.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/22.Register of Data User Forums

22. Register of Data User Forums

(1) The Commissioner shall maintain a Register of Data User Forums in accordance with section 128.

(2) The Register of Data User Forums shall contain the names of data user forums which have been designated and registered in pursuance of this Division and any other particulars regarding such data user forums as may be determined by the Commissioner.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/23.Code of practice

23. Code of practice

(1) A data user forum may prepare a code of practice--

(a) on its own initiative; or

(b) upon request by the Commissioner.

(2) The data user forum shall, in preparing a code of practice under subsection (1), consider matters including--

(a) the purpose for the processing of personal data by the data user or class of data users;

(b) the views of the data subjects or groups representing data subjects;

(d) that the code of practice, upon having regard to all of the matters in paragraphs (a), (b) and (c) and any other matters, offers an adequate level of protection for the personal data of the data subjects concerned.

(3) The Commissioner may register the code of practice prepared pursuant to subsection (1), if the Commissioner is satisfied that--

(a) the code of practice is consistent with the provisions of this Act; and

(b) the matters as set out in subsection (2) have been given due consideration.

(4) The code of practice under subsection (1) shall take effect on the date of registration of the code of practice by the Commissioner in the Register of Codes of Practice.

(5) If the Commissioner refuses to register the code of practice, the Commissioner shall notify the relevant data user forum of his decision in writing and provide the reasons for it.

(6) If the Commissioner neither registers nor refuses to register a code of practice within thirty days from the date of receipt of the code of practice by him for registration, he shall be deemed to have refused the registration of the code of practice.

(7) The Commissioner may register different codes of practice for different classes of data users.

(8) The Commissioner and data user shall make available to the public any code of practice registered under subsection (3).

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/24.Commissioner may issue code of practice

24. Commissioner may issue code of practice

(1) The Commissioner may issue a code of practice, if--

(a) a code of practice is not prepared under paragraph 23(1)(a);

(b) the Commissioner is satisfied that a code of practice for a specific class of data users is unlikely to be prepared by the relevant data user forum within the period as specified by the Commissioner; or

(2) The Commissioner shall, before issuing a code of practice under subsection (1), consider matters including--

(a) the purpose for the processing of personal data by the data user or class of data users;

(b) the views of the data users or groups representing data users, to which the code of practice is applicable;

(d) the views of the relevant regulatory authority, if any, to which the data user is subject to; and

(e) that the code of practice, upon having regard to all of the matters in paragraphs (a), (b) and (c) and any other matters, offers an adequate level of protection for the personal data of the data subjects concerned.

(3) The Commissioner may issue different codes of practice for different classes of data users.

(4) The code of practice issued by the Commissioner under subsection (1) shall be registered in the Register of Codes of Practice.

(5) The code of practice under subsection (1) shall take effect on the date of registration of the code of practice by the Commissioner.

(6) The Commissioner shall make available to the public any code of practice issued by him under subsection (1).

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/25.Applicable code of practice

25. Applicable code of practice

(1) The Commissioner shall ensure that there is only one code of practice registered for a class of data users at a given time.

(2) All data users belonging to a class of data users shall comply with the relevant registered code of practice that is applicable to that class of data users at a given time.

(3) Where a code of practice is registered by the Commissioner under section 23 or 24, the Commissioner shall notify, in such manner as he may determine, the relevant class of data users to whom the code of practice is applicable--

(a) of the identity of the code of practice concerned and the date on which the code of practice is to take effect; and

(b) of the specific requirements under this Act for which the code of practice is issued and registered.

(4) If there is any uncertainty or ambiguity as to which code of practice is applicable to a particular data user or class of data users, the data user or person concerned may apply to the Commissioner for his opinion on which code of practice is the applicable code of practice in relation to the circumstances of such data user or person.

(5) The Commissioner shall provide his opinion within thirty days from the date of receipt of an application made under subsection (4).

(6) The Commissioner shall, when making his opinion under subsection (5), take into account any relevant previous opinions, if any.

(7) The Commissioner may withdraw an opinion made under this section if the Commissioner is satisfied that the nature of the activity engaged by the data user has changed materially.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/26.Revocation, etc., of code of practice

26. Revocation, etc., of code of practice

(1) The Commissioner may revoke, amend or revise, whether in whole or in part, any code of practice registered under this Act--

(a) on his own accord; or

(b) upon an application by the data user forum or such bodies representing the data users.

(2) The Commissioner shall, before revoking, amending or revising a code of practice under subsection (1), consult with--

(a) such data users or bodies representative of data users to which the code of practice shall apply, whether in whole or in part; and

(b) such other interested persons,

as the Commissioner thinks fit.

(3) Where any code of practice has been revoked, amended or revised under subsection (1), the Commissioner--

(a) shall enter the particulars of such revocation, amendment or revision in the Register of Codes of Practice; and

(b) shall notify the relevant data user forum, class of data users, data users and the public of such revocation, amendment or revision in such manner as may be determined by him.

(4) The Commissioner shall make available to the public any code of practice as amended or revised by him under this section.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/27.Submission of new code of practice by data user forum

27. Submission of new code of practice by data user forum

(1) A data user forum may submit a new code of practice to replace an existing code of practice.

(2) The new code of practice submitted in pursuance of subsection (1) shall be subject to the provisions of this Division.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/28.Register of Codes of Practice

28. Register of Codes of Practice

(1) The Commissioner shall maintain a Register of Codes of Practice in accordance with section 128.

(2) The Register of Codes of Practice shall contain--

(a) particulars of codes of practice registered under section 23 or 24 and any revocation, amendment or revision to such codes of practice under section 26; and

(b) any opinion made by the Commissioner under section 25, including particulars of withdrawal of previous opinions.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/29.Non-compliance with code of practice

29. Non-compliance with code of practice

A data user who fails to comply with any provision of the code of practice that is applicable to the data user commits an offence and shall, on conviction, be liable to a fine not exceeding one hundred thousand ringgit or to imprisonment for a term not exceeding one year or to both.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/30.Right of access to personal data

Part II PERSONAL DATA PROTECTION

Division 4 Rights of data subject

30. Right of access to personal data

(1) An individual is entitled to be informed by a data user whether personal data of which that individual is the data subject is being processed by or on behalf of the data user.

(2) A requestor may, upon payment of a prescribed fee, make a data access request in writing to the data user--

(a) for information of the data subject's personal data that is being processed by or on behalf of the data user; and

(b) to have communicated to him a copy of the personal data in an intelligible form.

(3) A data access request for any information under subsection (2) shall be treated as a single request, and a data access request for information under paragraph (2)(a) shall, in the absence of any indication to the contrary, be treated as extending also to such request under paragraph (2)(b).

(4) In the case of a data user having separate entries in respect of personal data held for different purposes, a separate data access request shall be made for each separate entry.

(5) Where a data user does not hold the personal data, but controls the processing of the personal data in such a way as to prohibit the data user who holds the personal data from complying, whether in whole or part, with the data access request under subsection (2) which relates to the personal data, the first-mentioned data user shall be deemed to hold the personal data and the provisions of this Act shall be construed accordingly.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/31.Compliance with data access request

31. Compliance with data access request

(1) Subject to subsection (2) and section 32, a data user shall comply with a data access request under section 30 not later than twenty-one days from the date of receipt of the data access request.

(2) A data user who is unable to comply with a data access request within the period specified in subsection (1) shall before the expiration of that period--

(a) by notice in writing inform the requestor that he is unable to comply with the data access request within such period and the reasons why he is unable to do so; and

(b) comply with the data access request to the extent that he is able to do so.

(3) Notwithstanding subsection (2), the data user shall comply in whole with the data access request not later than fourteen days after the expiration of the period stipulated in subsection (1).

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/32.Circumstances where data user may refuse to comply with data access request

32. Circumstances where data user may refuse to comply with data access request

(1) A data user may refuse to comply with a data access request under section 30 if--

(a) the data user is not supplied with such information as he may reasonably require--

(i) in order to satisfy himself as to the identity of the requestor; or

(ii) where the requestor claims to be a relevant person, in order to satisfy himself--

(A) as to the identity of the data subject in relation to whom the requestor claims to be the relevant person; and

(B) that the requestor is the relevant person in relation to the data subject;

(b) the data user is not supplied with such information as he may reasonably require to locate the personal data to which the data access request relates;

(c) the burden or expense of providing access is disproportionate to the risks to the data subject's privacy in relation to the personal data in the case in question;

(d) the data user cannot comply with the data access request without disclosing personal data relating to another individual who can be identified from that information, unless--

(i) that other individual has consented to the disclosure of the information to the requestor; or

(ii) it is reasonable in all the circumstances to comply with the data access request without the consent of the other individual;

(e) subject to subsection (3), any other data user controls the processing of the personal data to which the data access request relates in such a way as to prohibit the first-mentioned data user from complying, whether in whole or in part, with the data access request;

(f) providing access would constitute a violation of an order of a court;

(g) providing access would disclose confidential commercial information; or

(h) such access to personal data is regulated by another law.

(2) In determining for the purposes of subparagraph (1)(d)(ii) whether it is reasonable in all the circumstances to comply with the data access request without the consent of the other individual, regard shall be had, in particular, to--

(a) any duty of confidentiality owed to the other individual;

(b) any steps taken by the data user with a view to seeking the consent of the other individual;

(d) any express refusal of consent by the other individual.

(3) Paragraph (1)(e) shall not operate so as to excuse the data user from complying with the data access request under subsection 30(2) to any extent that the data user can comply with the data access request without contravening the prohibition concerned.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/33.Notification of refusal to comply with data access request

33. Notification of refusal to comply with data access request

Where a data user who pursuant to section 32 refuses to comply with a data access request under section 30, he shall, not later than twenty-one days from the date of receipt of the data access request, by notice in writing, inform the requestor--

(a) of the refusal and the reasons for the refusal; and

(b) where paragraph 32(1)(e) is applicable, of the name and address of the other data user concerned.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/34.Right to correct personal data

34. Right to correct personal data

(1) Where--

(a) a copy of the personal data has been supplied by the data user in compliance with the data access request under section 30 and the requestor considers that the personal data is inaccurate, incomplete, misleading or not up-to-date; or

(b) the data subject knows that his personal data being held by the data user is inaccurate, incomplete, misleading or not up-to-date,

the requestor or data subject, as the case may be, may make a data correction request in writing to the data user that the data user makes the necessary correction to the personal data.

(2) Where a data user does not hold the personal data, but controls the processing of the personal data in such a way as to prohibit the data user who holds the personal data from complying, whether in whole or in part, with the data correction request under subsection (1) which relates to the personal data, the first-mentioned data user shall be deemed to be the data user to whom such a request may be made and the provisions of this Act shall be construed accordingly.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/35.Compliance with data correction request

35. Compliance with data correction request

(1) Subject to subsections (2), (3) and (5) and section 36, where a data user is satisfied that the personal data to which a data correction request relates is inaccurate, incomplete, misleading or not up-to-date, he shall, not later than twenty-one days from the date of receipt of the data correction request--

(a) make the necessary correction to the personal data;

(b) supply the requestor with a copy of the personal data as corrected; and

(i) the personal data has been disclosed to a third party during the twelve months immediately preceding the day on which the correction is made; and

(ii) the data user has no reason to believe that the third party has ceased using the personal data for the purpose, including any directly related purpose, for which the personal data was disclosed to the third party, take all practicable steps to supply the third party with a copy of the personal data as so corrected accompanied by a notice in writing stating the reasons for the correction.

(2) A data user who is unable to comply with a data correction request within the period specified in subsection (1) shall before the expiration of that period--

(a) by notice in writing inform the requestor that he is unable to comply with the data correction request within such period and the reasons why he is unable to do so; and

(b) comply with the data correction request to the extent that he is able to do so.

(3) Notwithstanding subsection (2), the data user shall comply in whole with the data correction request not later than fourteen days after the expiration of the period stipulated in subsection (1).

(4) A data user is not required to comply with paragraph (1)(c) in any case where the disclosure of the personal data to a third party consists of the third party's own inspection of a register--

(a) in which the personal data is entered or otherwise recorded; and

(b) which is available for inspection by the public.

(5) Where a data user is requested to correct personal data under subsection 34(1) and the personal data is being processed by another data user that is in a better position to respond to the data correction request--

(a) the first-mentioned data user shall immediately transfer the data correction request to such data user, and notify the requestor of this fact; and

(b) sections 34, 35, 36 and 37 shall apply as if the references therein to a data user were references to such other data user.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/36.Circumstances where data user may refuse to comply with data correction request

36. Circumstances where data user may refuse to comply with data correction request

(1) A data user may refuse to comply with a data correction request under section 34 if--

(a) the data user is not supplied with such information as he may reasonably require--

(i) in order to satisfy himself as to the identity of the requestor; or

(ii) where the requestor claims to be a relevant person, in order to satisfy himself--

(A) as to the identity of the data subject in relation to whom the requestor claims to be the relevant person; and

(B) that the requestor is the relevant person in relation to the data subject;

(b) the data user is not supplied with such information as he may reasonably require to ascertain in what way the personal data to which the data correction request relates is inaccurate, incomplete, misleading or not up-to-date;

(c) the data user is not satisfied that the personal data to which the data correction request relates is inaccurate, incomplete, misleading or not up-to-date;

(d) the data user is not satisfied that the correction which is the subject of the data correction request is accurate, complete, not misleading or up-to-date; or

(e) subject to subsection (2), any other data user controls the processing of the personal data to which the data correction request relates in such a way as to prohibit the first-mentioned data user from complying, whether in whole or in part, with the data correction request.

(2) Paragraph (1)(e) shall not operate so as to excuse the data user from complying with subsection 35(1) in relation to the data correction request to any extent that the data user can comply with that subsection without contravening the prohibition concerned.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/37.Notification of refusal to comply with data correction request

37. Notification of refusal to comply with data correction request

(1) Where a data user who pursuant to section 36 refuses to comply with a data correction request under section 34, he shall, not later than twenty-one days from the date of receipt of the data correction request, by notice in writing, inform the requestor--

(a) of the refusal and the reasons for the refusal; and

(b) where paragraph 36(1)(e) is applicable, of the name and address of the other data user concerned.

(2) Without prejudice to the generality of subsection (1), where personal data to which the data correction request relates is an expression of opinion and the data user is not satisfied that the expression of opinion is inaccurate, incomplete, misleading or not up-to-date, the data user shall--

(a) make a note, whether annexed to the personal data or elsewhere--

(i) of the matters in respect of which the expression of opinion is considered by the requestor to be inaccurate, incomplete, misleading or not up-to-date; and

(ii) in such a way that the personal data cannot be used by any person without the note being drawn to the attention of and being available for inspection by that person; and

(b)attach a copy of the note to the notice referred to in subsection (1) which relates to the data correction request.

(3) In this section, "expression of opinion" includes an assertion of fact which is unverifiable or in all circumstances of the case is not practicable to verify.

(4) A data user who contravenes subsection (2) commits an offence and shall, on conviction, be liable to a fine not exceeding one hundred thousand ringgit or to imprisonment for a term not exceeding one year or to both.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/38.Withdrawal of consent to process personal data

38. Withdrawal of consent to process personal data

(1) A data subject may by notice in writing withdraw his consent to the processing of personal data in respect of which he is the data subject.

(2) The data user shall, upon receiving the notice under subsection (1), cease the processing of the personal data.

(3) The failure of the data subject to exercise the right conferred by subsection (1) does not affect any other rights conferred on him by this Part.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/39.Extent of disclosure of personal data

39. Extent of disclosure of personal data

Notwithstanding section 8, personal data of a data subject may be disclosed by a data user for any purpose other than the purpose for which the personal data was to be disclosed at the time of its collection or any other purpose directly related to that purpose, only under the following circumstances:

(a) the data subject has given his consent to the disclosure;

(b) the disclosure --

(i) is necessary for the purpose of preventing or detecting a crime, or for the purpose of investigations; or

(ii) was required or authorized by or under any law or by the order of a court;

(c) the data user acted in the reasonable belief that he had in law the right to disclose the personal data to the other person;

(d) the data user acted in the reasonable belief that he would have had the consent of the data subject if the data subject had known of the disclosing of the personal data and the circumstances of such disclosure; or

(e) the disclosure was justified as being in the public interest in circumstances as determined by the Minister.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/40.Processing of sensitive personal data

40. Processing of sensitive personal data

(1) Subject to subsection (2) and section 5, a data user shall not process any sensitive personal data of a data subject except in accordance with the following conditions:

(a) the data subject has given his explicit consent to the processing of the personal data;

(b) the processing is necessary--

(i) for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data user in connection with employment;

(ii) in order to protect the vital interests of the data subject or another person, in a case where--

(A) consent cannot be given by or on behalf of the data subject; or

(B) the data user cannot reasonably be expected to obtain the consent of the data subject;

(iii) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unreasonably withheld;

(iv) for medical purposes and is undertaken by--

(A) a healthcare professional; or

(B) a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a healthcare professional;

(v) for the purpose of, or in connection with, any legal proceedings;

(vi) for the purpose of obtaining legal advice;

(vii) for the purposes of establishing, exercising or defending legal rights;

(viii) for the administration of justice;

(ix) for the exercise of any functions conferred on any person by or under any written law; or

(x) for any other purposes as the Minister thinks fit; or

(c) the information contained in the personal data has been made public as a result of steps deliberately taken by the data subject.

(2) The Minister may by order published in the Gazette exclude the application of subparagraph (1)(b)(i), (viii) or (ix) in such cases as may be specified in the order, or provide that, in such cases as may be specified in the order, the condition in subparagraph (1)(b)(i), (viii) or (ix) is not to be regarded as satisfied unless such further conditions as may be specified in the order are also satisfied.

(3) A person who contravenes subsection (1) commits an offence and shall, on conviction, be liable to a fine not exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.

(4) For the purposes of this section--

"medical purposes"

includes the purposes of preventive medicine, medical diagnosis, medical research, rehabilitation and the provision of care and treatment and the management of healthcare services;

"healthcare services"

has the meaning assigned to it in the Private Healthcare Facilities and Services Act 1998 [Act 586];

"healthcare professional"

means a medical practitioner, dental practitioner, pharmacist, clinical psychologist, nurse, midwife, medical assistant, physiotherapist, occupational therapist and other allied healthcare professionals and any other person involved in the giving of medical, health, dental, pharmaceutical and any other healthcare services under the jurisdiction of the Ministry of Health.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/41.Repeated collection of personal data in same circumstances

41. Repeated collection of personal data in same circumstances

(1) Where a data user-

(a) has complied with the provisions of the Notice and Choice Principle under section 7 in respect of the collection of personal data from the data subject, referred to as the "first collection"; and

(b) on any subsequent occasion again collects personal data from that data subject, referred to as the "subsequent collection",

the data user is not required to comply with the provisions of the Notice and Choice Principle in respect of the subsequent collection if--

(A) to comply with those provisions in respect of that subsequent collection would be to repeat, in the same circumstances, what was done to comply with that principle in respect of the first collection; and

(B)not more than twelve months have elapsed between the first collection and the subsequent collection.

(2) For the avoidance of doubt, it is declared that subsection (1) shall not operate to prevent a subsequent collection from becoming a first collection if the data user concerned has complied with the provisions of the Notice and Choice Principle in respect of the subsequent collection.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/42.Right to prevent processing likely to cause damage or distress

42. Right to prevent processing likely to cause damage or distress

(1) Subject to subsection (2), a data subject may, at any time by notice in writing to a data user, referred to as the "data subject notice", require the data user at the end of such period as is reasonable in the circumstances, to--

(a) cease the processing of or processing for a specified purpose or in a specified manner; or

(b) not begin the processing of or processing for a specified purpose or in a specified manner,

any personal data in respect of which he is the data subject if, based on reasons to be stated by him--

(A) the processing of that personal data or the processing of personal data for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another person; and

(B) the damage or distress is or would be unwarranted.

(2) Subsection (1) shall not apply where--

(a) the data subject has given his consent;

(b) the processing of personal data is necessary--

(i) for the performance of a contract to which the data subject is a party;

(ii) for the taking of steps at the request of the data subject with a view to entering a contract;

(iii) for compliance with any legal obligation to which the data user is the subject, other than an obligation imposed by contract; or

(iv) in order to protect the vital interests of the data subject; or

(3) The data user shall, within twenty-one days from the date of receipt of the data subject notice under subsection (1), give the data subject a written notice--

(a) stating that he has complied or intends to comply with the data subject notice; or

(b) stating his reasons for regarding the data subject notice as unjustified, or to any extent unjustified, and the extent, if any, to which he has complied or intends to comply with it.

(4) Where the data subject is dissatisfied with the failure of the data user to comply with the data subject notice, whether in whole or in part, under paragraph (3)(b), the data subject may submit an application to the Commissioner to require the data user to comply with the data subject notice.

(5) Where the Commissioner is satisfied that the application of the data subject under subsection (4) is justified or justified to any extent, the Commissioner may require the data user to take such steps for complying with the data subject notice.

(6) A data user who fails to comply with the requirement of the Commissioner under subsection (5) commits an offence and shall, on conviction, be liable to a fine not exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/43.Right to prevent processing for purposes of direct marketing

43. Right to prevent processing for purposes of direct marketing

(1) A data subject may, at any time by notice in writing to a data user, require the data user at the end of such period as is reasonable in the circumstances to cease or not to begin processing his personal data for purposes of direct marketing.

(2) Where the data subject is dissatisfied with the failure of the data user to comply with the notice, whether in whole or in part, under subsection (1), the data subject may submit an application to the Commissioner to require the data user to comply with the notice.

(3) Where the Commissioner is satisfied that the application of the data subject under subsection (2) is justified or justified to any extent, the Commissioner may require the data user to take such steps for complying with the notice.

(4) A data user who fails to comply with the requirement of the Commissioner under subsection (3) commits an offence and shall, on conviction, be liable to a fine not exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.

(5) For the purposes of this section, "direct marketing" means the communication by whatever means of any advertising or marketing material which is directed to particular individuals.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/44.Record to be kept by data user

44. Record to be kept by data user

(1) A data user shall keep and maintain a record of any application, notice, request or any other information relating to personal data that has been or is being processed by him.

(2) The Commissioner may determine the manner and form in which the record is to be maintained.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/45.Exemption

Part III EXEMPTION

45. Exemption

(1) There shall be exempted from the provisions of this Act personal data processed by an individual only for the purposes of that individual's personal, family or household affairs, including recreational purposes.

(2) Subject to section 46, personal data--

(a) processed for--

(i) the prevention or detection of crime or for the purpose of investigations;

(ii) the apprehension or prosecution of offenders; or

(iii) the assessment or collection of any tax or duty or any other imposition of a similar nature,

shall be exempted from the General Principle, Notice and Choice Principle, Disclosure Principle and Access Principle and other related provisions of this Act;

(b) processed in relation to information of the physical or mental health of a data subject shall be exempted from the Access Principle and other related provisions of this Act of which the application of the provisions to the data subject would be likely to cause serious harm to the physical or mental health of the data subject or any other individual;

(c) processed for preparing statistics or carrying out research shall be exempted from the General Principle, Notice and Choice Principle, Disclosure Principle and Access Principle and other related provisions of this Act, provided that such personal data is not processed for any other purpose and that the resulting statistics or the results of the research are not made available in a form which identifies the data subject;

(d) that is necessary for the purpose of or in connection with any order or judgement of a court shall be exempted from the General Principle, Notice and Choice Principle, Disclosure Principle and Access Principle and other related provisions of this Act;

(e) processed for the purpose of discharging regulatory functions shall be exempted from the General Principle, Notice and Choice Principle, Disclosure Principle and Access Principle and other related provisions of this Act if the application of those provisions to the personal data would be likely to prejudice the proper discharge of those functions; or

(f) processed only for journalistic, literary or artistic purposes shall be exempted from the General Principle, Notice and Choice Principle, Disclosure Principle, Retention Principle, Data Integrity Principle and Access Principle and other related provisions of this Act, provided that--

(i) the processing is undertaken with a view to the publication by any person of the journalistic, literary or artistic material;

(ii) the data user reasonably believes that, taking into account the special importance of public interest in freedom of expression, the publication would be in the public interest; and

(iii) the data user reasonably believes that in all the circumstances, compliance with the provision in respect of which the exemption is claimed is incompatible with the journalistic, literary or artistic purposes.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/46.Power to make further exemptions

46. Power to make further exemptions

(1) The Minister may, upon the recommendation of the Commissioner, by order published in the Gazette exempt--

(a) the application of any of the Personal Data Protection Principles under this Act to any data user or class of data users; or

(b) any data user or class of data users from all or any of the provisions of this Act.

(2) The Minister may impose any terms or conditions as he thinks fit in respect of any exemption made under subsection (1).

(3) The Minister may at any time, on the recommendation of the Commissioner, by order published in the Gazette, revoke any order made under subsection (1).

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/47.Appointment of Commissioner

Part IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER

47. Appointment of Commissioner

(1) The Minister shall appoint any person as the "Personal Data Protection Commissioner" for the purposes of carrying out the functions and powers assigned to the Commissioner under this Act on such terms and conditions as he thinks desirable.

(2) The appointment of the Commissioner shall be published in the Gazette.

(3) The Commissioner appointed under subsection (1) shall be a body corporate having perpetual succession and a common seal.

(4) The Commissioner may sue and be sued in his corporate name.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/48.Functions of Commissioner

48. Functions of Commissioner

The Commissioner shall have the following functions:

(a) to advise the Minister on the national policy for personal data protection and all other related matters;

(b) to implement and enforce the personal data protection laws, including the formulation of operational policies and procedures;

(c) to promote and encourage associations or bodies representing data users to prepare codes of practice and to disseminate to their members the codes of practice for the purposes of this Act;

(d) to cooperate with bodies corporate or government agencies for the purpose of performing his functions;

(e) to determine in pursuance of section 129 whether any place outside Malaysia has in place a system for the protection of personal data that is substantially similar to that as provided for under this Act or that serves the same purposes as this Act;

(f) to undertake or cause to be undertaken research into and monitor developments in the processing of personal data, including technology, in order to take account any effects such developments may have on the privacy of individuals in relation to their personal data;

(g) to monitor and supervise compliance with the provisions of this Act, including the issuance of circulars, enforcement notices or any other instruments to any person;

(h) to promote awareness and dissemination of information to the public about the operation of this Act;

(i) to liaise and cooperate with persons performing similar personal data protection functions in any place outside Malaysia in respect of matters of mutual interest, including matters concerning the privacy of individuals in relation to their personal data;

(j) to represent Malaysia through participation in events that relate to personal data protection as authorized by the Minister, whether within or outside Malaysia; and

(k) to carry out such activities and do such things as are necessary, advantageous and proper for the administration of this Act, or such other purposes consistent with this Act as may be directed by the Minister.

Unannotated Statutes of Malaysia - Principal Acts/PERSONAL DATA PROTECTION ACT 2010 Act 709/PERSONAL DATA PROTECTION ACT 2010 ACT 709,,/49.Powers of Commissioner