What does Malaysia’s PDPA require of the documents you store?

Key takeaways

• Act 709 sets seven principles, all under section 5(1); the Security Principle and the Storage Principle govern documents you already hold (Personal Data Protection Commissioner).
• The Personal Data Protection Standard 2015 turns that principle into 14 numbered items for electronic records and a separate list of nine for paper ones, including an access record the Commissioner can call for.
• The same Standard requires disposal of collection forms within not more than 14 days where they carry no legal value, and a disposal schedule for inactive data with a 24 month period.
• Sections 12A and 12B of Act 709, on data protection officers and breach notification, came into operation on 1 June 2025 under gazette notice P.U.(B) 522.
• Our new Docuflo Data Loss Prevention (DLP) module helps put data protection controls into practice. It does not, by itself, make an organisation PDPA-compliant.

Which of your documents does the PDPA actually cover?

Malaysia’s PDPA document requirements reach any document holding personal data processed in connection with a commercial transaction: customer files, claim forms, supplier contacts, scanned identity documents, and the spreadsheets exported from those systems. Seven principles apply under section 5(1) of Act 709, and two of them speak to documents in storage rather than to collection.

The Commissioner states the Security Principle as a duty to “take steps to ensure that the data is secure, not modified, misused or given to unauthorized parties”, and the Storage Principle as a rule that “personal data is not allowed to be stored in a processing for more than the necessary time limit”. The Commissioner’s page on the application of the Act records one limit worth knowing: Act 709 does not apply to the Federal Government and the State Government.

To talk about document management, access control or retention in your organisation, email sales@infoconnect.com.my or use the contact page.

What does the Security Standard require of an electronic document store?

The Personal Data Protection Standard 2015 turns the Security Principle into 14 numbered items for personal data processed electronically. Several are system requirements rather than policy statements. Items 2 to 5 alone require employee access to be controlled and limited, user IDs issued to authorised staff, and those IDs ended immediately when an employee no longer handles the data.

Item 12 is the item a plain shared folder rarely satisfies: unless auditing has been switched on and its logs are kept, there is no per-document record of who opened what. Our Docuflo document management system keeps audit trails and applies role-based and folder/document-level access controls and encryption, and its new Data Loss Prevention module adds controls on how sensitive documents are shared, as the next section explains.

Items 9 and 10 reach past the repository: transfers of personal data through removable media and cloud services need written consent from an officer authorised by top management, and every such transfer has to be recorded. In our data masking work, non-production environments, third-party access and insider threats are the often-overlooked sources of leakage; static masking gives a masked copy for non-production use, and dynamic masking hides data at query time by the user’s role.

How does Docuflo’s Data Loss Prevention module support PDPA compliance?

Our Docuflo Data Loss Prevention (DLP) module can support compliance with Malaysia’s Personal Data Protection Act 2010, as amended, by helping organisations reduce the risk of unauthorised access, sharing, disclosure and loss of personal data stored in or managed through Docuflo. DLP helps operationalise data protection controls. It does not, by itself, make an organisation PDPA-compliant.

These alignments reflect the PDPA’s personal data protection principles and the security, storage limitation and accountability requirements relevant to organisations handling personal data.

What does the Standard require of paper files and physical archives?

The Standard 2015 sets a separate list of nine items for personal data processed non-electronically. Employees are registered in a system or registration book before being allowed access, files are stored in a locked place, a record is kept of where the keys are, and the same periodic access record applies to the paper archive.

• Transfers sent conventionally, through mail, delivery or fax, have to be recorded.
• Used papers and printed documents showing personal data are destroyed thoroughly, by shredding or another appropriate method.
• Employee access to the files is controlled and limited, and ends on resignation, termination or a change in the organisation.

These items apply to personal data processed non-electronically, so a file that is still on paper is covered by them, and the Standard requires its destruction to be done thoroughly. Governing the information is therefore a question about both halves of the archive, not only the digital one.

How long may you keep documents that contain personal data?

The PDPA sets no single retention period. The Standard 2015 requires a data user to keep personal data no longer than necessary unless other legal provisions require longer, to check those periods before destroying anything, and to maintain a record of disposal produced when the Commissioner directs. Those periods come from the other legislation the Standard tells a data user to check, not from Act 709, and this article does not list them.

Two of the Standard’s retention items carry hard numbers. The first is disposal of personal data collection forms used in commercial transactions “within the period not exceeding fourteen (14) days”, unless the forms carry legal value in relation to that transaction. The second is a standing instruction to “prepare a personal data disposal schedule for inactive data with a 24 month period”, maintained properly. In practice that means a retention rule per document type, applied by the system holding the documents, with each disposal written down.

Who must appoint a data protection officer, and by when?

Section 12A of Act 709 has applied since 1 June 2025, and requires a data controller to “appoint one or more data protection officers who shall be accountable to the data controller for the compliance with this Act”. Circular 1/2025 of the Personal Data Protection Commissioner sets when that duty bites: personal data of more than 20,000 data subjects, sensitive personal data including financial information of more than 10,000 data subjects, or any activity requiring regular and systematic monitoring.

The duty reaches processors too: section 12A(2) requires a data processor to appoint its own officer, and an appointed officer is registered with the Commissioner within twenty-one days. A practical measure of that appointment is whether the officer can answer three questions about any file: who may open it, who did open it, and when it is due for disposal. An audit trail helps here: it promotes compliance and accountability and simplifies document tracking.

What does the 72-hour breach rule mean for your documents?

Section 12B requires a data controller with reason to believe a personal data breach has occurred to notify the Commissioner as soon as practicable. The February 2025 guideline sets the outer limit in paragraph 6.1: no later than seventy-two hours from the occurrence of the personal data breach. Paragraph 6.2 works that out in practice from the point the controller is informed of or detects a security incident and investigates whether a breach has actually occurred. Failing to notify is an offence carrying a fine of up to two hundred and fifty thousand ringgit, up to two years’ imprisonment, or both.

1. Contain it: isolate the affected repository and suspend the access rights involved.
2. Establish scope from the system itself: which documents, whose personal data, how many records.
3. Submit the notification inside the 72 hours, through the form on the JPDP website or the Annex B form by email or hard copy.
4. Tell affected individuals, in language they can act on, where the breach is likely to cause them significant harm, no later than seven days after the Commissioner was notified.

The incident then goes into the breach register, which the guideline makes a standing obligation rather than an incident artefact. A data controller must “keep records and maintain a register detailing personal data breach for a period of at least two (2) years from the date of the notification to the Commissioner, including those that did not meet the notification criteria”.

“The data controller is free to determine what method and format to use when documenting the breach, provided that the documentation is in such a way that is clear, concise and enables the Commissioner to verify that the data controller has complied with this documentation requirement.”

Source: Personal Data Protection Commissioner, Guideline on Personal Data Protection: Data Breach Notification, February 2025, paragraph 14.2

Frequently asked questions

What does Data Loss Prevention do in a document management system?

In Docuflo, DLP policies can help identify documents that hold personal or sensitive personal data and restrict their unauthorised sharing, downloading, exporting or distribution, where the relevant controls are supported and configured. DLP works alongside role-based and document-level security, and alongside retention policies, which deal with not keeping personal data longer than necessary.

How can a document system help when a breach is suspected?

It shows from the system itself which documents were involved, whose personal data they hold and who opened them, through the access record and audit trails. Where DLP event logging and audit integration are available, security teams can also trace the relevant activities and gather evidence for internal reviews and incident response.

What happens if we miss the 72-hour deadline?

Where a data controller fails to notify in time, a written notice must be submitted to the Commissioner setting out the reasons for the delay with supporting evidence, which the guideline says should include the incident timeline, internal communications, and any technical issues or external factors involved.

Does a document management system make us PDPA-compliant?

No single system does, and that includes our DLP module: it helps put data protection controls into practice but does not, by itself, make an organisation PDPA-compliant. The duties under Act 709 mostly sit with the data controller, including appointing a data protection officer and contracting with processors. What a document system can do is produce the evidence the rules ask for: the register of who may process personal data, the access record, the disposal record, and the history behind a breach register entry.

Sources

1. Principles of Personal Data Protection, Personal Data Protection Commissioner (JPDP)
2. Application and Non-Application of the Act, Personal Data Protection Commissioner
3. Personal Data Protection Standard 2015 (PDF)
4. Personal Data Protection (Amendment) Act 2024 [Act A1727] (PDF)
5. Appointment of Date of Coming into Operation, P.U.(B) 522 (PDF), 24 December 2024
6. Circular 1/2025 of the Personal Data Protection Commissioner (PDF), on data protection officers
7. Guideline on Personal Data Protection: Data Breach Notification (PDF), February 2025

Talk to InfoConnect

We have provided information and content management solutions since 1994, from our head office in Petaling Jaya, Selangor. To talk about document management, workflow or data governance for your organisation, contact our sales team.

Email sales@infoconnect.com.my Call +603-7722 2001 Contact page

Existing customers can reach our support team at support@infoconnect.com.my.