Under Malaysia's amended PDPA, your AI vendor carries duties of its own, and the Act leaves the speed of its breach alert to your contract. A vendor that handles personal data for you must meet the security rule itself and appoint a data protection officer. Only you, the data controller, must tell the Commissioner about a breach. This post is for owners and COOs with Malaysian customers. It is general information, not legal advice.
The amending law is the Personal Data Protection (Amendment) Act 2024, Act A1727, which received Royal Assent on 9 October 2024 and was gazetted on 17 October 2024. We read the Act's text. Section 1(2) says the Act starts on dates the Minister appoints by gazette notice, and different provisions may start on different dates. The Minister of Digital's notice, P.U. (B) 522, published in the Federal Gazette on 24 December 2024, set three dates: sections 7, 11, 13 and 14 on 1 January 2025; sections 2, 3, 4, 5, 8, 10 and 12 on 1 April 2025; and sections 6 and 9 on 1 June 2025. In this post that means the processor security duty (section 4) and the amended Security Principle wording (section 5) have applied since 1 April 2025. The data protection officer and breach notification duties (section 6) have applied since 1 June 2025.
At a glance: what the amended Malaysian PDPA says about processors and breaches
Figures from the text of Act A1727 (gazetted 17 October 2024) and the PDPA 2010 reprint.
Who has to do what under the amended Act?
The amended Act gives the controller, the firm that decides why data is used, and the processor, the firm that handles it on the controller's behalf, separate duties. The 2016 reprint of the old Act calls controllers "data users". Section 2 of Act A1727 replaces "data user" with "data controller" wherever it appears, except in the definition of "register" and in section 9, which section 5 amends in its own words. The Act also puts duties on processors directly. Where this post quotes the 2016 reprint, it keeps the 2016 wording and says so. The table lists each duty and whom the text names.
| Duty | Controller (you) | Processor (your AI vendor) |
|---|---|---|
| Meet the Security Principle | Section 9(1) | Section 5(1a) and section 9, as amended |
| Appoint data protection officers | Section 12A(1): one or more | Section 12A(2): one or more |
| Tell the Commissioner who the officer is | Section 12A(3) | Not stated |
| Tell the Commissioner of a breach | Section 12B(1) | Not named |
| Tell affected people if significant harm | Section 12B(2) | Not named |
| Penalty for contravening | Up to 2 years in prison for the breach notice, section 12B(3) | Up to 3 years in prison for the Security Principle, section 5(2) |
Reading the table, the text assigns the notice duties to you and the security and officer duties to both of you. Section 12A(4) adds that appointing an officer "shall not discharge the data controller or data processor from all duties and functions under this Act". The fine ceilings rose too, and the Act states them in ringgit, which we leave to the source.
The Ministry of Digital described the change in a speech on 14 October 2024, in its published text. It says the amendments introduced "mandatory data breach notifications" and "a Data Protection Officer role". The same speech says the Act was amended "in July 2024". We do not use that date. The Act itself shows Royal Assent on 9 October 2024 and gazette publication on 17 October 2024.
Interactive chart
The longest prison term for a principle breach went from 2 to 3 years
Longest prison term in years for two offences: breaking a principle, before and after the amendment, and failing to notify a breach.
Breaking a data protection principle, before the amendment: 2 years. After: 3 years. Failing to notify the Commissioner of a breach: 2 years.
| Offence | Years |
|---|---|
| Principle, before | 2 |
| Principle, after | 3 |
| Breach notice | 2 |
Does the breach clock apply to your AI vendor?
The Act's clock runs for the controller, and its wording is "as soon as practicable", not a number of hours. Section 12B(1) is short.
Where a data controller has reason to believe that a personal data breach has occurred, the data controller shall, as soon as practicable, notify the Commissioner in the manner and form as determined by the Commissioner.
Personal Data Protection (Amendment) Act 2024 (Act A1727), section 6, inserting section 12B(1), Laws of Malaysia, gazetted 17 October 2024.
Three things follow from that text. The trigger is "reason to believe", which can arrive before you know the cause. The form and manner are for the Commissioner to determine, so any hours or fields sit outside the Act's text. And the sentence names the controller only. If your vendor sees the breach first, the Act does not say how fast it must tell you. The Commissioner's guideline fills part of that gap. It says the 72 hours start when the vendor tells you, or when you have clear evidence of the breach yourself, whichever is earlier (paragraph 6.2, example v). It also says the Act's notice duty does not apply to processors directly, and that you must bind the vendor by contract to tell you promptly and give you reasonable help (paragraphs 12.1 and 12.2).
You may have read that the deadline is a fixed number of hours. The Act's text sets no number; the number comes from the Commissioner's Data Breach Notification Guideline, issued 25 February 2025. It sets 72 hours for the notice to the Commissioner and, where individuals must be told, seven days after that notice. Paragraph 6.1 says notify "as soon as practicable and no later than" 72 hours, so 72 is a ceiling, not a target. Paragraph 7.7 says a late notice needs written reasons and supporting evidence. Read both before you write a number into a contract. The Act itself still says "as soon as practicable".
Section 12B(2) adds a second duty. If the breach "causes or likely to cause any significant harm to the data subject", you tell the person without unnecessary delay, again in the form the Commissioner sets. Section 4 of the PDPA, as amended by section 3 of Act A1727, defines a personal data breach as "any breach of personal data, loss of personal data, misuse of personal data or unauthorized access of personal data". Misuse and loss are inside it. Not every breach goes to the Commissioner: under paragraph 5.1 of the guideline, you notify only when it causes or is likely to cause significant harm. The Act does not define significant harm; the guideline does (paragraph 5.2). It covers a risk of physical harm, financial loss, harm to credit records or property, misuse for illegal purposes, sensitive personal data, data that could enable identity fraud when combined, and a breach of significant scale, which paragraph 5.3 sets at more than 1,000 people. The scale test applies only to the notice to the Commissioner, not to telling individuals (paragraph 8.2). The guideline also asks you to keep a register of every breach, including those you did not have to report, for at least two years (paragraph 14.1).
How a breach at your AI vendor reaches the regulator, and who owes what
Top row: the path. Green: written in the Act. Dashed amber: left to your contract.
The diagram shows the gap. Between the vendor finding a breach and you hearing of it, the Act is silent and the guideline requires you to oblige the vendor by contract to tell you promptly (paragraph 12.2). Putting a number of hours into that clause is how you make "promptly" something you can check.
What must the vendor do, and is it a processor?
Under the amended Act, an AI vendor that is a processor must meet the Security Principle itself and appoint a data protection officer. Section 5(1a), inserted by section 4 of Act A1727, reads: "Where the processing of personal data is carried out by a data processor on behalf of the data controller, the data processor shall comply with the Security Principle as specified in section 9." Section 12A(2) adds the officer: the processor "shall appoint one or more data protection officers who shall be accountable to the data processor for the compliance with this Act".
Before the amendment, the security duty reached the vendor through you. Section 9(2) of the 2016 reprint of the Act says, in the 2016 wording, that the "data user shall ... ensure that the data processor" provides sufficient guarantees on security and takes reasonable steps to comply. Section 5 of Act A1727 replaces "the data user, the data user shall," with "a data controller, the data processor shall," and deletes the words ", ensure that the data processor". Our reading of those amending words is that the vendor's guarantees and reasonable steps become its own duty. We have not seen a consolidated reprint to confirm it. You can still be asked what you did about it, because the Security Principle in section 9(1) remains yours too.
Two points are easy to miss. First, the Act does not tell you what the officer must do for you, and it sets no qualification. Second, a vendor's own officer does not replace your own. Section 12A(1) applies to you whether or not your vendor has one.
Is your AI vendor a processor at all?
Only a firm that handles your data solely on your behalf is a processor, so the label turns on what the vendor does with the data. The 2016 reprint defines a data processor, in its 2016 wording, as "any person, other than an employee of the data user, who processes the personal data solely on behalf of the data user, and does not process the personal data for any of his own purposes". Act A1727 section 2 replaces "data user" with "data controller" in that definition, so the test becomes handling data solely on behalf of the data controller.
That matters for AI tools. A transcription service that keeps your calls only to give you the transcript fits the definition. A chatbot vendor that also uses your customers' messages to train a model it sells to others is processing for a purpose of its own. Whether that makes it a controller, and what follows, is a question for your lawyer. The practical point is that a vendor can look like a processor on the invoice and not on the facts. Ask.
Illustrative example: a Kuala Lumpur retailer uses an AI chat tool on its website. The vendor's terms let it use chat logs to improve its products. The retailer asks three questions: is the vendor a processor for our chat data, who is its officer, and how soon will it tell us of a breach? The vendor answers the second and third but is vague on the first. That is the cue to go back to the contract before the next campaign.
Check your vendor contract
Seven contract clauses turn a silent Act and a guideline that says "promptly" into something you can enforce. A plain version of the first one: the vendor tells you of any suspected personal data breach within the number of hours you choose, and says what happened, which data and which customers. They are a design check from Origin Pi, drawn from the sections above, not a legal test. Tick what the contract says today.
Vendor contract check
Does your AI vendor contract cover the amended PDPA?
Tick what is true now. Heavier items count more. A guide, not an audit. Nothing you enter leaves your browser.
- 0 to 39%: Exposed. The contract leaves the breach path to chance.
- 40 to 74%: Partly covered. Some clauses exist. Close the heaviest gaps first.
- 75% and above: Covered. Recheck when the Commissioner changes what it requires.
Weights are illustrative. Total 15 points. A design check drawing on Act A1727, not a compliance test.
Build your own breach clock
The guideline's 72 hours run from when the vendor tells you or you have clear evidence yourself, whichever is earlier, so a slow vendor alert uses up time you may not get back. Notice is still due as soon as practicable, and 72 hours is the outer limit. The Act's wording is "as soon as practicable", and the Commissioner's guideline sets 72 hours for the notice to the Commissioner, counted from the vendor's report or your own clear evidence, whichever is earlier. The builder below does not state a legal limit. You set your own target for the whole path, from the vendor seeing the breach to your notice, and see how much of it the vendor's window uses.
Breach clock builder
How much of your target does the vendor's window use?
Hours until you could notify = hours until the vendor tells you + hours for you to review and decide. Spare hours = your target minus that total. Share used = total divided by target, as a percentage.
The defaults are illustrative, not a legal limit and not a measured vendor window. Pick your own target for the whole path, from the vendor seeing the breach to your notice. The legal 72 hours count from the vendor's alert or your own clear evidence, whichever is earlier, so keep your own review time well inside 72 hours whatever target you set. Nothing you enter leaves your browser.
If the bar passes 100%, the whole path is longer than your target. Shorten the vendor window in the contract, shorten your own review, or accept that the target is not realistic.
What this does not tell you
Three things sit outside this post, and each changes how you act. The Commissioner's separate guideline on data protection officers sets who must appoint one and how to register, and this post does not cover it, so check it for your firm. The dates above come from the commencement notice and the 72-hour and seven-day periods from the breach guideline; the Act itself sets neither. And we have not tested any of this in a court or with the regulator.
Where Origin Pi stands
We treat a vendor's breach alert as a design problem. Origin Pi designs AI systems so that logs, bounded permissions and a confirm step let you reconstruct what happened and tell the right person quickly. See our guides to what to log, the liability gap, Malaysia's draft AI governance bill and which rule applies when.
Your first step this week: open your AI vendor contracts, run the check above on the busiest one, and write the breach window you want in hours before the next renewal. This is general information, not legal advice.
Take the data with you
Every figure in this post's chart and at-a-glance card is in one table, with its source, source date and the date we read it. If you reuse either file, please cite this post and link back to it.
