New 2026 Data Protection Guidelines: What Malaysian Businesses and the Public Should Know

In brief: Malaysia's Personal Data Protection Commissioner has issued new guidelines in 2026 on how organisations should handle personal data — covering data protection impact assessments (DPIAs), ‘data protection by design,’ and, importantly for anyone using AI, automated decision-making and profiling. Together, they mark a shift from ticking compliance boxes towards managing privacy risk on an ongoing basis.

This article is general information about Malaysian data protection law for the public.

What has changed?

The new guidelines build on the Personal Data Protection (Amendment) Act 2024, which was rolled out in stages between January and June 2025 and was the most significant overhaul of the Personal Data Protection Act 2010 since it was first enacted. The Commissioner has also issued Circular No. 1/2026 on the registration of ‘data controllers’ — a new term that replaces the old ‘data user,’ bringing Malaysian usage into line with international norms such as the European Union's GDPR.

What is a data protection impact assessment (DPIA)?

A DPIA is a structured check that an organisation carries out before it starts a higher-risk activity involving people's personal data. The idea is simple: think carefully about the privacy risks first, write them down, and address them before the project goes live — rather than dealing with problems after something goes wrong. This approach has long been standard under the GDPR and is now becoming the norm in countries with modern data protection laws.

What about AI and automated decisions?

The guidance on automated decision-making and profiling is likely to be the most significant development in practice. It speaks directly to organisations that use AI systems to make, or heavily influence, decisions about individuals — for example in credit scoring, shortlisting job applicants, insurance underwriting or fraud detection. Until now, Malaysian law offered relatively little specific guidance in this area, even though the practice had become widespread. The new guidance means people should be told, more clearly, when and how automated decisions are being made about them.

Why does this matter for you?

As more Malaysian businesses adopt AI tools, clear rules on automated decision-making give organisations greater certainty about what is expected of them — and give the public a clearer basis to hold organisations accountable when an AI-driven decision goes wrong. For businesses, privacy advice is shifting from a one-off compliance checklist towards ongoing risk governance, with documented DPIAs and clearer disclosure to the people affected.

What happens next?

The things to watch are the final published text of the automated decision-making guidelines and how the Commissioner approaches enforcement in the first cases.

Frequently asked questions

Who does Malaysia's data protection law apply to?

It applies to organisations that handle personal data in Malaysia — now called ‘data controllers’ under the amended law. If your organisation collects or uses people's personal information, these rules are relevant to you.

What is ‘automated decision-making’?

It means using software or AI to make a decision about a person with little or no human involvement — for example, an automated system that scores a loan application or screens a job applicant. The new guidelines address how organisations should handle this responsibly and what they should tell the people affected.

What is the difference between a ‘data user’ and a ‘data controller’?

They mean essentially the same thing. The Personal Data Protection (Amendment) Act 2024 replaced the older Malaysian term ‘data user’ with ‘data controller’ to match international usage, such as under the EU's GDPR.

Last updated: 17 August 2026.

This article is published by Khaw Ewe Seng & Co., Advocates & Solicitors (Penang) for general information about Malaysian law. It is not legal advice, and it does not create a solicitor–client relationship. For advice on a specific matter, please consult a qualified lawyer.