Recent Reforms to the Personal Data Protection Act 2010 and Its Implications for Business Organisations in Malaysia

The advancement of the Internet and social media platforms has revolutionised human communication and interactions in the knowledge economy. However, this progress has also introduced significant risks, including cyber scams, misuse of personal data, identity theft, and online harm targeting vulnerable populations such as children. Recent incidents highlight the urgent need for effective data protection legislation. Malaysia’s Personal Data Protection (PDP) Act, enacted in 2010 and implemented in 2013, is designed to address these concerns. However, the security of personal data remains a critical issue, evidenced by the rising number of data breaches. This paper focuses on the newly amended PDPA of 2024, assessing its provisions against the data protection framework in the United Kingdom and analysing its ramifications for businesses operating in Malaysia. The qualitative research methodology, which includes doctrinal and comparative legal analysis of primary sources, reveals that protecting personal data is an ongoing and formidable challenge. Key issues such as data sharing, the right to erase personal data, and the role of the Data Commissioner remain inadequately defined in Malaysia’s legal framework. Businesses must promptly review and update their policies and procedures to comply with the new legal requirements.