Data Processing Agreement (Malaysia)

A Data Processing Agreement in Malaysia sets out the rights and obligations the parties agree to be bound by.

Under the PDPA 2010, a data user is defined in Section 4 as a person who processes personal data or has personal data processed on their behalf. Where a data user engages a third party (the data processor) to process personal data — for example, a cloud computing provider, payroll bureau, or customer support platform — the data user remains responsible for confirming the data processor handles the data in compliance with the PDPA 2010. Section 40 of the PDPA 2010 imposes criminal liability on data users and data processors (where the processor acts outside the data user's instructions) for breaches of the Act, with fines up to RM 500,000 and/or imprisonment.

The seven data protection principles under Section 5 of the PDPA 2010 — General Principle, Notice and Choice Principle, Disclosure Principle, Security Principle, Retention Principle, Data Integrity Principle, and Access Principle — form the framework that a Data Processing Agreement must reflect. The Security Principle under Section 9 specifically requires data users to take practical steps to protect personal data from loss, misuse, modification, unauthorised disclosure, and destruction.

Malaysia's PDPA 2010 is undergoing amendments through the Personal Data Protection (Amendment) Act 2024, which introduces a mandatory data breach notification requirement (currently voluntary under the existing Act) and strengthens the powers of the Personal Data Protection Commissioner. The proposed amendments bring Malaysia's data protection framework closer to the European Union's General Data Protection Regulation (GDPR), which influences how multinational companies structure their Data Processing Agreements for Malaysian operations.

The legal framework governing the Data Processing Agreement (Malaysia) in Malaysia draws on several key statutes and regulatory bodies. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Parties executing a Data Processing Agreement (Malaysia) in Malaysia should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Personal Data Protection Act 2010 (Act 709) sets the foundational requirements.

A Data Processing Agreement in Malaysia is required whenever a company shares personal data of Malaysian residents with a third-party service provider that processes that data on the company's behalf.

A Data Processing Agreement is needed when a company engages a cloud computing provider — such as Amazon Web Services (AWS), Microsoft Azure, or a local Malaysian cloud provider — to host systems that store or process customer or employee personal data. The cloud provider acts as a data processor, and the company as data user must contractually bind the provider to PDPA 2010 compliance standards.

A Data Processing Agreement is required when a company uses an outsourced payroll bureau, HR management platform, or benefits administration service that processes employee personal data — including NRIC numbers, salary details, and bank account information — on the company's behalf.

A Data Processing Agreement is needed when a financial institution regulated by Bank Negara Malaysia (BNM) or the Securities Commission Malaysia (SC) engages a fintech platform or data analytics vendor that processes customer financial data, as both BNM's Risk Management in Technology (RMiT) Policy Document and SC's Guidelines on Technology Risk Management require formal data processing contracts.

A Data Processing Agreement is required when a company engages a marketing agency, customer relationship management (CRM) platform provider, or customer support outsourcing firm that will access and process the company's customer personal data for marketing, analytics, or support delivery purposes.

A Data Processing Agreement is needed when a Malaysian subsidiary of a multinational corporation transfers personal data to a parent company or affiliate in another country for group-level data processing, as the Transfer Principle under Section 129 of the PDPA 2010 restricts cross-border transfers of personal data outside Malaysia.

Parties in Malaysia should prepare a Data Processing Agreement (Malaysia) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A valid Data Processing Agreement in Malaysia under the PDPA 2010 must contain the following essential elements.

Parties and Roles: Clear identification of the data user (the party that determines the purpose of processing) and the data processor (the party processing data on the data user's behalf), with their SSM registration numbers and registered addresses. The agreement must specify the categories of personal data to be processed and the categories of data subjects (employees, customers, etc.).

Purpose and Instructions: A statement that the data processor shall process personal data only on the documented instructions of the data user and for no other purpose. This reflects the General Principle under Section 6 of the PDPA 2010, which requires personal data to be processed only for lawful purposes.

Security Measures: Specific technical and organisational security measures the data processor must implement, as required by the Security Principle under Section 9 of the PDPA 2010. These should include encryption of personal data in transit and at rest, access controls, employee confidentiality obligations, regular security audits, and ISO 27001 certification or equivalent.

Data Breach Notification: An obligation on the data processor to notify the data user of any actual or suspected personal data breach within a defined period (typically 24 to 72 hours of discovery), with details sufficient for the data user to comply with any applicable notification obligations under the PDPA 2010 or proposed amendments.

Sub-processor Controls: Restrictions on the data processor engaging sub-processors without the data user's prior written consent, and an obligation on the processor to impose equivalent data protection obligations on any approved sub-processors.

Data Retention and Deletion: The Retention Principle under Section 10 of the PDPA 2010 requires that personal data not be kept longer than necessary. The agreement must specify maximum retention periods and the data processor's obligation to delete or return personal data upon termination of the underlying service agreement.

Audit Rights: The data user's right to audit the data processor's data protection practices, either directly or through an independent auditor, to verify ongoing PDPA 2010 compliance.

Cross-Border Transfer Restrictions: Where personal data may be transferred to a country outside Malaysia, compliance with the Transfer Principle under Section 129 of the PDPA 2010 must be addressed, including confirmation that the recipient country provides adequate protection or that appropriate safeguards are in place.

Additional compliance elements for a Data Processing Agreement (Malaysia) used in Malaysia include: Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Forms-legal.com provides this template as a starting point for Malaysia-compliant documentation.