PDPA Consent Form (Malaysia)

A PDPA Consent Form in Malaysia records the consent or release given and the scope of what the party agrees to.

The Notice and Choice Principle under Section 7 of the PDPA 2010 requires data users to notify data subjects of specified information before or at the time of collecting personal data, and to give data subjects the choice to consent or withhold consent to processing their data. The Personal Data Protection Regulations 2013 (PU(A) 335/2013) prescribe the minimum information that must be provided in the data protection notice and consent form.

The Personal Data Protection Commissioner (PDPC) — established under Section 76 of the PDPA 2010 and operating under the Ministry of Communications and Digital — enforces the PDPA 2010 and has issued guidelines on consent, data security, and data subject rights. The PDPC's Enforcement Guidelines 2020 and sector-specific codes of practice (including codes for the healthcare, insurance, banking, and communications sectors) supplement the PDPA 2010 requirements for data users in regulated industries.

The PDPA 2010 applies to personal data processed in Malaysia by data users registered under the mandatory registration scheme in Section 13, which covers data users in specified commercial sectors including banking and financial institutions under the Financial Services Act 2013, insurance companies, healthcare providers, telecommunications companies under the Communications and Multimedia Act 1998, and utilities. The PDPA 2010 also applies to any data user processing personal data in Malaysia for commercial transactions. Notably, the PDPA 2010 does not apply to the federal and state governments (Section 3(1)) and does not cover personal data processed for personal or domestic purposes.

The legal framework governing the PDPA Consent Form (Malaysia) in Malaysia draws on several key statutes and regulatory bodies. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Parties executing a PDPA Consent Form (Malaysia) in Malaysia should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Personal Data Protection Act 2010 (Act 709) sets the foundational requirements.

A PDPA Consent Form is needed in Malaysia whenever a data user collects, processes, stores, transfers, or discloses the personal data of individuals in connection with a commercial transaction, and relies on consent as the lawful basis for such processing.

A PDPA Consent Form is required when an employer collects personal data from job applicants and employees — including NRIC numbers, employment history, medical records, bank account details for salary payment, and EPF membership numbers. Under the PDPA 2010 and the Employment Act 1955, employee personal data requires explicit consent for purposes beyond the immediate employment relationship, such as sharing employee data with group companies or outsourced payroll providers.

A PDPA Consent Form is needed when a healthcare provider collects patient personal data — name, NRIC, medical history, diagnoses, medications, and insurance information — for the purpose of providing medical treatment and submitting insurance claims. The PDPC's Healthcare Sector Code of Practice under the PDPA 2010 imposes specific consent requirements for sensitive medical data under Section 40 of the Act, which designates health data as sensitive personal data requiring explicit consent.

A PDPA Consent Form is required when a financial institution under the Financial Services Act 2013 or the Islamic Financial Services Act 2013 collects customer data for KYC (Know Your Customer) purposes under Bank Negara Malaysia's Anti-Money Laundering, Anti-Terrorism Financing and Proceeds of Unlawful Activities Act 2001 guidelines, and wishes to use that data for marketing products and services.

A PDPA Consent Form is needed when an e-commerce business, retailer, or service provider in Malaysia collects customers' personal data — name, address, email, phone, payment information — for the purposes of processing transactions, delivering goods, and sending promotional communications. The PDPC's guidelines require separate consent for marketing communications beyond the core transaction purpose.

A PDPA Consent Form is required when personal data is to be transferred outside Malaysia under Section 129 of the PDPA 2010, which restricts cross-border data transfers to countries listed in the Personal Data Protection (Countries and Territories Receiving Personal Data from Malaysia) Order 2014, unless the data subject's explicit consent is obtained for the transfer.

A legally compliant Malaysian PDPA Consent Form under the Personal Data Protection Act 2010 and Personal Data Protection Regulations 2013 must contain the following essential elements.

Data User Identification: Full name and registration details of the data user — the organisation collecting and processing personal data. For companies, include the SSM registration number under the Companies Act 2016 and the PDPC registration number if the company is in a sector requiring mandatory registration under Section 13 of the PDPA 2010.

Data Subject Identification: A section for the data subject (the individual giving consent) to provide their name, NRIC number, and signature. The form must be capable of identifying the specific individual who gave consent.

Purpose of Collection: A clear, specific, and exhaustive statement of the purpose(s) for which personal data is collected and will be processed — for example, processing a job application, providing a service, sending marketing communications, or sharing data with related companies. Vague purpose statements ('for business purposes') do not comply with the Notice and Choice Principle under Section 7 of the PDPA 2010.

Categories of Personal Data: A specific list of the types of personal data being collected — such as name, NRIC, date of birth, address, email, phone number, financial information, health data, or sensitive personal data under Section 40. Sensitive personal data (health information, racial/ethnic origin, religious beliefs, political opinions, criminal records, biometric data) requires explicit separate consent.

Recipients and Disclosure: Identification of the third parties to whom personal data may be disclosed — affiliates, subsidiaries, service providers, outsourced data processors, regulatory authorities, and overseas recipients. Under the Disclosure Principle in Section 8 of the PDPA 2010, data may only be disclosed to third parties specified in the consent form.

Data Subject Rights: A statement informing the data subject of their rights under Section 30 (right of access to personal data), Section 34 (right to correct personal data), and Section 43 (right to withdraw consent and its consequences). The contact details for exercising these rights must be provided.

Withdrawal of Consent: A clear statement that consent may be withdrawn at any time by written notification to the data user, and the consequences of withdrawal — such as the inability to continue providing the service or processing the application.

Additional compliance elements for a PDPA Consent Form (Malaysia) used in Malaysia include: Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Forms-legal.com provides this template as a starting point for Malaysia-compliant documentation.