PDPA Correction Request (Malaysia)

A PDPA Correction Request in Malaysia records the information the relevant body requires to process the matter.

The right to request correction applies to all sectors covered by the PDPA 2010, including banking and finance, insurance, telecommunications, transportation, utilities, health, and professional services as listed in the Personal Data Protection (Class of Data Users) Order 2013. Government agencies are currently excluded from the PDPA 2010's application but may be subject to separate data governance frameworks under the Communications and Multimedia Act 1998.

Under Section 34(1) of the PDPA 2010, a data subject may at any time request in writing that the data user correct personal data that is inaccurate, incomplete, misleading, or not up to date. The data user must within 21 days of receiving the request either correct the data and transmit the corrected data to each person to whom the data was disclosed within the previous 12 months, or inform the data subject in writing of the reason for refusing to correct the data. A refusal to correct does not automatically discharge the data user's obligation — the data subject may under Section 34(4) attach a statement to the personal data record noting that a correction was requested and refused.

The PDPC enforces the PDPA 2010, and data subjects who are aggrieved by a data user's refusal to correct may lodge a complaint with the PDPC under Section 104 of the PDPA 2010. The Commissioner may investigate and, if satisfied that the data user has breached the Data Integrity Principle, issue a notice of enforcement or refer the matter for prosecution. Conviction for breach of the Data Integrity Principle under Section 10 may result in a fine of up to RM 300,000 or imprisonment of up to two years under Section 129 of the PDPA 2010.

A PDPA Correction Request differs from a PDPA Access Request under Section 30, which entitles a data subject to request a copy of their personal data, and from a withdrawal of consent under Section 38, which stops future processing. The Correction Request is the appropriate instrument where the data subject has identified specific errors in data already held — for example, a wrong address, incorrect employment history, or inaccurate credit record shared with a financial institution reporting to Sistem Maklumat Rujukan Kredit (CCRIS) operated by Bank Negara Malaysia.

A PDPA Correction Request in Malaysia is needed whenever a data subject discovers that a data user holds inaccurate, incomplete, misleading, or outdated personal data that requires correction.

A PDPA Correction Request is required when a bank, insurance company, or financial institution licensed by Bank Negara Malaysia holds incorrect personal details — such as a wrong NRIC number, inaccurate date of birth, or erroneous employment information — that affect the data subject's credit profile, loan eligibility, or insurance premiums.

A PDPA Correction Request is needed when a telecommunications company licensed under the Communications and Multimedia Act 1998 holds outdated contact information — such as an old address or superseded mobile number — that results in incorrect billing or service interruptions.

A PDPA Correction Request is required when a healthcare provider or hospital covered by the PDPA 2010 has recorded inaccurate medical information, incorrect diagnoses, or wrong patient details that could affect future treatment decisions or insurance claims under policies regulated by Bank Negara Malaysia.

A PDPA Correction Request is needed when an employer or HR department holds incorrect employment records — such as wrong salary figures, inaccurate performance ratings, or erroneous disciplinary records — that the employee discovers upon accessing their personnel file.

A PDPA Correction Request is required when a credit reporting agency registered under the Credit Reporting Agencies Act 2010 (CRAA 2010) holds inaccurate credit data about an individual, affecting the individual's credit score and borrowing capacity.

A PDPA Correction Request is needed when an e-commerce platform, financial technology company, or digital service provider holds incorrect personal data — for example, a wrong delivery address or inaccurate date of birth — that causes service failures or identity verification problems.

Parties in Malaysia should prepare a PDPA Correction Request (Malaysia) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A valid PDPA Correction Request in Malaysia under Section 34 of the Personal Data Protection Act 2010 must contain the following essential elements.

Identification of Data Subject: The request must state the full name and NRIC number (or passport number for foreign nationals) of the data subject, along with current contact details. This allows the data user to locate the correct record and verify the identity of the requestor.

Identification of Data User: The request must clearly identify the data user — the organisation, company, or entity holding the personal data — including its registered name, registration number under the Companies Act 2016 or the Registration of Businesses Act 1956, and address. Data users in regulated sectors must hold a certificate of registration issued by the PDPC under Section 16 of the PDPA 2010.

Description of Inaccurate Data: The request must precisely identify the personal data that is inaccurate, incomplete, misleading, or not up to date. The data subject should state the current incorrect version held by the data user and the correct version that should replace it.

Evidence Supporting Correction: The request should attach supporting documentation evidencing the correct information — for example, a copy of the NRIC card, a utility bill showing the correct address, a birth certificate, or an official employment letter. Section 34 of the PDPA 2010 does not explicitly require evidence, but attaching it expedites the data user's processing and reduces grounds for refusal.

Reference to PDPA 2010 Rights: The request should explicitly invoke the data subject's rights under Section 34(1) of the PDPA 2010, putting the data user on formal notice that the 21-day response period under Section 34(2) has commenced.

Relief Sought: The request should state the specific correction sought — for example, updating the address, correcting a date of birth, removing erroneous entries — and request written confirmation once the correction has been made and transmitted to any third parties to whom the data was previously disclosed.

Escalation Notice: The request should state that failure to correct within 21 days or unjustified refusal will result in a complaint to the Personal Data Protection Commissioner under Section 104 of the PDPA 2010 and, if warranted, civil proceedings in the High Court of Malaya for breach of statutory duty.

Additional compliance elements for a PDPA Correction Request (Malaysia) used in Malaysia include: Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Forms-legal.com provides this template as a starting point for Malaysia-compliant documentation.