PDPA amendments 2024: what changes for your business software

What changed in the PDPA in 2024?

The amendments came into force in phases during 2025. Key changes are the move from data user to data controller, direct security obligations for data processors, biometric data counted as sensitive personal data, higher penalties, a new basis for cross-border transfers, mandatory data protection officers, breach notification and a right to data portability.

According to the published implementation schedule, the terminology change, processor obligations, biometric data, penalties and cross-border transfer changes took effect first, and the data protection officer, breach notification and data portability provisions followed from 1 June 2025.

The maximum fine for breaching the data protection principles rose from RM300,000 to RM1,000,000, and the maximum prison term from two to three years. Cross-border transfers moved from a whitelist of approved countries to transfers to places with substantially similar laws or an equivalent level of protection. This article is a technical summary, not legal advice; check the Commissioner's current guidelines for detail.

• Data controllerThe new term for what the 2010 Act called a data user.
• Data processorNow directly bound by the security principle, not only through contract.
• Biometric dataNow sensitive personal data, which matters for fingerprint or face attendance systems.

What does breach notification mean for your systems?

If personal data is breached, the controller must notify the Personal Data Protection Commissioner, and notify affected individuals where significant harm is likely. In practice that means your systems must let you discover a breach, work out what data and which people were affected, and do it quickly.

Many small business systems cannot answer basic questions after an incident: who accessed the customer list, when, and what they exported. Without access logs and a clear record of where data is stored, a breach report becomes guesswork.

Ask your developer for role-based staff accounts, an audit trail of sensitive actions, alerts for unusual exports, and a documented list of every place customer data is stored, including spreadsheets, email and third-party tools.

Does a software developer count as a data processor?

Often, yes. If a developer or hosting provider stores or handles personal data on your behalf, for example by running your app's server or supporting your CRM, it is likely acting as a data processor and now has direct security obligations of its own. Agree the responsibilities in the contract.

The contract should state where data is hosted, who at the supplier can access production data, how access is revoked when staff leave, how backups are protected, and how quickly the supplier must tell you about an incident so you can meet your own notification duty.

This change is useful for buyers. It gives you a clearer basis to ask a supplier how it secures your data, and a reason to prefer suppliers who can answer in writing.

What should you fix first?

Start with an inventory: list every system that holds personal data, what it holds and who can access it. Then remove data you do not need, close shared logins, turn on access logging, and confirm backups can be restored. Appoint the data protection officer the law now requires.

Data minimisation is the cheapest control. An attendance system that stores fingerprint templates now holds sensitive personal data; a system that only needs a staff number does not. Review what each form collects and delete fields that do not serve the workflow.

Macoin builds apps, CRMs and business systems with role-based access, audit trails and documented data locations from the start. If you are reviewing an existing system for the amendments, send us a description through WhatsApp and we can tell you what we would check.