data user
Entity determining purposes and means of processing personal data.
How the laws define this
Both authorities position a data user as an entity or individual responsible for processing data within a processing workflow. They fundamentally disagree, however, on whether this role commands authority or requires external authorization. Under the Personal Data Protection Act 2010 (PDPA), a data user is the primary party that determines the purposes and manner of processing personal data and bears direct obligations for compliance, notices, registration, and accountability duties, although a 2024 amendment substitutes the term 'data controller' for many provisions. Conversely, ISO/IEC 5259-1:2024 - Artificial intelligence — Data quality for analytics and machine learning (ML) — Part 1: Overview, terminology, and examples defines a data user as an entity or individual granted authorization to access and process a dataset under predefined terms and conditions set by a data holder. Consequently, the former framework casts the data user as the primary legal controller, whereas the latter treats the data user as an authorized actor operating under conditions set by another entity.
Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Malaysia | Personal Data Protection Act 2010 (PDPA) | In Force (Amended) | This definition specifies primary compliance obligations including adherence to PDPA principles, notices, registration, and accountability duties, and notes the 2024 amendment substituting 'data controller'. |
| ISO | ISO/IEC 5259-1:2024 - Artificial intelligence — Data quality for analytics and machine learning (ML) — Part 1: Overview, terminology, and examples | In Force | This definition limits the term to an authorized entity accessing and processing datasets under terms set by a data holder, focusing on responsibilities in AI and ML data quality workflows. |
What it triggers
- Under the Malaysia Personal Data Protection Act 2010 (PDPA), the data user bears primary obligations for compliance with the PDPA's principles, notices, registration and accountability duties.
- ISO/IEC 5259-1:2024 sets out the data user role as fundamental in defining responsibilities within data processing workflows for AI and machine learning projects.source
Definitions (2)
The person or organization that, either alone or jointly with others, determines the purposes for which and the manner in which personal data is, or is to be, processed; the 2024 amendment substitutes the term 'data controller' for many provisions. The data user/controller bears primary obligations for compliance with the PDPA's principles, notices, registration and accountability duties.
Designates the entity or individual who has been granted authorization to access and process a dataset, typically under predefined terms and conditions set by the data holder. This role is fundamental in defining responsibilities within data processing workflows.
Not to be confused with
Data controller determines purposes and means of processing, while data user under PDPA interchangeably bears those compliance duties as substituted by the 2024 amendment.
Questions and answers
What obligations does a data user have under Malaysia's PDPA?
The data user bears primary obligations for compliance with the PDPA's principles, notices, registration, and accountability duties. This applies to persons or organizations determining purposes and means of processing personal data in commercial transactions.
How does ISO define data user in AI contexts?
ISO/IEC 5259-1:2024 designates data user as the entity or individual authorized to access and process a dataset under terms set by the data holder. This role defines responsibilities in data processing workflows for analytics and machine learning.
Is data user the same as data controller in PDPA?
The PDPA definition of data user aligns with data controller, as the 2024 amendment substitutes 'data controller' for many provisions while retaining the same meaning and obligations.
Related Terms
Service Provider (data intermediary)
Third‑party processors handling personal data for clients....
Data Custodian / Controller
Entity responsible for registering and managing personal data processing....
Data controller
Entity that determines purposes and means of processing....
Controller (Pengendali Data Pribadi)
Entity determining purposes and means of processing....
Data controller/processor
Entities determining or processing personal data for AI systems....