Data Protection

Personal Data Breach

Security breach affecting personal data integrity or confidentiality.

How the laws define this

Both regulatory instruments establish that a personal data breach centers on the compromise of personal data through unauthorized or unlawful destruction, loss, alteration, disclosure, or access, triggering mandatory reporting obligations to an authority and to affected individuals when harm is likely. However, these frameworks diverge regarding specific risk thresholds, scope elements, and procedural timelines. Under the Personal Data Protection (Amendment) Act 2024, the definition explicitly encompasses data acquisition and misuse compromising confidentiality, integrity, or availability, requiring data subject notification specifically when significant harm is likely, while mandating reporting to the JPDP. By contrast, the Implementing Regulations of the Personal Data Protection Law (PDPL Implementing Regulations) frame the threshold around risks to the rights and freedoms of natural persons, require notification to individuals whenever harm is likely, and impose a precise 72-hour deadline for notifying SDAIA.

Synthesised from the 2 statutory definitions below. Each one is quoted in full, with its source.

What it triggers

In Malaysia under the Personal Data Protection (Amendment) Act 2024, it triggers mandatory breach notification duties to the JPDP and, where significant harm is likely, to affected data subjects.
Under the Implementing Regulations of the Personal Data Protection Law, it triggers obligations including SDAIA notification within 72 hours and, where likely to cause harm, direct notification to affected data subjects.

Definitions (2)

Defined as an incident involving loss, unauthorised access, acquisition, disclosure, alteration, destruction or misuse of personal data that compromises confidentiality, integrity or availability and may cause harm to data subjects; the definition triggers mandatory breach notification duties to the JPDP and, where significant harm is likely, to affected data subjects.

Personal Data Protection (Amendment) Act 2024Definition 1 of 2

Any accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to personal data that is likely to result in a risk to the rights and freedoms of natural persons; such breaches trigger obligations including SDAIA notification within 72 hours and, where likely to cause harm, direct notification to affected data subjects.

Implementing Regulations of the Personal Data Protection Law (PDPL Implementing Regulations)Definition 2 of 2

Not to be confused with

Data breach

Data breach applies to any data while personal data breach specifically affects personal data.

Failure of Personal Data Protection

Failure of personal data protection refers to a breach compromising confidentiality, integrity, or availability, whereas personal data breach involves specific incidents like loss or unauthorised access that may cause harm.

Questions and answers

What notification duties does a personal data breach trigger in Malaysia?

Under the Personal Data Protection (Amendment) Act 2024, it triggers mandatory notification to the JPDP and, if significant harm is likely, to affected data subjects.

What are the notification timelines for a personal data breach under the PDPL Implementing Regulations?

It triggers SDAIA notification within 72 hours and, where likely to cause harm, direct notification to affected data subjects.

What incidents count as a personal data breach?

It includes loss, unauthorised access, acquisition, disclosure, alteration, destruction or misuse of personal data that compromises confidentiality, integrity or availability and may cause harm in Malaysia, or accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access likely to risk rights and freedoms under the Implementing Regulations.