Personal Data Protection Act 2010, as amended 2024
Phased through 2025. Breach notification within 72 hours. Note the DPO duty: “regular and systematic monitoring” itself triggers the appointment requirement — which a DLP deployment can constitute.
← All jurisdictions
Jurisdiction record
Malaysia
Malaysia
A dual-track market. The PDPA does not bind government, so the public sector and the enterprise sector are governed by different instruments — and sold to differently.
Orientation only, not legal advice. Every fact carries its own review date.
Market-prerequisite record
No product licence prerequisite recordedNo product licence prerequisite. A service licence under the Cyber Security Act would only apply to a managed-monitoring offering, which is not in v1 scope.
Sourced facts
Instruments and current record
Personal Data Protection Act 2010, as amended 2024 Cyber Security Act 2024 (Act 854) BNM Risk Management in Technology, November 2025 Government security directives
Separately labelled interpretation Bounded product mapping
This path describes content governance; it does not represent certified legal compliance.
Cyber Security Act 2024 (Act 854)
NACSA and the NCII sectors. Initial incident report within 6 hours — the tightest clock in our market set, and the case that drives the incident export design.
BNM Risk Management in Technology, November 2025
Explicitly mandates data-loss prevention for data in use, in motion and at rest. The most direct regulatory mandate for this product in the region.
Government security directives
Public-sector obligations, applicable where the PDPA does not bind.
Product mapping
Detector-pack direction
MyKad — 12 digits, no check digit. Validation is contextual: date validity, place-of-birth code range, and the gender digit. A pure regex will over-match; the pack encodes the structure.
This maps deterministic detector content; it is not a claim of complete legal compliance.
Run browser demonstrationInterpretation
Classification mapping
Government classification per the security directives, plus enterprise labels mapped through the configurable taxonomy.
Customers should confirm applied policy with qualified counsel and security owners.
Watch items
Not treated as current fact
- PDPA subsidiary rulemaking wave
Validate the mapping in evaluation
Confirm current primary sources, applicability, and product maturity before selecting test cases.