Overview on the Data Breach Notification under the Personal Data Protection Act 2010
Introduction
Section 12B of the Personal Data Protection Act 2010[1] [Act 709] (“PDPA”), which will come into effect on 1 June 2025 introduces a mandatory requirement for data controller to notify the Personal Data Protection Commissioner (“Commissioner”) and affected data subjects if the data controller has reason to believe that a personal data breach has occurred.
Pursuant to the above and Section 48(g) of the PDPA, the Commissioner has recently issued:
(a) Circular of Personal Data Protection Commissioner No. 2/2025 (Data Breach Notification) (“Circular No. 2/2025”); and
(b) Personal Data Protection Guideline: Data Breach Notification Version 1.0 (“DBN Guideline”).
Circular No. 2/2025 (which will come into effect on 1 June 2025) and the DBN Guideline serves as a valuable reference to help data controller in adhering to their obligations in respect of personal data breach.
Key Information under the Circular No. 2/2025 and the DBN Guideline
We highlight below some of the key information under the Circular No. 2/2025 and the DBN Guideline:?
Conclusion
In conclusion, data controllers are required to comply with all the requirements in respect of personal data breach notification as required under Circular No. 2/2025 and DBN Guideline. Further, it is important for such data controllers to be proactive in reviewing and updating their existing data protection policies, procedures and notices to reflect the above requirements and to strictly adhere to the same to ensure compliance with the PDPA.
Corporate Communications, Azmi & Associates - 13 March 2025