PDPA Data Breach Notification in Malaysia: The 72-Hour Rule and How ISO 27001 Helps You Prepare
PDPA data breach notification in Malaysia has been a legal duty since 1 June 2025. A data controller with reason to believe a personal data breach has occurred must tell the Personal Data Protection Commissioner as soon as practicable under the Act, and the Commissioner’s guideline sets 72 hours as the outer limit. Affected individuals must follow within seven days if harm is significant. ISO 27001 certification of your information security management system helps you run that process, but it does not make you PDPA compliant by itself.
What Counts as a Personal Data Breach Under the PDPA in Malaysia?
The Personal Data Protection (Amendment) Act 2024 [Act A1727] added a definition to the PDPA 2010. A personal data breach covers any breach or loss of personal data, its misuse, or unauthorised access to it. The Commissioner’s Data Breach Notification (DBN) Guideline, issued on 25 February 2025, adds that the cause can be accidental or deliberate, internal or external.
The guideline’s examples are ordinary ones: customer records emailed to the wrong person, a lost laptop with unencrypted files, a misconfigured system. Ransomware that locks you out of your own records also counts, because losing access, even temporarily, is covered.
The law arrived in stages. Under the Minister of Digital’s commencement order, P.U.(B) 522, the amending Act started on 1 January 2025 (sections 7, 11, 13 and 14), 1 April 2025 (sections 2, 3, 4, 5, 8, 10 and 12) and 1 June 2025 (sections 6 and 9). Section 6 inserted the data protection officer duty (section 12A) and the breach notification duty (section 12B).
When Is PDPA Data Breach Notification Required in Malaysia?
Not every incident has to be reported. Under the DBN Guideline, you notify the Commissioner only where a breach has caused, or is likely to cause, significant harm. The guideline treats harm as significant if the data could lead to physical harm, financial loss, credit damage or loss of property, could be misused illegally, includes sensitive personal data, could enable identity fraud when combined with other details, or is of significant scale. Significant scale means more than 1,000 affected data subjects.
The test for individuals is narrower. They must be told when significant harm is likely, but the 1,000 count does not apply to them. A large breach with no other harm factor therefore goes to the Commissioner only. You must run this assessment yourself, every time.
The guideline’s examples show the logic. A stolen encrypted laptop holding 200 employees’ email addresses needs no notification. Patients’ medical records need it whatever the number, because medical data is sensitive. In another example, an attacker reached a supplier’s server but could not read the data behind two layers of security measures. Individuals did not need to be told, but the Commissioner still did.
What Is the 72-Hour Timeline for Data Breach Notification in Malaysia?
The Commissioner must hear from you promptly, and at the latest 72 hours after the breach occurs (paragraph 6.1). Paragraph 6.2 shows how counting works when you find out later. For a possibly compromised network, it starts when your inspection confirms the compromise. For ransomware, it starts when you realise access is lost or confirm the breach. Where a processor handles the data, it starts when the processor tells you or when you hold clear evidence, whichever is earlier. Because paragraph 6.1 refers to the occurrence, ask your legal adviser how the clock applies to you.
File through the Commissioner’s online data breach notification form, or send the Annex B form to dbnpdp@pdp.gov.my, or deliver a hard copy. A notification counts as submitted only after the Commissioner issues a confirmation notice, so keep it. If details are missing, send them in phases within 30 days after the first notification. If you miss 72 hours, send a written notice with your reasons and supporting evidence.
Individuals come second. The guideline says to notify them directly, without unnecessary delay, and at the latest seven days after you file with the Commissioner. Say what happened, the likely consequences, your response, how they can protect themselves, and who to contact. Public notices are allowed only when direct contact is impracticable or needs disproportionate effort.
What Should You Do in the First 72 Hours After a Data Breach in Malaysia?
Use this table as a starting playbook. The stages follow the DBN Guideline’s order, not a fixed clock, because the guideline sets only the deadlines above.
| Stage | What to do | Guideline paragraph |
|---|---|---|
| You hear of an incident | Start a preliminary investigation to confirm whether personal data was affected | 6.2 |
| Straight away | Contain it: isolate the system, suspend compromised access, stop the cause; record data types, people affected, timeline and root cause | 13.3, 13.4 |
| Assessment | Test the breach against the significant harm factors and the 1,000 threshold | 5.2, 5.3, 5.5 |
| Within 72 hours | Notify the Commissioner and keep the confirmation notice; if late, send written reasons with evidence | 6.1, 7.3, 7.7 |
| After filing | Tell affected individuals within seven days where required; send missing details within 30 days | 7.5, 9.1 |
Check other laws at the same time. The guideline says the PDPA duty runs alongside other notification duties, such as reporting crime to the police, sector rules from regulators like Bank Negara Malaysia, and reporting to the National Cyber Security Agency under the Cyber Security Act 2024 for designated national critical information infrastructure (NCII) entities.
What Must a Data Breach Response Plan Include Under the PDPA?
The guideline expects every controller to have a data breach management and response plan. At a minimum it covers six things: how breaches are identified and escalated, who does what, how to contain damage, how to decide whether to notify, how you will communicate with the Commissioner and individuals, and a review afterwards. It also says you should run periodic training and simulations. A plan only works if staff follow it, and the usual reasons SOPs are often ignored apply to breach procedures too.
Three further duties catch companies out. Processors are not directly bound by section 12B, so you must require them by contract to tell you promptly and help you comply. You must also log every breach in a register kept for at least two years, including breaches you chose not to report, with reasons. You also need a contact point: the data protection officer where mandatory, otherwise a senior representative.
What Is the Penalty for Not Reporting a Data Breach in Malaysia?
Section 12B(3) makes it an offence for a controller to fail to notify the Commissioner as section 12B(1) requires. On conviction the fine can reach RM250,000, or imprisonment up to two years, or both.
Some online summaries, such as a Malaysian cybersecurity vendor’s blog, quote RM500,000 and three years for failing to notify. That does not come from section 12B(3). Separately, section 4 of the amending Act raised the section 5(2) maximum, for contravening the seven personal data protection principles, to RM1 million or three years from 1 April 2025.
How Does ISO 27001 Help With PDPA Data Breach Notification in Malaysia?
ISO describes ISO/IEC 27001 as the standard for information security management systems (ISMS), used to establish, implement, maintain and improve one. BSI’s implementation guide to the 2022 edition summarises the requirements as context, leadership, risk assessment, documented information, performance measurement, internal audits, management reviews and correcting nonconformities. Annex A also lists controls on incident management (planning, assessing events, responding, learning and collecting evidence), event reporting, logging, monitoring and supplier relationships. Here is how they line up with the DBN Guideline.
| DBN Guideline expects | An ISMS gives you | You still add for the PDPA |
|---|---|---|
| Identify and escalate breaches | A staff reporting route, logging and monitoring | A rule that suspected loss of personal data goes straight to your contact point |
| Assess harm and scale, then contain | A documented way to decide when an event is an incident, response procedures and roles | The PDPA tests (significant harm, more than 1,000 data subjects) and the guideline’s containment steps |
| Notify in 72 hours and seven days | Communication planning and named responsibilities | The Annex B details and the individual notice content |
| Keep a two-year register | Controlled documented information and evidence handling | The register fields the guideline lists, including unreported breaches |
| Bind processors by contract | Supplier relationship and agreement controls | A clause requiring prompt breach notice and help |
| Review and train | Learning from incidents, corrective action, awareness, internal audit | Simulation exercises and a post-breach review of the plan |
The gain is a process that is written down, owned, audited and reviewed by management. Risk assessment decides which controls you need, and the habit of ISO risk and opportunity assessment carries across standards. After an incident, the root cause work in CAPA (corrective and preventive action) is the discipline the standard’s corrective action clause applies to nonconformities.
If your team needs the skills first, we provide ISO training, including ISO/IEC 27001 courses. For recovery planning, look at ISO 22301 certification, which covers business continuity.
What Does ISO 27001 Not Cover Under the PDPA?
Certification is not compliance. A certificate does not decide whether a breach triggers section 12B, and a certified company can still miss a deadline. The DBN Guideline does not mention ISO 27001 or any certification.
The data protection officer is also outside the standard. Section 12A requires controllers and processors to appoint one or more. Under the DPO Guideline, the duty applies if you process personal data of over 20,000 people, sensitive data (financial data included) on over 10,000 people, or run activities needing regular and systematic monitoring. Their business contact details must be registered with the Commissioner within 21 days of appointment.
Some customers still ask for the certificate. Technology and IT services are among the Malaysian industries that require ISO certification commercially, with ISO/IEC 27001 part of vendor qualification. If you decide to certify, the steps for how to get ISO certification in Malaysia are the same for ISO/IEC 27001.
This article is general information, not legal advice. Confirm how the rules apply to you with a lawyer. Nobody, Connext included, can guarantee a certification or compliance outcome.
Could Your Team Report a Breach Within 72 Hours?
If you are not sure, contact Connext to discuss an ISO/IEC 27001 gap analysis. Connext can also assess your incident process against ISO/IEC 27001 as part of its ISO and compliance services.
Frequently Asked Questions
How long do you have to report a data breach under the PDPA in Malaysia?
The DBN Guideline sets 72 hours after the breach occurs as the outer limit for telling the Commissioner, and sooner if practicable. Affected individuals follow within seven days after that. Missing details can be supplied in phases within 30 days.
Does every data breach have to be reported to the Commissioner?
No. Notification is required where significant harm has occurred or is likely, or where more than 1,000 data subjects are affected. Your register must still record breaches you decide not to report, with reasons, for at least two years.
Is ISO 27001 certification required by the PDPA?
The DBN Guideline does not require it and does not mention ISO 27001. Certification can support your breach process, but it does not replace the legal steps: assessment, notification, a data protection officer where required, and records.
Should a Malaysian SME get ISO 27001 certification?
It depends on your risk and your customers. Check whether tenders or contracts ask for it, how much personal data you hold, and whether you already have a tested incident process. Certification cannot guarantee compliance or any audit result.
What if a vendor or cloud provider causes the breach?
You still carry the notification duty as controller. Section 12B does not apply directly to processors, so your contract must require them to tell you promptly. Your 72 hours start when the processor tells you or when you have clear evidence, whichever is earlier.
