PDPA 2010 section 129 (as amended 2024): transfer outside Malaysia needs a similar law, adequate protection, or a listed condition (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 129(2), (3)(a), (3)(f) and (5), as amended by the Personal Data Protection (Amendment) Act 2024 [Act A1727], s. 12)
Since the 2024 amendment (the old whitelist of approved countries was deleted) a holder may send personal data to the United States if it finds the US has a substantially similar law or adequate protection, or if the data subject consents, or if it has taken all reasonable precautions and exercised all due diligence. Breach is an offence with a fine up to RM300,000 or two years in prison.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“A data controller may transfer any personal data of a data subject to any place outside Malaysia if- (a) there is in that place in force any law which is substantially similar to this Act; or (b) that place ensures an adequate level of protection in relation to the processing of personal data which is at least equivalent to the level of protection afforded by this Act. ... (a) the data subject has given his consent to the transfer; ... (f) the data controller has taken all reasonable precautions and exercised all due diligence to ensure that the personal data will not in that place be processed in any manner which, if that place is Malaysia, would be a contravention of this Act; ... A data controller who contravenes this section commits an offence and shall, on conviction, be liable to a fine not exceeding three hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.”
Where it was read
Also read from the same source
- PDPA 2010 section 4: personal data is information about an identified or identifiable person in respect of commercial transactions (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 4 (definitions of "personal data" and "commercial transactions"))
- PDPA 2010 sections 6 and 7: consent to process, and written notice before using data for another purpose or disclosing it to a third party (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 6(1)(a) and s. 7(2)(c))
- PDPA 2010 sections 8 and 39: no disclosure for a new purpose or to an unlisted third party without consent (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 8 and s. 39)
- PDPA 2010 section 39(d): disclosure on a reasonable belief that the data subject would have consented (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 39(d) and (e))
- PDPA 2010 section 45(2)(c): processing for statistics or research is exempt from the consent and disclosure principles (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 45(2)(c))
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides