PDPA 2010 sections 8 and 39: no disclosure for a new purpose or to an unlisted third party without consent (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 8 and s. 39)
Personal data may not be disclosed without consent for a purpose other than the one stated at collection or a directly related one. The only disclosure exceptions in section 39 that could fit a commercial licence are consent, or the controller's reasonable belief that the data subject would have consented; the others are crime, legal authority, legal rights and a Minister-determined public interest.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“no personal data shall, without the consent of the data subject, be disclosed- (a) for any purpose other than- (i) the purpose for which the personal data was to be disclosed at the time of collection of the personal data; or (ii) a purpose directly related to the purpose referred to in subparagraph (i); ... (a) the data subject has given his consent to the disclosure;”
Where it was read
Also read from the same source
- PDPA 2010 section 4: personal data is information about an identified or identifiable person in respect of commercial transactions (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 4 (definitions of "personal data" and "commercial transactions"))
- PDPA 2010 sections 6 and 7: consent to process, and written notice before using data for another purpose or disclosing it to a third party (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 6(1)(a) and s. 7(2)(c))
- PDPA 2010 section 39(d): disclosure on a reasonable belief that the data subject would have consented (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 39(d) and (e))
- PDPA 2010 section 45(2)(c): processing for statistics or research is exempt from the consent and disclosure principles (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 45(2)(c))
- PDPA 2010 section 129 (as amended 2024): transfer outside Malaysia needs a similar law, adequate protection, or a listed condition (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 129(2), (3)(a), (3)(f) and (5), as amended by the Personal Data Protection (Amendment) Act 2024 [Act A1727], s. 12)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide