Commissioner's Cross Border Personal Data Transfer Guidelines: the holder itself finds whether the receiving country has a similar law, using a transfer impact assessment (Personal Data Protection Commissioner Malaysia, Guidelines on Cross Border Personal Data Transfer (CBPDT), Version 1.0, 29 April 2025, paras 5.1 and 5.3)
The Guidelines publish no list of approved or adequate countries: the holder makes its own finding, usually by a written transfer impact assessment of the receiving country's law. For a US buyer the holder has to document why US law is substantially similar or adequate, or use consent or contractual precautions instead.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“Data controller may refer to paragraph 129(2)(a) of the Act 709 if it makes a finding that the place it intends to transfer personal data to has in place a law substantially similar to the Act 709. ... Data controller may conduct Transfer Impact Assessment (“TIA”) to review the relevant personal data protection law of the receiving country/ jurisdiction is equivalent to the Act 709 in order to fulfil the requirement under paragraph 129(2)(a) of the Act 709.”
Where it was read
Also read from the same source
- Commissioner's Cross Border Personal Data Transfer Guidelines (29 April 2025): consent route needs a notice and recorded consent (Personal Data Protection Commissioner Malaysia, Guidelines on Cross Border Personal Data Transfer (CBPDT), Version 1.0, 29 April 2025, paras 4.3, 7.2 and 7.3)
- Commissioner's Cross Border Personal Data Transfer Guidelines: contractual clauses, binding corporate rules or certification count as reasonable precautions (Personal Data Protection Commissioner Malaysia, Guidelines on Cross Border Personal Data Transfer (CBPDT), Version 1.0, 29 April 2025, paras 12.1, 12.7.2 and 12.8)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide