Commissioner's Cross Border Personal Data Transfer Guidelines: contractual clauses, binding corporate rules or certification count as reasonable precautions (Personal Data Protection Commissioner Malaysia, Guidelines on Cross Border Personal Data Transfer (CBPDT), Version 1.0, 29 April 2025, paras 12.1, 12.7.2 and 12.8)

For a one-off licence to a US buyer the practical alternative to consent is a contract with clauses that bind the buyer to security equivalent to the Act and to process the data in compliance with it. The holder must keep taking reasonable precautions, and must stop the transfer if it finds the buyer in breach.

Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text

In the source's own words

“all reasonable precautions and exercised due diligence may be deciphered by the following mechanisms: 12.1.1 Binding Corporate Rules (“BCR”); 12.1.2 Contractual Clauses (“CC”); or 12.1.3 Certification under an approved certification scheme (“Certification”). ... clauses that state and guarantee that the processing of personal data shall be carried out in compliance with the Act 709. ... In the event that the data controller discovers a breach of terms provided by the CC, the data controller shall cease the transfer of personal data to the other parties to the contract until such party rectifies the breach.”

Where it was read

Commissioner's Cross Border Personal Data Transfer Guidelines: contractual clauses, binding corporate rules or certification count as reasonable precautions, Malaysia, checked 18 Oct 2026
Everything read from this source (3)