Renewal and Cancellation of Registration – Personal Data Protection

REGISTRATION RENEWAL

Section 17. Renewal of certificate of registration

A data user may make an application for the renewal of the registration certificate not later than ninety days before the expiry date of the registration certificate in the manner and in the form determined by the Commissioner and the application must be accompanied by the prescribed renewal fee and any required documents by the Commissioner, but no application for renewal shall be allowed if the application is made after the expiry date of the certificate of registration.
When renewing a registration certificate, the Commissioner may change the conditions or restrictions imposed when the registration certificate was issued or impose additional conditions or restrictions.
The Commissioner may refuse to renew a certificate of registration—

if the data user does not comply with any of the provisions of this Act;
if the data user does not comply with any conditions or restrictions imposed when the registration certificate is issued; or
if he is satisfied that the data user cannot continue the processing of personal data in accordance with this Act.

CANCELLATION OF REGISTRATION

Section 18. Cancellation of registration

The Commissioner may cancel the registration of a data user if the Commissioner is satisfied that—
(a) the data user does not comply with any of the provisions of this Act;
(b) the data user does not comply with any conditions or restrictions imposed when the registration certificate is issued;
(c) the issuance of the registration certificate is motivated by a false representation of facts by the data user; or
(d) the data user has ceased to carry out personal data processing.
Notwithstanding subsection (1), the Commissioner shall not cancel the registration of a data user unless the Commissioner is satisfied that, after giving the data user an opportunity to make any written representation he wishes to make, the registration should be cancelled.
If the registration of the data user is cancelled, the Commissioner shall issue a notice of cancellation of registration to the data user, and the certificate of registration issued in respect of the registration shall not have effect when the notice of cancellation of registration is served.
A data user whose registration has been canceled under this section and who continues to process personal data thereafter commits an offense and may, on conviction, be fined not exceeding five hundred thousand ringgit or imprisoned for a term not exceeding three years or both.