Application of the Act:

This Act applies to:-

(a) Any person who processes; and

(b) Any person who has control over or authorizes the processing of any personal data in connection with commercial transactions.

1. Subject to subsection (1), this Act applies to a person in respect of personal data if:-
   
   (a) The person is established in Malaysia and the personal data is processed, whether in the context of the establishment or not, by the person or any other person employed or employed by the establishment; or
   
   (b) The person is not established in Malaysia, but uses equipment in Malaysia to process the personal data other than for the purpose of transit through Malaysia.
   
2. A person covered by paragraph (2) (b) shall nominate for the purposes of this Act a representative established in Malaysia.
   
3. For the purposes of subsections (2) and (3), each of the following shall be deemed to be established in Malaysia:
   
   (a) An individual whose physical presence in Malaysia shall not be less than one hundred and eighty days in one calendar year;
   
   (b) A body incorporated under the Companies Act 1965;
   
   (c) A partnership or other unincorporated association formed under any written law in Malaysia; and
   
   (d) Any person not covered by paragraph (a), (b) or (c) but maintaining in Malaysia that is:-
   
   – An office, branch or agency through which he carries out any activity; or
   
   – A regular practice.
   

2. Inapplicability of the Act

1. This Act does not apply to the Federal Government and the State Government.
   
2. This Act does not apply to any personal data processed outside Malaysia unless the personal data is intended to be further processed in Malaysia.
   
3. This Act does not apply to a credit reporting business conducted by a Credit Reporting Agency under the Credit Reporting Agency Act 2010.
   
4. This Act provides a comprehensive exemption to personal data processed by individuals for the purpose of personal, family or household affairs including recreation