Although the PDPA sets out broad legal requirements to be complied with when processing Personal Data, it does not provide guidance on the practical steps that can be taken to comply. Code helps fill this gap. The Code will help Data Users identify issues they need to consider when processing personal Data. It will give Data Users confidence about the appropriate steps to take with regard to Personal Data and give a clearer picture of what is not acceptable when dealing with Personal Data

This Code has the force of law and comes into force as soon as it is registered by the Commissioner in the Register of Codes of Practice (“Effective Date”). It binds the Data User, must comply with the Code within a period to be determined and notified in writing by the Commissioner. As the Code is legally binding, Data Users who fail to comply with this Code are considered to have committed an offence, and upon conviction, may be fined up to RM 100,000 or imprisoned for a period of not more than one (1) year or both under Section 29 PDPA.