Malaysia PDPA 2024: A Marketing Agency Compliance Guide

By Tessar Napitupulu, Founder & CEO, PT Arfadia Digital Indonesia

Malaysia's Personal Data Protection (Amendment) Act 2024 phased into force between January and June 2025, and it changes the compliance posture of every marketing or GEO agency handling Malaysian personal data, whether that agency is based in Kuala Lumpur or Jakarta. The law now applies on an extraterritorial basis: what matters is whether personal data connected to Malaysia is being collected, used or disclosed, not where the agency's office happens to sit.

For an Indonesia-based agency serving Malaysian clients, or for a Malaysian business evaluating whether to hire one, this is not a footnote. It touches contract structure, data flows, and in some cases where personal data can be processed at all. This guide works through what actually changed, what it means operationally, and where the four major research sources this piece draws on genuinely agree versus where they diverge.

What the 2024 Amendment Actually Changed

Malaysia's original PDPA dates to 2010. The 2024 amendment, which received Royal Assent on 9 October 2024, is the first substantial overhaul since then, and it moves Malaysia's framework noticeably closer to international standards like the EU's GDPR. The changes rolled out in three phases rather than all at once: 1 January 2025, 1 April 2025, and 1 June 2025.

Five changes matter most for a marketing agency specifically. First, the terminology itself shifted, "data user" became "data controller," aligning Malaysia's vocabulary with the controller and processor framework used internationally. Second, data processors, not just controllers, now carry direct legal obligations of their own, a material change for any agency that processes a client's data rather than owning the underlying customer relationship. Third, mandatory Data Protection Officer appointment applies to controllers and processors alike, from June 2025. Fourth, mandatory data-breach notification became law, also from June 2025. Fifth, a new data portability right lets individuals request their data be transferred between controllers.

The financial stakes rose sharply alongside these changes. The maximum fine for breaching the core Data Protection Principles increased from RM300,000 to RM1,000,000, roughly USD215,000, and maximum imprisonment rose from two to three years. Biometric data was also explicitly reclassified as sensitive personal data, requiring explicit consent and materially stricter storage protocols than before.

Cross-Border Transfer Is Where an Indonesia-Based Agency Actually Feels This

For a foreign agency specifically, the cross-border data transfer rules are the part of the amendment that bites hardest. The old regime under Section 129 worked off an approved-country whitelist, a fixed list of jurisdictions Malaysian organisations could transfer personal data to without extra justification. The amended Section 129, in force from 1 April 2025, removed that whitelist entirely.

In its place, a Malaysian data controller may now transfer personal data abroad on one of several bases: the destination country has "substantially similar" protection or an "adequate level of protection," assessed through a formal Transfer Impact Assessment; explicit data-subject consent with proper notice; contractual necessity; a legal purpose; or a narrower reasonable-grounds exception. The Cross-Border Personal Data Transfer Guidelines, issued 29 April 2025, set out how a Transfer Impact Assessment should actually be conducted, and it needs reassessing periodically rather than done once and filed away.

Here is the detail that gets missed in a lot of summary coverage: no formal Malaysian "adequacy" or "substantial similarity" determination currently exists for Indonesia's own 2022 Personal Data Protection Law. That does not block a transfer, but it does mean an Indonesia-based agency typically needs to rely on a Transfer Impact Assessment or an explicit consent basis, documented properly, rather than assuming a blanket exemption applies simply because Indonesia has its own comparable data protection law. This is a genuinely practical point, not a theoretical one, and it is worth confirming with Malaysian legal counsel before systems access is granted rather than after.

Controller, Processor, or Both

How a marketing agency is classified under the amended PDPA depends entirely on what it actually touches, not on its general business description. A public website and citation audit typically involves low personal-data exposure and can often avoid collecting unnecessary identifiers altogether. Access to Google Analytics or Search Console sits in a middle zone, possible user and account-level data, best handled with restricted access and a documented, narrow purpose. CRM access and lead-list analysis is where processor-type responsibilities clearly apply, requiring a formal data-processing agreement and defined access controls. Direct collection of personal data, customer interviews for example, needs proper notice and a valid consent or processing basis before it happens, not retrospectively.

One area worth flagging specifically for GEO work: testing AI-search prompts using real customer records is both high-risk and generally unnecessary. Anonymised or synthetic data serves the same testing purpose without creating a live compliance exposure, and this should be the default approach for any Malaysian Citable Audit or prompt-testing exercise that touches customer-adjacent data.

A properly structured data processing agreement between an agency and its Malaysian client should specify controller and processor roles explicitly, name any authorised subprocessors, set breach escalation timelines, cover deletion or return of data at the end of the engagement, address confidentiality, grant audit rights, specify data location, and, increasingly relevant for a GEO-focused agency, place explicit restrictions on which AI tools client data can be run through and under what conditions.

Business Registration: Does an Offshore Agency Need a Malaysian Entity

Separately from PDPA, foreign companies serving Malaysian clients need to consider the Companies Act 2016. A foreign company that "carries on business" in Malaysia must register with the Companies Commission of Malaysia, either as a registered foreign branch, which requires a local agent and registered office, or by incorporating a local Sdn Bhd entity.

The more relevant question for most agencies is what actually counts as carrying on business. Providing services from abroad to Malaysian clients, without a physical place of business in Malaysia, without an agent habitually concluding contracts there, and without a sustained local presence, generally does not by itself trigger this requirement. A purely offshore service provider can typically contract with Malaysian clients without SSM registration. Where it gets more complicated is tax: payments from a Malaysian client to a foreign service provider can attract Malaysian withholding tax on certain categories of income, commonly cited around 10%, and this should be checked against the Indonesia-Malaysia double-tax agreement rather than assumed away.

Separately, Malaysia's 8% Sales and Service Tax applies to qualifying digital services provided by a registered foreign service provider once the value of services delivered to Malaysian recipients exceeds RM500,000 over a rolling 12-month period. This tax is single-stage and cannot be claimed as input credit further down the supply chain. Bespoke consulting engagements are not automatically treated the same as fully automated digital services for this purpose, custom, project-specific work is often classified differently from subscription-style SaaS delivery, so this needs a transaction-specific read rather than a blanket assumption in either direction. Foreign providers that exceed the threshold register formally, issue proper digital invoices (e-invoicing becomes mandatory in stages through July 2026), and file quarterly using Form DST-02.

What the Data Protection Officer Role Actually Requires

The mandatory DPO requirement deserves more than a passing mention, because it is easy to treat as a paperwork exercise rather than an operational one. A DPO is not simply a name on a compliance document. The role carries direct responsibility for the organisation's Protection and Retention Limitation obligations under the PDPA, and for a data processor specifically, that responsibility now sits with the processor directly rather than being fully absorbed by the controller upstream.

In practice, a workable DPO function for a marketing or GEO agency needs a genuinely accessible point of contact, someone who can respond to a data subject request or a Commissioner inquiry within the timelines the amended Act expects, not a name buried in a footer. It needs documented visibility into what personal data the agency actually holds or processes on behalf of each client, since a DPO cannot protect data flows they do not know exist. And it needs the authority to say no, to flag a proposed data use, an AI-tool integration, or a new data source as out of scope until it has been properly assessed, rather than being consulted only after a decision has already been made elsewhere in the business.

Some claims circulating in the market about specific DPO residency requirements, for instance, that a DPO must physically reside in Malaysia for a set number of days per year, are not consistently corroborated across the sources reviewed for this piece and should be verified directly with current PDPC guidance or Malaysian legal counsel before being treated as settled fact, rather than repeated as received wisdom.

A Staged Approach That Keeps Risk Proportionate

None of this means an Indonesia-based agency needs to solve every compliance question before taking a first Malaysian client. A staged entry model keeps risk proportionate to actual engagement size. Early engagements can run as straightforward cross-border consulting contracts, scoped to avoid heavy personal-data handling wherever the work allows it. As data-touching work grows, a Malaysian linguistic or implementation partner can absorb some of the compliance surface directly. Revenue and the practical indicators of "carrying on business" get monitored over time rather than assumed from day one. A Malaysian entity gets established only once client volume genuinely justifies the cost and complexity of doing so.

What should not happen at any stage is treating PDPA compliance as something that only becomes relevant once a business is caught out by it. The realistic posture for any agency handling Malaysian personal data, foreign or local, is a named DPO, a documented data processing agreement template, a defined breach response protocol, and a clear, written basis for any cross-border transfer, in place before the first piece of client data changes hands, not drafted retroactively after a client asks.

Frequently Asked Questions

Does the PDPA apply to us if our agency has no physical office in Malaysia?

Yes. The amended PDPA applies on an extraterritorial basis: what matters is whether personal data connected to Malaysian activity is being processed, not where the processing agency's office is located.

What's the actual difference between a data controller and a data processor under the new law?

A controller determines the purposes and means of processing personal data, typically the client business itself. A processor handles data on the controller's behalf and, since the 2024 amendment, now carries direct legal obligations of its own rather than relying entirely on the controller's compliance.

Do we need a Malaysian company to hire an Indonesia-based GEO agency?

No. You contract as the Malaysian client, and your agency's compliance posture, plus your own PDPA obligations around cross-border transfer, are managed through the engagement contract rather than requiring either party to incorporate locally.

Is Indonesia automatically considered an "adequate" destination for data transfer under the new rules?

No formal adequacy or substantial-similarity determination currently exists for Indonesia's PDP Law specifically. In practice, transfers typically rely on a documented Transfer Impact Assessment or an explicit consent basis rather than an assumed blanket exemption.

What happens if a data breach occurs during an engagement?

Breach notification to the Commissioner and affected individuals is now mandatory, not optional, following the 2024 amendment. A documented incident response protocol and breach register should be in place before an engagement starts, not improvised after an incident occurs.

We cover the broader regulatory and compliance groundwork for cross-market GEO engagements, including data governance frameworks, in Cited or Silent, and apply this compliance posture directly in our GEO service for Malaysia.