PDPA Privacy Notices in Malay and English: What the Law Requires
Short answer: Section 7(3) of Malaysia's Personal Data Protection Act 2010 says: "A notice under subsection (1) shall be in the national and English languages." Every privacy notice given to individuals, on a website, an app, a form or a job application, must therefore be in both Malay and English. Breaching the Personal Data Protection Principles, including the Notice and Choice Principle, now carries a fine of up to RM1 million, up to three years' jail, or both, after the Personal Data Protection (Amendment) Act 2024 raised the penalty from RM300,000 with effect from 1 April 2025.
What we do: Malay translations of privacy notices, consent wording, employee and job-applicant notices, CCTV signs and data breach letters, using the terms of the Act's official Malay text, and kept in step with your English version. Send your notice on WhatsApp for a quote. A standard notice is a quick job.
Last reviewed: October 2026.
What changed with the 2024 amendments
1 January 2025: notices may be served electronically.
1 April 2025: "data users" became "data controllers", biometric data became sensitive personal data, penalties rose, data processors became subject to the Security Principle, and the cross-border transfer whitelist was removed.
1 June 2025: mandatory data protection officers, mandatory breach notification and a new right to data portability.
Breach notification: the Commissioner must be told "as soon as possible, and within 72 hours"; affected individuals "not later than 7 days" after that, where the breach is likely to cause them significant harm.
Data protection officer: required when processing data of more than 20,000 individuals, more than 10,000 for sensitive data, or when regularly and systematically monitoring people.
Many companies rewrote their notices in 2025 for these changes. If the English notice was updated but the Malay version was not, the two no longer match, and section 7(3) is no longer met.
Which documents need both languages
Website and app privacy notices, and cookie or consent banners that collect personal data.
Customer forms, membership and loyalty sign-ups, and marketing consent wording.
Employee and job-applicant privacy notices.
CCTV notices at premises.
Notices sent with the right to request access or correction, and the DPO's contact details.
Letters to individuals after a data breach. The Act does not set their language, but a bilingual letter is the safe choice.
Key terms in the Act's Malay text
Personal data: data peribadi; sensitive personal data: data peribadi sensitif.
Data subject: subjek data; data processor: pemproses data.
Notice and Choice Principle: Prinsip Notis dan Pilihan; Disclosure Principle: Prinsip Penzahiran; Security Principle: Prinsip Keselamatan.
Retention Principle: Prinsip Penyimpanan; Data Integrity Principle: Prinsip Integriti Data; Access Principle: Prinsip Akses.
Using the Act's own terms keeps the Malay notice consistent with the law it relies on. Machine translation tends to mix terms, for example rendering "consent" three different ways in one notice.
How we translate a privacy notice
Send the current English notice and tell us where it is used (website, HR, forms).
We translate it into Malay using the Act's terminology and keep the same headings and numbering, so the two versions can sit side by side or in a language toggle.
We check the legal terms, figures, dates and contact details against the English text.
When you update the English version, send the changes and we update the Malay text to match.
The Personal Data Protection Department's 2022 guide to preparing a personal data protection notice also addresses the need for notices in both languages.
Maklumat dalam Bahasa Melayu
Seksyen 7(3) Akta Perlindungan Data Peribadi 2010 menetapkan bahawa notis di bawah subseksyen (1) hendaklah dalam bahasa kebangsaan dan bahasa Inggeris. Mulai 1 April 2025, pelanggaran Prinsip Perlindungan Data Peribadi boleh dikenakan denda sehingga RM1 juta atau penjara sehingga tiga tahun atau kedua-duanya. Kami menterjemah notis privasi, borang persetujuan dan notis pekerja ke dalam Bahasa Melayu menggunakan istilah Akta. WhatsApp: +60 17-227 9378.
Common questions
Can we publish the notice in English only?
No. Section 7(3) requires the notice in both the national language and English.
Does it have to be one bilingual document?
The Act requires both languages, not a particular layout. Two separate pages, a language toggle or a side-by-side document all work if both versions say the same thing.
Is a machine translation enough?
It is risky. The Malay version is a legal notice, and inconsistent terms or mistranslated rights can make it misleading.
Does the PDPA apply to foreign companies?
It applies to personal data processed in commercial transactions in Malaysia, including by foreign companies operating here. Ask your lawyer about your specific setup.
Related guides
Sources: