APAC Legal Summit 2026

Under the Personal Data Protection (Amendment) Act 2024, an organization must appoint a DPO if it meets any one of the following 3 criteria:

1. Processes personal data of more than 20,000 data subjects;
2. Processes sensitive personal data, including financial information, for more than 10,000 data subjects; or
3. Involves activities that require regular and systematic monitoring of personal data

Organizations should assess their data processing practices against these thresholds to determine whether they need to appoint a DPO. If there is uncertainty regarding the applicability of these criteria, it is advisable to consult a law firm for a legal opinion to confirm the necessity of appointing a DPO.

At present, there is no prescribed minimum professional qualification, accreditation, or certification required to be appointed as a DPO under Malaysian law. However, an appointed DPO should meet the following 5 key criteria:

1. Knowledge of Data Protection Laws – A DPO must have a strong grasp of the Personal Data Protection Act 2010 and other relevant data protection regulations.
2. Understanding of the Organization’s Business Operation – A DPO should be familiar with how the organization processes personal data within its business operations.
3. Technical and Data Security Awareness – A DPO should possess sound knowledge of IT and data security practices to ensure compliance.
4. Ethical and Corporate Governance Awareness – A DPO should demonstrate integrity, corporate governance awareness, and high professional ethics.
5. Ability to Cultivate a Data Protection Culture – A DPO should be capable of promoting strong data protection awareness within the organization.

The role of a DPO extends beyond a mere designation and involves a broad scope of responsibilities, including but not limited to:

1. Advisory Role – Providing guidance on compliance with the Personal Data Protection Act 2010 and related regulations.
2. Compliance Audits and Gap Analysis – Performing gap analysis and audits on the organization’s data protection policies, frameworks, and procedures.
3. Gap Analysis Report and Recommendations – Issuing gap analysis report and recommendations by advising on remediation plans for compliance gaps.
4. Data Protection Frameworks Development – Drafting, reviewing and revising the organization’s data protection policies, guidelines, notices, and handbooks.
5. Compliance Training: Conducting compliance training for employees, stakeholders, and directors to enhance understanding of data protection requirements.
6. Handling Data Breaches – Acting as the main point of contact with the PDP Commission during a data breach, ensuring proper notification and incident management within the prescribed timelines.
7. Interfacing with Data Subjects – Serving as the point of contact for data subjects regarding their rights and personal data inquiries, including during a personal data breach to notify affected individuals as required by law within the prescribed timelines.

Organizations have the flexibility to appoint a DPO either internally or outsource the role to an external service provider. If an organization opts for an outsourced DPO, it is recommended that the appointment be for a minimum term of 2 years to ensure stability and continuity.

The decision to appoint a DPO internally or to outsource the role depends on cost considerations and the expertise available within the organization. Many organizations do not have a dedicated in-house legal team, and even when they do, privacy law is a niche area that may not be within their expertise, therefore, for companies that lack the budget to hire a dedicated DPO, outsourcing can be a cost-effective solution.

It is important to understand that the role of a DPO is more than just a paper title, as it comes with real responsibilities, such as conducting gap analyses to advise the organization on compliance risks, developing frameworks by reviewing and revising personal data policies and guidelines, and providing compliance training. Additionally, in the event of a data breach, the DPO must be familiar with the response process, including handling data breaches, incident response, and incident management, particularly when dealing with the PDP Commissioner and data subjects. Therefore, given the importance of these tasks, whether appointing a DPO internally or outsourcing the role, or even deciding which service provider to outsource to, it is crucial to ensure that the appointed person or organization has actual experience in privacy law, particularly in handling data breaches.

In Malaysia, the DPO should meet local residency requirements, meaning that the DPO should be a resident in Malaysia (i.e., physically present in Malaysia for at least 180 days in a calendar year) or be easily contactable by any means and be proficient in both Bahasa Melayu and English.

Yes. Once a DPO has been appointed, the organization must register the DPO with the PDP Commissioner and submit their business contact information within 21 days from the date of appointment.

Yes, after appointing a DPO, organizations are required to publish the business contact information of the DPO through various channels, including the official website and other official media of the organization, personal data protection notices, and security policies and guidelines.

Additionally, organizations must create a dedicated official business email account for the DPO, which shall be distinct and separate from the personal and official business work email address of the individual appointed as the DPO.

The role and responsibilities of a DPO can only be carried out effectively with adequate resources and support from the organization, regardless of whether the DPO is appointed internally or outsourced. Therefore, the organization must ensure that the DPO is provided with sufficient resources, including financial support, infrastructure, and manpower, to perform their role effectively. The level of resources should be aligned with factors such as the complexity of data processing operations, the sensitivity of the personal data being processed, and the size and structure of the organization.

If an organization is uncertain about whether it needs to appoint a DPO or is unsure where to start, it is it is advisable to consult a legal professional with data privacy and cyber security experience to assess whether the organization is required to appoint a DPO. If the answer is yes, the organization must then decide whether the DPO role can be filled internally or, due to expertise and cost considerations, whether outsourcing to an organization such as ours would be more suitable.

If your organization would like to learn more about DPO outsourcing services or assess whether your organization requires a DPO, you may reach out to us for a consultation.