There is little doubt that artificial intelligence (“AI”) has moved from the edges of business operations to the very centre of them, and in a remarkably short time. Chatbots, AI-assisted credit assessments, CV screening tools and AI note-takers are now everyday tools for organisations of every size, and in almost every one of these use cases, personal data sits at the heart of the system, whether it is used to train the model, entered into it as a prompt or generated by it as an output. Yet one fundamental question has remained largely unanswered in Malaysia, namely how exactly the Personal Data Protection Act 2010 (“PDPA”) applies when personal data passes through an AI system.
The PDPA is Malaysia’s principal legislation governing the processing of personal data in commercial transactions. At its core are seven Personal Data Protection Principles, namely the General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access Principles, a breach of which may attract a fine of up to RM1 million, imprisonment of up to three years, or both.
Against that backdrop, on 5 October 2026, the Department of Personal Data Protection (“JPDP”) released Public Consultation Paper No. 1/2026 in respect of an Artificial Intelligence and Personal Data Protection Framework (“Consultation Paper”). The Consultation Paper does not introduce new legislation. Instead, it explains how the existing requirements of the PDPA apply when personal data is processed through AI, from the collection of training data to the retirement of the system, and whether the AI is built in-house or procured from a third party. In developing it, JPDP drew on the European Union’s AI legislation, the OECD AI principles and the guidance of data protection authorities in Hong Kong, the Philippines, Singapore and the United Kingdom.
In our earlier article on the next wave of personal data protection reform in Malaysia, we noted that such a framework appeared to be in development. It has now arrived. While the proposed AI Governance Bill, which the Malaysia Minister of Digital has indicated is targeted for tabling by the first quarter of 2027, is intended to regulate AI as a technology, the Consultation Paper is concerned with the personal data flowing through AI systems under a law that already applies today. And although the Consultation Paper describes itself as setting out high-level best practices and practical measures, it is written largely in mandatory terms, and in practice it is likely to become the yardstick against which an organisation’s use of AI is measured.
The Consultation Paper is open for public consultation until 23 October 2026 and its final form may differ, but it already gives a clear indication of the Commissioner’s expectations. In this article, we highlight seven key takeaways for organisations that build, buy or use AI systems involving personal data.
Key Takeaway 1: AI Does Not Create a New Legal Basis
The first key takeaway, and perhaps the most fundamental, is that the use of AI does not create a separate legal basis for the processing of personal data. In other words, if personal data goes into, through or out of an AI system, the Personal Data Protection Principles will have to be observed.
Accordingly, the data controller must identify the purpose and the legal basis before processing personal data through AI. Sensitive personal data requires explicit consent where the PDPA requires it, together with an assessment of whether processing it through AI is necessary and proportionate.
Of course, the most significant practical issue is the reuse of existing data. Where personal data is to be processed through AI for a purpose that was not previously notified, the Consultation Paper expects a new or revised notice to be given before the processing begins, and fresh consent to be obtained where consent is required. This matters because, unlike the European Union’s General Data Protection Regulation, the PDPA has no general “legitimate interests” basis, and the non-consent grounds it does provide, such as processing necessary for the performance of a contract, are narrow. The data controller also remains responsible for personal data obtained from third-party or publicly available sources.
Therefore, organisations considering using years of accumulated customer data to train or fine-tune an AI model should look carefully at what their customers were originally told. Personal data collected to serve customers is not automatically personal data that can be used to train a model.
Key Takeaway 2: A Wide Net in Both Definition and Scope
The second key takeaway is that the Consultation Paper casts a wide net, both in what it treats as AI and in how that AI is sourced.
The Consultation Paper defines an “AI system” as “a machine-based system designed to operate with varying levels of autonomy and that may exhibit adaptiveness after deployment. Such a system processes inputs to perform tasks by learning from data and/or inferring from patterns to generate outputs such as predictions, recommendations, content or decisions that may influence physical or virtual environments”. More notably, paragraph 4.1 recognises that AI systems may use machine learning models, predefined rules or other computational methods. In other words, the Consultation Paper is not confined to generative AI, and a rules-based credit scoring engine or CV filter that has been running quietly in the background for years may arguably fall within it.
The Consultation Paper also applies however the AI is sourced, whether it is developed in-house, procured off the shelf, customised, open-source or embedded within software-as-a-service, cloud services or application programming interfaces, including where general-purpose AI models are built into specific applications.
This breadth is understandable, as it stops organisations from stepping outside the Consultation Paper simply by choosing a different label for their technology. That being said, the consultation paper on the proposed AI Governance Bill appears to be taking a slightly different approach when it comes to the definition of “AI”. The proposed AI Governance Bill is looking at AI as “a functional capability or a set of methods that enables a system to perform functions that resemble human cognitive functions”, and it is expressly stated that AI should be distinguished from “ordinary software, which generally operates based on fixed instructions directly determined by humans”. This will no doubt affect the reach of the two (2) frameworks, and it would be helpful for the two definitions to be aligned, so that the same system is not treated as AI by one regulator but by the other.
Key Takeaway 3: Data Protection Across the Entire AI Lifecycle
The third key takeaway is that the Consultation Paper maps the PDPA onto each stage of an AI system’s lifecycle, rather than treating compliance as a one-off exercise at the point of launch.
At the development stage, data controllers are expected to incorporate Data Protection by Design from the outset, ensure that the personal data used for training and testing is adequate, relevant and limited to what is necessary, and consider anonymised or pseudonymised data where the purpose can be achieved without identifying individuals. The AI system should only be deployed once the data controller is reasonably satisfied that testing is complete and material issues have been addressed.
Even after deployment, the Consultation Paper expects data controllers to continue to play active roles in keeping an eye on how the AI systems are ultimately going to be processing the personal data “under the hood”. AI systems are to be monitored in operation, and where they are modified, retrained or updated, the data controller must assess whether the change materially affects the processing and, if so, test and validate it before continued use. When the AI system is eventually retired, personal data should not be retained solely because it was used by the decommissioned system.
In practical terms, privacy sign-off should therefore be built into each gate of an AI project, and not only at the go-live stage. Retraining and model updates, which are often treated as routine technical events, should likewise be recognised as potential triggers for a fresh assessment.
Key Takeaway 4: You Can Outsource the AI, but Not the Responsibility
The fourth key takeaway, and in our view the most practically significant, concerns external AI systems. The reality is that most Malaysian organisations do not build their own AI. They subscribe to it, license it or receive it embedded within software they already use, and Part F of the Consultation Paper effectively turns that procurement into a personal data protection exercise.
Engaging an AI service provider does not transfer or diminish the data controller’s responsibilities under the PDPA. Before procuring or using an external AI system, the data controller is expected to carry out proportionate due diligence on matters such as the system’s purpose and limitations, the personal data involved, the involvement of other processors or third-party providers, cross-border processing, security measures and any known risks or biases. Of particular importance is paragraph 20.2(d), which requires the data controller to consider whether personal data will be retained, reused or used for model training, fine-tuning, optimisation, analytics or other purposes beyond the intended service. Put simply, any sensible company would want to know whether the AI service provider is going to use the personal data fed into its AI systems to train its own AI model.
Where the provider processes personal data on the data controller’s behalf, the arrangements should cover matters such as instructions or authorisations given to the provider to process personal data, security, sub-processors, breach handling and the return or deletion of personal data at the end of the service. Cross-border transfers must comply with section 129 of the PDPA, supported where appropriate by a Transfer Impact Assessment, and significant changes to the AI system, its terms of service or its sub-processors should prompt a reassessment before the system continues to be used.
From a drafting perspective, standard AI subscription terms, which are often presented on a take-it-or-leave-it basis, will therefore need closer scrutiny. It would be wise for organisations to ensure that their AI vendor contracts address, at a minimum:
- whether the provider may retain or use the organisation’s personal data to train or improve its models, with the default being that it may not unless expressly agreed;
- notice of, and a right to object to, new sub-processors, together with the locations where personal data is stored and processed;
- breach notification timelines short enough for the organisation to meet the 72-hour window for notifying the Commissioner under the Data Breach Notification Guideline; and
- notice of material changes to the provider’s terms, a right to exit, and the return or deletion of personal data at the end of the engagement.
Of course, the Consultation Paper does not prescribe these clauses, and the appropriate position will depend on the AI system and the risks involved. But many of these contracts are already in place, with personal data already flowing through them, and organisations would do well to revisit them now rather than wait for the final framework.
Key Takeaway 5: Shadow AI Is Now a Personal Data Protection Issue
The fifth key takeaway concerns what is commonly referred to as “shadow AI”, being the use of AI tools by employees without the organisation’s knowledge or approval. From what we are seeing, this is one of the most common, and least visible, sources of personal data risk within organisations today.
Paragraph 16.4 of the Consultation Paper provides that personal data shall not be entered into or otherwise processed through an AI system where the use of that AI system for such processing has not been authorised by the data controller. Take a customer service executive who pastes a complaint, complete with the customer’s name, account number and contact details, into a free online chatbot to draft a quick reply.
To manage this, the Consultation Paper expects internal policies and procedures on the use of AI, appropriate training for personnel and, where appropriate, privacy-preserving settings by default. It also identifies additional measures that may be considered, such as Data Loss Prevention controls to detect and prevent the unauthorised transmission of personal data to external AI models.
In other words, AI acceptable-use policies, approved-tool lists and enterprise licences, which many organisations have treated as IT housekeeping, now carry a clear personal data protection dimension. That being said, monitoring employees’ use of AI tools raises personal data protection questions of its own, and any such monitoring should be proportionate and properly notified to employees.
Key Takeaway 6: Data Subject Rights Apply to AI-Generated Personal Data
The sixth key takeaway is that the Consultation Paper applies the existing data subject rights under the PDPA to AI systems, and in doing so, extends their practical reach in a direction that many organisations may not have anticipated.
Most notably, paragraph 25.2 provides that the right of access may extend to personal data generated or derived through the AI system that relates to the data subject, where such data can reasonably be identified and retrieved. Depending on the system, this could include profiles, scores or inferences about an individual.
Similarly, where an AI system causes or contributes to an inaccuracy in personal data, the data controller should correct the record and, where appropriate, address the source of the error. Separately, a withdrawal of consent by a data subject to the processing of his personal data means that processing through the AI system for that purpose must also cease, subject to the PDPA.
One issue that the Consultation Paper does not address, however, is personal data that has already been absorbed into a trained model. Deleting a record from a database is relatively straightforward but making a model “unlearn” its training data is a far more complex exercise, both technically and commercially, and some guidance on the Commissioner’s expectations in the final Consultation Paper would be welcomed. In the meantime, organisations should ensure that their data subject request procedures, as well as their arrangements with AI providers, are capable of reaching AI-generated personal data, and not merely the information that data subjects originally provided.
Key Takeaway 7: Fairness, Accuracy and Human Review
The seventh key takeaway is that the Consultation Paper brings fairness squarely into the personal data protection conversation, alongside accuracy and security.
Under paragraph 31 of the Consultation Paper, AI systems that process personal data are to be designed, tested, used and monitored in a manner that minimises foreseeable risks of unfair, biased or discriminatory outcomes, including risks arising from characteristics such as race, gender, religion, age and disability. Where appropriate, this involves assessing data for quality, representativeness and potential bias, reviewing AI-generated outputs for discriminatory patterns, taking corrective measures, and establishing review or escalation mechanisms where AI-generated outputs may significantly affect the data subject.
Take recruitment as a simple example. An organisation that uses an AI tool to screen CVs would be expected to check whether the tool systematically disadvantages certain groups of candidates, and to provide a route for a person to review outcomes that significantly affect a candidate. Although the Consultation Paper does not refer to it expressly, this sits comfortably alongside the Automated Decision Making and Profiling Guideline, and organisations using AI to make or support significant decisions about individuals should read the two together.
Closing Thoughts
The Consultation Paper is a significant step in Malaysia’s approach to AI governance, especially in the context of personal data. Rather than waiting for a dedicated AI statute, JPDP has made it clear that the PDPA already applies to AI and has set out in considerable detail what that means at each stage of the AI lifecycle. AI governance in Malaysia is therefore developing in two layers, with the proposed AI Governance Bill to regulate AI as a technology, and the PDPA already regulating the personal data that flows through it.
While the actual framework may still be refined, organisations should not wait for the final version before acting. The practical steps are relatively clear: take stock of the AI systems in use across the organisation, including tools used by employees and AI features embedded in existing software; identify the respective roles of the organisation and its providers; revisit privacy notices and consents; review AI vendor contracts; and document the assessments made.
The consultation also presents an opportunity for organisations to shape the final framework. The Consultation Paper poses several questions, ranging from the adequacy and scope of the framework to industry readiness and the regulatory support needed, and organisations may wish to raise practical issues such as personal data already absorbed into trained models and the alignment of the definition of AI with the proposed AI Governance Bill. Feedback may be submitted through the Unified Public Consultation platform or JPDP’s official Google Form on or before 23 October 2026.
If you have any questions on AI governance, personal data protection, AI procurement and vendor contracts, or the deployment of AI systems in Malaysia, please feel free to reach out to the partners in our Technology Practice Group, Lo Khai Yi and Ong Johnson, for a consultation. We have extensive experience advising on personal data protection, AI governance, technology contracts and related regulatory matters in Malaysia, and would be pleased to assist organisations in navigating the legal, regulatory and commercial considerations involved, including in preparing submissions to the consultation.
The Technology Practice Group of Halim Hong & Quek continues to be recognised by leading legal directories and industry benchmarks. Recent accolades include FinTech Law Firm of the Year at the ALB Malaysia Law Awards (2024, 2025 and 2026), Law Firm of the Year for Technology, Media and Telecommunications by the In-House Community, FinTech Law Firm of the Year by the Asia Business Law Journal, a Band 2 ranking for FinTech by Chambers and Partners, and a Tier 3 ranking by Legal 500. The strength of the practice is further reflected in the individual recognition of its partners, including a Band 1 ranking for FinTech by Chambers and Partners within the Technology Practice Group.
About the authors
Lo Khai Yi
Partner
Co-Head of Technology Practice Group
Technology, Media & Telecommunications (“TMT”), Technology
Acquisition and Outsourcing, Telecommunication Licensing and
Acquisition, Cybersecurity
ky.lo@hhq.com.my.
◦
Ong Johnson
Partner
Head of Technology Practice Group
Fintech, Data Protection,
Technology, Media & Telecommunications (“TMT”),
IP and Competition Law
johnson.ong@hhq.com.my
More of our Tech articles that you should read:
- • Consumer Credit Act 2025: 10 Key Takeaways on Malaysia’s New Authorisation Regime
- • Exit and Step-In Rights in Artificial Intelligence-as-a-Service
- •Telecommunication Towers M&A: Unpacking the Transaction
