Material Applicability

The PDPA's material scope is defined by two key factors:

• Government and Public Agency Exemption
• Exemption for Specific Purposes of Processing

Government and Public Agency Exemption

PDPA Section 3(1):

"This Act shall not apply to the Federal Government and State Governments"

The PDPA explicitly excludes all federal and state government entities from its scope. This broad exemption applies to all data processing activities conducted by these governmental bodies, regardless of the nature or purpose of processing.

Exemption for Specific Purposes of Processing

PDPA Section 2(1):

"This Act applies to—(a) any person who processes; and (b) any person who has control over or authorizes the processing of, any personal data in respect of commercial transactions."

The Act's scope is limited to data processing in commercial contexts, effectively exempting non-commercial processing activities.

Territorial Applicability

The PDPA's territorial scope is determined by the following factors:

• Processing by Local Establishment
• Processing by Entity Registered or Incorporated in Jurisdiction
• Processing in Context of Local Establishment
• Long-Term Residency Threshold
• Use of Equipment Within Jurisdiction
• Doing Business in Jurisdiction
• Exception for Data Processing Outside Jurisdiction

Processing by Local Establishment

PDPA Section 2(2)(a):

"Subject to subsection (1), this Act applies to a person in respect of personal data if—(a) the person is established in Malaysia and the personal data is processed, whether or not in the context of that establishment, by that person or any other person employed or engaged by that establishment"

The Act applies to all data processing by entities established in Malaysia, regardless of where the processing occurs or its purpose.

Processing by Entity Registered or Incorporated in Jurisdiction

PDPA Section 2(4)(b-c):

"For the purposes of subsections (2) and (3), each of the following is to be treated as established in Malaysia: (b) a body incorporated under the Companies Act 1965 (c) a partnership or other unincorporated association formed under any written laws in Malaysia"

Long-Term Residency Threshold

PDPA Section 2(4)(a):

"For the purposes of subsections (2) and (3), each of the following is to be treated as established in Malaysia: (a) an individual whose physical presence in Malaysia shall not be less than one hundred and eighty days in one calendar year"

Exception for Data Processing Outside Jurisdiction

PDPA Section 3(2):

"This Act shall not apply to any personal data processed outside Malaysia unless that personal data is intended to be further processed in Malaysia."