The Personal Data Protection Act 2010 (PDPA) of Malaysia uses the "Processing by Local Establishment" factor to determine its applicability to data processing activities within the country.

Text of Relevant Provision

Section 2(2)(a) of the PDPA 2010 states:

"Subject to subsection (1), this Act applies to a person in respect of personal data if— (a) the person is established in Malaysia and the personal data is processed, whether or not in the context of that establishment, by that person or any other person employed or engaged by that establishment"

Analysis of Provision

The provision extends the PDPA's applicability to entities established in Malaysia that process personal data, regardless of whether the processing occurs within the context of that establishment. This broad approach ensures comprehensive coverage of data processing activities by Malaysian entities.

The phrase "whether or not in the context of that establishment" is particularly significant as it expands the law's reach to include processing activities that may not be directly related to the entity's primary operations in Malaysia.

Section 2(4) further clarifies what constitutes being "established in Malaysia":

"For the purposes of subsections (2) and (3), each of the following is to be treated as established in Malaysia:(a) an individual whose physical presence in Malaysia shall not be less than one hundred and eighty days in one calendar year;(b) a body incorporated under the Companies Act 1965 [Act 125];(c) a partnership or other unincorporated association formed under any written laws in Malaysia; and(d) any person who does not fall within paragraph (a), (b) or (c) but maintains in Malaysia—(i) an office, branch or agency through which he carries on any activity; or(ii) a regular practice."

This detailed definition ensures that the law applies to a wide range of entities with a significant presence in Malaysia, including individuals, companies, partnerships, and other organizations maintaining offices or regular practices in the country.

Implications

The "Processing by Local Establishment" factor has several implications for businesses:

1. Malaysian companies: All companies incorporated in Malaysia are subject to the PDPA, regardless of where they process personal data.
2. Foreign companies with Malaysian presence: International companies with offices, branches, or agencies in Malaysia fall under the PDPA's jurisdiction for their data processing activities.
3. Regular practices: Entities that maintain a regular practice in Malaysia, even without a formal office, are considered established in the country and must comply with the PDPA.
4. Broad scope of processing: The law applies to all personal data processing by established entities, even if the processing is not directly related to their Malaysian operations.
5. Responsibility for third-party processing: Established entities are responsible for ensuring PDPA compliance when personal data is processed by other persons employed or engaged by their establishment.

This factor effectively extends the PDPA's reach to cover a wide range of data processing activities conducted by entities with a significant connection to Malaysia, ensuring comprehensive protection of personal data within the country's jurisdiction.