Does the PDPA apply when staff use AI chatbots at work?

Yes, whenever personal data goes into the tool. The organisation stays the data controller and must meet the PDPA principles on consent, disclosure, security, retention and cross-border transfer. Using an approved enterprise tool under a proper contract, and keeping names and identifiers out of prompts, removes most of the risk.

What is the maximum PDPA penalty in Malaysia now?

Since 1 April 2025, breaching the Personal Data Protection Principles can lead to a fine of up to RM1,000,000, imprisonment of up to three years, or both. The same amendment also made data processors directly responsible for the Security Principle, so vendors that handle data for you carry their own duty too.

Does every Malaysian company need a data protection officer?

No. The DPO guideline requires one where processing involves personal data of more than 20,000 people, sensitive personal data including financial information of more than 10,000 people, or regular and systematic monitoring. Organisations below those thresholds should still name someone responsible for approving AI tools and handling data incidents.

How quickly must a personal data breach be reported in Malaysia?

If a breach causes or is likely to cause significant harm, the data controller must notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours, using the SPDP portal. Affected individuals at risk of significant harm must be told within seven days of notifying the Commissioner. Staff should report suspected leaks internally at once.

Can HR use AI to screen job applicants under the PDPA?

It is possible, but the Commissioner's 2026 Automated Decision-Making and Profiling guideline sets clear expectations: assess the risks first, usually through a DPIA, tell applicants that automated tools are used and how, get explicit consent where sensitive data is involved, and keep trained people reviewing outputs so AI is never the sole basis for the decision.

PDPA Malaysia and AI Tools at Work: What Staff Must Know in 2026

Malaysia's Personal Data Protection Act 2010 (PDPA) applies whenever staff put personal data into an AI tool, because your organisation remains the data controller. Since the 2024 amendments took effect in 2025, the stakes are higher: fines of up to RM1 million, mandatory breach notification, mandatory data protection officers for many organisations and new cross-border transfer rules. The safe default: keep personal data out of unapproved AI tools.

This article is general information for staff and managers, not legal advice. For decisions about your own organisation, speak to your data protection officer or a lawyer.

At a glance

Date	What took effect
1 January 2025	Procedural changes, such as electronic service of documents
1 April 2025	New terms, biometric data, higher fines, transfer rules
1 June 2025	Data protection officers, breach notification, data portability
30 April 2026	New DPIA, ADMP and privacy by design guidelines

What the Personal Data Protection (Amendment) Act 2024 changed

The amendment act was gazetted on 17 October 2024. The Minister of Digital then set three commencement dates in P.U. (B) 522, published on 24 December 2024: sections 7, 11, 13 and 14 on 1 January 2025, sections 2, 3, 4, 5, 8, 10 and 12 on 1 April 2025, and sections 6 and 9 on 1 June 2025.

Changes from 1 April 2025

"Data user" became "data controller". The organisation that decides why and how personal data is processed is the data controller.
Biometric data is sensitive personal data. Fingerprints, face scans and similar data now need the stricter treatment that applies to health or religious data.
Higher penalties. Breaching the Personal Data Protection Principles can lead to a fine of up to RM1,000,000, imprisonment of up to three years, or both.
Data processors are directly bound by the Security Principle. Vendors that process data for you, including some AI and cloud services, now carry their own security duty.
Cross-border transfers changed. The old whitelist of approved countries was removed. Under the amended section 129, data may go abroad where the destination has a law substantially similar to the PDPA, or ensures an adequate level of protection, or where an exception applies. The Cross Border Personal Data Transfer Guidelines, launched on 29 April 2025, explain these tests and the transfer impact assessment.

Changes from 1 June 2025

Data protection officers became mandatory for many data controllers and processors.
Breach notification became mandatory, to the Commissioner and, in some cases, to affected individuals.
Data portability gave individuals a new right to have their data transmitted to another data controller.

Why an AI prompt is a PDPA question

The PDPA rests on seven principles: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access. Picture a customer service executive who pastes a complaint, with the customer's name, phone number and MyKad number, into a free AI chatbot to draft a reply. Several principles are now in play:

Disclosure. Did the customer agree to their data going to that AI provider for that purpose?
Security. Is the tool approved, and is there a contract that covers how the provider protects the data?
Cross-border transfer. If the provider processes data outside Malaysia, the transfer must meet section 129.
Retention. Consumer AI services may keep chat history. Can you delete it when you no longer need it?

None of this means AI tools are off limits. It means the organisation must choose approved tools, put contracts in place and tell staff where the lines are.

Approved enterprise tools versus personal accounts

The difference between a work tool and a personal one is contractual. For example, when staff use Microsoft Copilot Chat signed in with their work account, Microsoft's enterprise data protection terms apply: Microsoft acts as a data processor under its Data Protection Addendum, and prompts and responses are not used to train foundation models. The same staff member on a personal account does not get those commitments. An approved tool still does not remove your own PDPA duties, so the data minimisation rules below apply to every tool. Our guide to Copilot Chat and Microsoft 365 Copilot licences covers the licensing side.

When AI makes or shapes decisions about people

The Personal Data Protection Commissioner has issued three guidelines, each dated 30 April 2026: Data Protection Impact Assessment (DPIA), Automated Decision-Making and Profiling (ADMP), and Data Protection by Design. They set out the Commissioner's expectations and matter most when AI moves from drafting text to judging people.

The ADMP guideline covers decisions made by automated means without human involvement, and profiling that predicts traits such as work performance or finances. It focuses on outcomes that affect a person's legal rights or significantly affect their circumstances, such as ending a contract, refusing credit or affecting access to employment. The expectations include:

Telling people that automated decision-making is used, what decisions it makes, the possible consequences and the scope of AI involved
Getting explicit consent where sensitive data is involved
Having trained staff review AI outputs, and not relying on AI as the sole basis for a decision about a person
Training staff on how the AI works and where it fails

The DPIA guideline treats innovative technologies such as AI, and high-risk automated decision-making, as signs that a DPIA is needed. If HR wants an AI tool to shortlist candidates, that is a DPIA conversation before it is a procurement one.

Do and don't list for staff

Do	Don't
Use the company-approved AI tool with your work account	Paste data into personal AI accounts or unknown browser extensions
Replace names with roles, such as "Customer A"	Enter MyKad, passport or bank account numbers
Summarise trends instead of uploading raw records	Upload full customer lists, payroll files or medical claims
Check every AI output before it reaches a customer	Let AI alone decide on hiring, credit or discipline
Report a suspected leak to your DPO straight away	Delete the chat and hope nobody notices
Ask before trying a new AI tool	Assume a free tool is safe because it is popular

The role of the data protection officer

Under the DPO guideline, an organisation must appoint a DPO when its processing involves personal data of more than 20,000 data subjects, sensitive personal data (including financial information) of more than 10,000 data subjects, or regular and systematic monitoring of personal data. The DPO must be registered with the Commissioner through the SPDP portal within 21 days of appointment, must be proficient in Bahasa Melayu and English, and should either be resident in Malaysia or be easily contactable.

For AI, the DPO is the natural owner of four jobs: approving which tools staff may use, deciding when a DPIA is needed, handling breach notifications, and keeping staff training current. Smaller firms below the thresholds should still name one person to do these jobs.

If something goes wrong

A personal data breach that causes, or is likely to cause, significant harm must be notified to the Commissioner as soon as practicable and within 72 hours, through the SPDP data breach notification form. Significant harm includes risk of financial loss, identity fraud, misuse of data for illegal purposes or compromise of sensitive data. For notifying the Commissioner, a breach affecting more than 1,000 people also counts. Where significant harm to individuals is likely, they must be told without unnecessary delay and within seven days of notifying the Commissioner. The organisation keeps a breach register for at least two years.

The staff member's job is simpler: tell the DPO immediately. Whether an AI mistake counts as a notifiable breach is the DPO's call, and the 72-hour clock leaves no time for a quiet week of hoping.

A one-page AI rule you can adapt

Only use the AI tools on the approved list, signed in with your work account.
Never enter MyKad, passport, bank, health, biometric or salary details of identifiable people.
Remove or replace names and contact details before you prompt.
A person reviews every AI output before it goes to a customer or into a decision.
Report suspected leaks to the DPO at once.
The DPO reviews this rule every six months and whenever a new tool is approved.

For the wider ethical principles behind such rules, see our explainer on Malaysia's AI governance and ethics guidelines.

How CertTulen Academy can help

Most AI mistakes come from not knowing where AI fails. CertTulen Academy's AI Fluency: AI Capabilities and Limitations (CT-CLA-FLU2) gives all staff that judgement in a half-day session. For the people who own compliance and identity, SC-900 covers the Microsoft security, compliance and identity basics, including Microsoft Purview. Classes are live and MCT-led, online or in person in Malaysia, and CertTulen is an HRD Corp accredited training provider, so ask us which courses are claimable. Contact us or WhatsApp +60 16-241 8686.