How does Malaysia's PDPA apply to learner data?

Under Malaysia’s Personal Data Protection Act 2010, the organisation that enrols a learner stays responsible for that learner’s data, even when a platform stores it. You must give notice in Bahasa Melayu and English, obtain consent (from a parent for anyone under 18), keep the data secure and no longer than needed, and let people see and correct it. Since the 2024 amendments you must also report harmful breaches within 72 hours, and the platform has its own duty to keep the data secure.

Does the PDPA cover your organisation?

The Personal Data Protection Act 2010 (Act 709) applies to personal data processed in commercial transactions, which the Act defines to include the supply of services. A tuition centre, a private school, a language or skills school, or a training provider that charges for its courses supplies a service. The Act does not apply to the Federal and State Governments.

Since 1 April 2025 the Act calls your organisation the data controller (formerly “data user”). A platform that processes the data for you is a data processor. Using one does not hand your duties to it.

Which principles matter most for learner data?

Section 5 sets seven principles: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access. Five matter most for learner data.

• Consent and the minimum. Process personal data only with consent, unless an exception such as performing a contract applies, and keep it “adequate but not excessive” for its purpose.
• Notice and choice. A written notice says what you collect and why, who may receive it, whether supplying it is obligatory, and how to ask for access or correction. Section 7(3) requires it “in the national and English languages”, given when you first ask for the data.
• Security. Take practical steps against loss, misuse and unauthorised access, considering where the data is stored, who can reach it and how it is transferred.
• Retention. Keep data no longer than its purpose needs, then destroy or permanently delete it.
• Access. People may see and correct their data. A data access request must be answered within 21 days.

Breaking a principle can now cost up to RM 1 million, three years’ imprisonment, or both, up from RM 300,000 and two years.

What did the 2024 amendments change, and when?

The Personal Data Protection (Amendment) Act 2024, Act A1727, received royal assent on 9 October 2024. P.U. (B) 522 brought it into force in three steps:

• 1 January 2025: procedural changes, such as serving notices electronically.
• 1 April 2025: the term “data controller”, a security duty on processors, higher penalties and a new rule for transfers abroad.
• 1 June 2025: data protection officers, breach notification and data portability.

Data breach notification

Section 12B requires you to notify the Personal Data Protection Commissioner of a breach “as soon as practicable”, and the people affected “without unnecessary delay” when it causes or is likely to cause them significant harm. Failing to notify the Commissioner can cost up to RM 250,000, two years’ imprisonment, or both.

The Commissioner’s guideline on data breach notification sets the deadlines: the Commissioner within 72 hours, and the people affected no later than seven days after that. Only a breach that causes or is likely to cause significant harm must be notified: a risk of physical harm or financial loss, misuse for illegal purposes, sensitive personal data, data that together could enable identity fraud, and, for the Commissioner only, more than 1,000 people affected.

If a processor holds the data, the 72 hours start when it tells you or when you have clear evidence yourself, whichever is earlier, and your contract must oblige it to tell you promptly. Keep a register of every breach, notified or not, for at least two years.

Data protection officer

Section 12A requires controllers and processors to appoint a data protection officer. The guideline on appointing one applies this where processing involves the personal data of more than 20,000 people, the sensitive personal data (financial information included) of more than 10,000 people, or regular and systematic monitoring. The officer must live in Malaysia at least 180 days a year or be easily reachable, be proficient in Bahasa Melayu and English, and be registered with the Commissioner within 21 days.

The processor’s own security duty

You used to have to obtain security guarantees from your processor. Now the processor must comply with the Security Principle itself, under the same penalty as you.

Data portability

Section 43A lets a learner ask you, in writing by electronic means, to send their data directly to another organisation of their choice, subject to technical feasibility and compatible data formats.

Transfers outside Malaysia

Transfers used to be allowed only to places the Minister listed in the Gazette. Now you may transfer data to a place whose law is substantially similar to the Act or which ensures protection at least equivalent to it, or rely on an exception such as the person’s consent or having taken all reasonable precautions and due diligence. The guideline on cross-border transfers describes a transfer impact assessment, whose findings are valid for up to three years, and, for due diligence, binding corporate rules, contractual clauses or an approved certification.

What changes when learners are children?

The Personal Data Protection Regulations 2013 require consent from a parent, a guardian or a person with parental responsibility when the learner is under 18. The consent must be in a form you can record and keep, and the burden of proving it lies on you. The Act also lets that parent or guardian ask for access and correction on the child’s behalf.

Collecting the minimum matters most here: does a profile need a photo, a home address or a full date of birth? Take care with notes on health or learning conditions: a person’s physical or mental health or condition is sensitive personal data, allowed only under stricter conditions such as explicit consent.

What should you ask a platform provider?

1. Does our contract name you as our data processor and describe your security measures?
2. Will you tell us of a breach promptly enough for the 72-hour deadline?
3. Where is our data stored, and which kinds of provider receive any of it, in which countries?
4. Are the privacy notice and consent text in Bahasa Melayu and English, and is each parent’s consent recorded with its date and version?
5. Can learners and parents see, download and correct their data?
6. Can you export a learner’s data in a common format?
7. How long is each kind of data kept, and what happens to it when we leave?
8. What does each AI feature receive about a learner?
9. Who is your data protection officer?
10. Which fields can we leave out?

How does AI Teacher handle this?

The organisation that enrols a learner is the controller, and AI Teacher processes the data on its behalf. The privacy notice is in Bahasa Melayu and English. An account for a learner under 18 is opened by the organisation and confirmed by a parent or guardian at first sign-in, and the consent is recorded with the notice version, the date and time, and who gave it. No photograph of a learner is stored (learners pick a drawn animal avatar), and there is no location data or advertising identifier. From the Profile page, a learner or parent can download a copy of their data and ask for erasure, which is answered within 21 days.

The database and application servers are in Singapore, and media files are stored and delivered from a global content-delivery network. AI model providers outside Malaysia receive only what each job needs, and never a learner’s name or identifier, apart from anything a learner typed into an answer. The plain version for families is on our page for parents.

This article is general information about Malaysian law, not legal advice.