马来西亚：新的个人数据保护指南

(Department ofPersonal Data Protection, 2026) Any part of this publication may not be reproduced, stored in, or transmitted in a permanentstorage system, or transmitted in any form or by any means, electronically, mechanically, Address: DEPARTMENT OF PERSONAL DATA PROTECTIONLevel 8, Galeria PjH, Jalan P4W, Persiaran PerdanaPrecinct 4, Federal Government Administration Centre TABLE OF CONTENTS PART A:INTRODUCTION 1. 1.1Section 12A of the Personal Data Protection Act 2010 ("Act 709") sets out the requirement forboth the data controller and the data processor to appoint one or more Data Protection Officers 1.2Pursuant to the Circular of Personal Data Protection Commissioner No. 1/2025 (Appointmentof Data Protection Officer) and the Appointment of Data Protection Officer Guideline, one of 1.3This DPIA Guideline (“Guideline”) provides practical guidance in relation to the carrying outof DPIA. Through this process, theorganisations can systematically identify and manage risks 1.4Please note that examples provided in this Guideline are not intended to be exhaustive and 1.5This Guideline supplements and is to be read together with Act 709 and any other relevantlegislative instrument(s) issued under Act 709, as may be amended from time to time. It This 2.Legal Provisions 2.1This Guideline is issued by the Personal Data Protection Commissioner (“Commissioner”)pursuant to the functions of the Commissioner under subsection 48(g) of Act 709.In 3. 3.1Unless otherwise defined in this Guideline, the terms and expressions used herein shall havethe same meanings assigned to them under Act 709 and any other relevant legislative PART B:PRE-DPIA 4.What is a DPIA 4.1A DPIA is an assessment of the impact of a planned processing operation on personal dataprotection.It involvesidentifying, assessing,and managing personal data protection risks 4.2In essence, DPIA is a process designed to analyse and mitigate personal data protection risks. 5.Why Carry Out a DPIA 5.1DPIAserves as a useful mechanism to assist organisations in ascertaining the risksassociated with a processing operation.It enables the organisation to evaluatewhether suchrisks are acceptable in the circumstances, when weighed against the purpose and nature of 5.2The implementation of a DPIA assists organisations in fulfilling the adequacy requirementsprevalent in the international personal data protection landscape. For instance, the European 5.3Carrying out a DPIA willenhances an organisation’s accountability and transparency. Bydemonstrating a steadfast commitment to safeguarding personal data, organisations can 6.Who Is Responsible for Carrying Out a DPIA 6.1The obligation to carry out a DPIA falls on the data controller. This is because, by definition,the data processor does not process personal data for its own purposesand the data controller 6.2Nevertheless, the data processor who is involved in the processing operation is expected toprovide all reasonable and necessary assistance to the data controller in carrying out the Duty to carry out DPIA 6.3The ultimate responsibility for carrying out the DPIA and for any resulting decisions rests with DPO vs DPIA Lead 6.4One of the core responsibilities of a DPO is to support the carrying out of DPIA. In this regard, (a)identifying whether a DPIA needs to be carried out; 6.5The DPO may not necessarily be the individual leading the carrying out of a DPIA. A DPIALead may either be the DPO, the project manager, or other personnel deemed appropriate by 6.6The DPIA Lead is the key personnel in charge of planning and executing the DPIA. Thisincludes consulting and gathering input from relevant stakeholders on matters such as details Stakeholder Engagement 6.7To ensure a DPIA is comprehensive and effective, it shall involve all relevant stakeholdersfrom various functions of the organisation connected with the processing operation.These (a)project manager;(b)IT department;(c)legal department;(d)any other subject matter experts; 6.8All relevant stakeholders are expected to assist the DPO and the DPIA Lead and provideappropriate input in completing the DPIA. 7.When to Carry Out DPIA 7.1A data controller shall carry out a DPIA if the data controller foresees that a processingoperation is likely to result in a high risk to the protection of personal data for the data subject. 7.2In this regard, the data controller is required to follow a two-tier approach to determine thelevel of risk and assess whether a DPIA is required: (a)First, the data controller shall determine if thequantitative threshold(as explained inparagraph 7.5) is met. If the quantitative threshold is met, a DPIA shall be carried out. (b)Second, if the quantitative threshold is not met, the DPO shall exercise best judgmentin considering thequalitative factors(as explained in paragraph 7.6) to determine 7.3This Guideline does not derogate from the requirements set out under any other legal orregulatory instruments regarding the