Does Your Malaysian Business Need a DPO? The Three Tests and 21-Day Registration Rule

Decision tree with an evidence pack

Malaysian DPO appointment three-test decision tree

1. Test 1 — volume: do your current processing activities cover personal data of more than 20,000 individual data subjects? If yes, appoint a DPO.
2. Test 2 — sensitive volume: do you process sensitive personal data, including financial information, of more than 10,000 data subjects? If yes, appoint a DPO.
3. Test 3 — monitoring: do you regularly and systematically track or profile people, online or offline? If yes, the duty can apply even below both numeric thresholds.
4. If every answer is no, record the data map, counting method and reasons for not appointing, then set a review date for new systems, campaigns or acquisitions.
5. If any answer is yes, document the appointment, register business contact information within 21 days, publish the DPO contact route and give the role resources and direct access to senior management.

Why this matters

Malaysia added section 12A to the Personal Data Protection Act 2010 through the Personal Data Protection (Amendment) Act 2024. It creates the data-protection-officer role for data controllers and for data processors handling personal data on a controller’s behalf. The Commissioner’s appointment guideline, issued on 25 February 2025, explains which processing conditions trigger the requirement and how the role should operate.

The appointment duty took effect on 1 June 2025, according to the independent CMS legal update. This is now an operating compliance requirement, not a future proposal. A business should therefore be able to show how it tested the three conditions, who owns the decision, and how the conclusion is reviewed when its customers, staff, systems or monitoring activities change.

What the law says

The first condition is processing personal data exceeding 20,000 data subjects. Count people, not merely database rows, accounts or transactions. One customer may appear in sales, support and marketing systems several times. A defensible assessment starts with a data map and a deduplication method, records which groups are included, and states the period and systems used. Do not count only active paying customers if the business also processes applicants, staff, contractors, users or former customers.

The second condition is processing sensitive personal data, including financial information, exceeding 10,000 data subjects. This is a separate, lower threshold. The 2024 amendment also added biometric data to the statutory definition of sensitive personal data. A business may therefore fall below the general volume test but still trigger the DPO duty through health, biometric or financial-information processing at scale.

The third condition has no numeric threshold: activities requiring regular and systematic monitoring of personal data. The official guideline gives examples such as operating a telecommunications network, CCTV monitoring, online or offline behavioural tracking and profiling, and monitoring wellness or health data through connected devices. It also says a loyalty programme used strictly to manage accounts and not monitor purchasing behaviour may not amount to regular and systematic monitoring. Purpose and design matter, not the label attached to the system.

If the conditions are not met, paragraph 4.5 of the guideline says the controller or processor may keep a record of the reasons for not appointing a DPO. Treat that record as a living assessment. A new CCTV rollout, advertising profile, wearable-data feature, acquisition or combined customer database can change the answer even if each old system was below a threshold on its own.

A DPO can be an existing employee or an outsourced individual or organisation. The official guideline allows a part-time or full-time role and permits one person to serve multiple organisations if accessible. The person must have suitable knowledge of the PDPA, the business’s processing, information technology and data security, plus the integrity and governance ability needed for the role. No universal professional qualification is prescribed, but the required expertise rises with complexity and sensitivity.

Avoid an obvious conflict of interest. The guideline uses a head of marketing as an example of a dual role that may conflict with a DPO’s duty because the same person is trying to maximise targeting and sales while overseeing data-protection compliance. Compliance or records roles may be less likely to conflict, but job titles do not decide the issue. Ask whether the person determines the purposes or methods that they are supposed to scrutinise.

Registration is not the end of appointment. The guideline requires submission of the DPO’s business contact information through the Personal Data Protection System within 21 days of appointment and updates no later than 14 days after a new appointment or contact change. It also requires a dedicated official DPO email, separate from the individual’s personal and ordinary work email, and publication of business contact information through official channels such as the website, privacy notice or security policies.

The DPO should advise on processing, support compliance, assist with impact assessments, monitor practices, support breach management and act as a contact for data subjects and the Commissioner. The organisation must involve the DPO early, provide adequate resources and safeguard direct access to senior management. Section 12A(4) is equally important: appointing a DPO does not discharge the controller or processor from its own duties under the Act.

How does this impact me?

For a small business, employee count or annual revenue does not answer the DPO question. A lean app, platform or service provider can process data about many people or systematically track behaviour. Conversely, a larger offline business may need a careful assessment rather than assuming size alone triggers the role. Use the statutory processing tests, not the general idea of whether the company feels large.

For a group of companies, decide which legal entity is the data controller or processor for each activity and assess its processing. A shared DPO may be possible, but each appointing organisation needs access, clear reporting and its own compliance evidence. Do not hide responsibility inside a group label or assume one portal submission automatically documents every entity’s role.

For customers and staff, a published DPO contact should be a working route for privacy questions and rights requests, not a mailbox nobody checks. A clear dedicated address also helps the Commissioner reach the correct person. It should not expose the DPO’s private phone number or personal email; the guideline calls for business contact information.

Key lessons

The three-test assessment connects legal responsibility to data reality. A reliable organisation can identify the people whose data it holds, distinguish sensitive data, explain its monitoring and update the answer when systems change. If it cannot do that, the gap is wider than a missing appointment form.

The DPO must be independent enough to raise problems but integrated enough to be consulted before decisions are fixed. Giving the title to someone with no time, authority, training or senior access does not deliver the governance described by the guideline, and it does not transfer the organisation’s liability to that person.

Bottom line

Run all three DPO tests against a documented data map. If one applies, appoint a suitable and sufficiently independent person, register the business contact information on time, publish a monitored contact route and support the role. If none applies, record why and review the decision whenever processing changes.

Detailed steps

• Map every system and business activity that processes customer, employee, applicant, contractor, user or other individual data.
• Deduplicate and document the number of data subjects for general personal data and separately for sensitive and financial information.
• List tracking, profiling, CCTV, connected-device and behavioural-advertising activities, then assess whether monitoring is regular and systematic.
• Record the decision, evidence, counting method, responsible manager and next review date even when no DPO is currently required.
• If a test is met, select an internal or outsourced DPO with suitable legal, operational, IT and security understanding and no disabling conflict.
• Register the DPO's business contact information within 21 days, create a dedicated monitored email and publish the contact through official channels.
• Give the DPO timely access to projects, incidents, records, resources and senior management, and update appointment or contact changes within 14 days.