PDPA 2024 amendments: what changes for businesses on WhatsApp

The 2024 amendments to Malaysia’s Personal Data Protection Act raised the maximum penalty to RM1 million and three years’ imprisonment, made data protection officers mandatory above set thresholds, and require notifying the Commissioner of serious data breaches. For a business that sells on WhatsApp, the practical question is simple: do you know what customer data sits in your chats, who can see it, and what you’d do if it leaked?

This is a plain-language summary, not legal advice. Check the current Act and the Commissioner’s guidelines, and speak to a lawyer about your own obligations.

What changed, and when

The Personal Data Protection (Amendment) Act 2024 came into force in stages from January to June 2025.

Higher penalties

The maximum penalty for breaching the data protection principles rose from RM300,000 to RM1,000,000, and the maximum prison term from two years to three.

Data protection officers

From June 2025, both data controllers and data processors must appoint a data protection officer if they meet any of the thresholds in the Commissioner’s guideline:

• processing the personal data of more than 20,000 people,
• processing the sensitive personal data of more than 10,000 people, or
• activities that involve regular and systematic monitoring of people.

The DPO should be reachable: the guideline expects them to be resident in Malaysia or easily contactable, and proficient in Bahasa Malaysia and English.

A busy shop can pass 20,000 customers sooner than you’d think. Count the people in your chat history, not just this month’s buyers.

Data breach notification

From June 2025, if a controller has reason to believe a personal data breach has occurred that causes or is likely to cause significant harm, it must notify the Personal Data Protection Commissioner as soon as possible, and notify the affected people without unnecessary delay. The Commissioner’s guideline sets out the deadlines and the form; the Personal Data Protection Department runs an online reporting portal.

Significant harm includes a risk of physical harm, financial loss, damage to credit records, identity fraud, misuse for illegal purposes, a breach involving sensitive personal data, or one affecting more than 1,000 people.

Processors are now on the hook too

Software providers that process data on your behalf, such as your chat inbox, are now directly subject to the security principle and can face penalties themselves. You remain the data controller for your customers’ data, so choose providers who can show how they protect it.

Cross-border transfers

The amendments replaced the old ministerial “whitelist” with a risk-based framework: personal data can be transferred abroad under specified conditions, such as adequate protection or appropriate safeguards. Most cloud software stores or processes some data outside Malaysia, so ask your providers where, and on what terms.

A checklist for businesses that chat with customers

1. Know what’s in your chats. Names, phone numbers, addresses, IC numbers, payment slips, photos of documents. Collect only what you need.
2. Tell customers. Have a privacy notice that covers chat, and link to it from your profile or first message.
3. Get consent for marketing. Replying to someone who wrote to you is different from messaging people who never asked.
4. Control who can see what. One shared phone means everyone sees everything. Individual logins and roles let you limit access.
5. Keep a record of who did what. If something goes wrong, you’ll need to know.
6. Know where your data goes. Ask your software providers where data is hosted and which other companies process it.
7. Have a breach plan. Who decides, who contacts the Commissioner, who tells customers.
8. Handle requests. Customers can ask to see, correct or move their data. Know how you’ll find it.

How ezychat.io fits

ezychat.io hosts your data on AWS in Singapore, isolates each business at the database row, gives every teammate their own login and role, and keeps an audit trail of important actions. Our privacy policy lists every provider that processes data and where. Read the details on our trust page.