Malaysia PDPA 2010

Part II Division 1: the Personal Data Protection Principles (sections 5 to 12) – Malaysia PDPA 2010

Malaysia PDPA 2010 10: Section 10: retention no longer than necessary and destruction or permanent deletion when no longer required

Personal data processed for a purpose must not be kept longer than necessary to fulfil that purpose, and the data controller must take all reasonable steps to ensure it is destroyed or permanently deleted when no longer required for that purpose; regulation 7 requires retention in accordance with the Commissioner's retention standard.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Part II Division 1: the Personal Data Protection Principles (sections 5 to 12) – Malaysia PDPA 2010

11 Section 11: accurate, complete, not misleading and up-to-date data
6(1)-(2) Section 6(1) and (2): consent, or one of the six statutory grounds, before processing; sensitive data only under section 40
6(3) Section 6(3): lawful purpose directly related to the controller's activity, necessity and adequacy without excess
7(1) Section 7(1): written notice to the data subject with the eight required items, including the contact details in regulation 4
7(2)-(3) Section 7(2) and (3): notice at first request or collection, or before a new use or third-party disclosure, in Malay and English
8 Sections 8 and 39: no disclosure beyond the collection purpose or the notified classes of third parties without consent or a section 39 ground
9(1) Section 9(1): practical security steps by data controllers and data processors, having regard to five factors
9(2) Sections 9(2) and 5(1a): data processors give sufficient security guarantees and are directly liable under the Security Principle

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Malaysia PDPA 2010 controls