Since 1 April 2025 the ministerial whitelist is gone: a data controller may transfer personal data to any place outside Malaysia where that place has in force a law substantially similar to the Act, or ensures an adequate level of protection at least equivalent to the Act's. Guideline 3/2025 has the controller support either finding with a transfer impact assessment (identify the receiving countries, assess against the listed factors: rights of access and correction, equivalent principles, rules on collection, disclosure, retention and onward transfer, a DPO, breach notification, processor duties and an enforcing regulator; or, for adequacy, the receiver's security measures, certifications, enforceable obligations, compliance history and regulator), valid for no more than three years and reviewed on any change in the law or the receiver's systems. Contravening s. 129 is an offence (fine up to RM300,000, imprisonment up to two years or both).
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.