From 1 June 2025 a data controller, and a data processor processing for a controller, must appoint one or more data protection officers accountable to it for compliance with the Act; appointment does not discharge the controller or processor from any duty. Under Circular 1/2025 the duty applies where processing involves personal data of more than 20,000 data subjects, sensitive personal data including financial information of more than 10,000 data subjects, or activities requiring regular and systematic monitoring (such as tracking and profiling for behavioural advertising, telecommunications networks, wearables health monitoring, CCTV or connected devices). The DPO may be an employee or outsourced, part-time or full-time, may serve several entities if easily accessible, must be resident in Malaysia (180 days a year) or easily contactable, and proficient in Malay and English; the controller must ensure adequate knowledge of the Act, the business, IT and security, integrity and training. Organisations below the thresholds may record why no DPO was appointed.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.