Malaysia PDPA 2010 12A(3): Section 12A(3): notify the Commissioner of the DPO within 21 days through SPDP and update changes within 14 days

The data controller must notify the Commissioner of the DPO appointment in the manner the Commissioner determines: by registering the DPO and their business contact information in the Personal Data Protection System (SPDP, daftar.pdp.gov.my) within 21 days of appointment, keeping it current, and updating any change of DPO or contact details within 14 days of the new appointment taking effect; on a DPO's departure a replacement is appointed within a reasonable time and an interim DPO monitors the DPO mailbox.