Malaysia PDPA 2010 12B(2): Section 12B(2): notify affected data subjects of a significant-harm breach within 7 days of notifying the Commissioner

Where the breach causes or is likely to cause significant harm to data subjects (the scale test does not apply here), the data controller must notify each affected data subject without unnecessary delay and no later than 7 days after the initial notice to the Commissioner, directly and individually in intelligible language (e-mail, SMS, direct message, post), stating the breach, its likely consequences, the controller's measures, the steps data subjects can take to protect themselves and the DPO or other contact point; public communication (website, print media, official social media, push notification) may be used only where direct notice is impracticable or needs disproportionate effort, and the notice must be sent separately from newsletters or routine messages. Encryption rendering data unintelligible may mean no significant harm to data subjects.