Malaysia PDPA 2010 30-31: Sections 12, 30 and 31 with regulation 9: data access requests answered within 21 days (plus 14 with written reasons)

An individual is entitled to be told whether their personal data is processed by or for the data controller and, on a written data access request with the prescribed fee, to information about the data and a copy in intelligible form (one request, separate requests for separate entries). The controller must acknowledge receipt (reg. 9(2)) and comply within 21 days; if unable, it must before then give written reasons and comply as far as it can, and comply fully within a further 14 days. A controller that controls the processing so as to prevent the holder complying is treated as holding the data.