Malaysia PDPA 2010 32-33: Sections 32 and 33 with regulation 10: refusing an access request only on a listed ground and notifying the refusal within 21 days

A data controller may refuse an access request only where identity or relevant-person status is not established (name, identity card number, address and related information, reg. 10), the data cannot be located from what was supplied, the burden or expense is disproportionate to the privacy risk, compliance would disclose another identifiable individual (unless consented or reasonable, weighing confidentiality, consent attempts, capacity and refusal), another controller prevents it (then complying as far as possible), a court order would be breached, confidential commercial information would be disclosed, or another law regulates access. The refusal and reasons, and the other controller's name and address where relevant, must be notified in writing within 21 days of receipt.