Malaysia PDPA 2010 36-37: Sections 36 and 37: refusing correction only on a listed ground, with a note annexed to disputed opinions

A data controller may refuse correction only where identity or authority is unproven, the inaccuracy is not shown, it is not satisfied the data is wrong or that the proposed correction is right, or another controller prevents it (then correcting as far as possible). It must notify the refusal and reasons (and any other controller's name and address) in writing within 21 days. Where the data is an expression of opinion (including an unverifiable assertion of fact) that it does not accept is wrong, it must annex a note of the requestor's objection so that no one uses the data without seeing the note, and attach a copy of the note to the refusal; failure is an offence (fine up to RM100,000, imprisonment up to one year or both).