Malaysia PDPA 2010

Part II Division 4: rights of data subjects (sections 30 to 44) – Malaysia PDPA 2010

Malaysia PDPA 2010 38: Section 38: stop processing when consent is withdrawn by written notice

A data subject may withdraw consent to processing by written notice, and the data controller must cease processing on receiving it; failure is an offence (fine up to RM100,000, imprisonment up to one year or both). Not withdrawing does not affect the data subject's other rights.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Part II Division 4: rights of data subjects (sections 30 to 44) – Malaysia PDPA 2010

30-31 Sections 12, 30 and 31 with regulation 9: data access requests answered within 21 days (plus 14 with written reasons)
32-33 Sections 32 and 33 with regulation 10: refusing an access request only on a listed ground and notifying the refusal within 21 days
34-35 Sections 34 and 35 with regulation 11: correcting data within 21 days, telling recent third-party recipients, transferring to a better-placed controller
36-37 Sections 36 and 37: refusing correction only on a listed ground, with a note annexed to disputed opinions
40 Section 40: sensitive personal data (including biometric data since 1 April 2025) only with explicit consent or a listed necessity
42 Section 42: responding within 21 days to a notice to stop processing likely to cause substantial damage or distress
43 Section 43: stop processing for direct marketing on written notice
43A Section 43A: data portability on an electronic written request, subject to technical feasibility and format compatibility

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Malaysia PDPA 2010 controls