Malaysia PDPA 2010

Part II Division 4: rights of data subjects (sections 30 to 44) – Malaysia PDPA 2010

Malaysia PDPA 2010 44: Section 44: records of applications, notices, requests and other information

What does 44 require?

A data controller must keep and maintain a record of every application, notice, request or other information relating to personal data it has processed or is processing, in the manner and form the Commissioner may determine; the record forms part of the personal data system open to inspection under s. 101.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Part II Division 4: rights of data subjects (sections 30 to 44) – Malaysia PDPA 2010

30-31 Sections 12, 30 and 31 with regulation 9: data access requests answered within 21 days (plus 14 with written reasons)
32-33 Sections 32 and 33 with regulation 10: refusing an access request only on a listed ground and notifying the refusal within 21 days
34-35 Sections 34 and 35 with regulation 11: correcting data within 21 days, telling recent third-party recipients, transferring to a better-placed controller
36-37 Sections 36 and 37: refusing correction only on a listed ground, with a note annexed to disputed opinions
38 Section 38: stop processing when consent is withdrawn by written notice
40 Section 40: sensitive personal data (including biometric data since 1 April 2025) only with explicit consent or a listed necessity
42 Section 42: responding within 21 days to a notice to stop processing likely to cause substantial damage or distress
43 Section 43: stop processing for direct marketing on written notice

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Malaysia PDPA 2010 controls