Malaysia PDPA 2010 6(1)-(2): Section 6(1) and (2): consent, or one of the six statutory grounds, before processing; sensitive data only under section 40

A data controller must not process personal data (other than sensitive personal data) without the data subject's consent, and may process sensitive personal data only as section 40 allows. Without consent, processing is permitted only where necessary for performing a contract with the data subject, for pre-contract steps the data subject requested, for a non-contractual legal obligation of the controller, to protect the data subject's vital interests (life, death or security), for the administration of justice, or for functions conferred by law. Breach of any principle is an offence under s. 5(2) punishable (from 1 April 2025) by a fine up to RM1,000,000, imprisonment up to three years or both.