Malaysia PDPA 2010

Part II Division 1: the Personal Data Protection Principles (sections 5 to 12) – Malaysia PDPA 2010

Malaysia PDPA 2010 6(3): Section 6(3): lawful purpose directly related to the controller's activity, necessity and adequacy without excess

Personal data may be processed only for a lawful purpose directly related to an activity of the data controller, where the processing is necessary for or directly related to that purpose, and where the data is adequate but not excessive in relation to that purpose.

Maintained by Gerard BlokdykVerified against the published standard 31 May 2026Control text last updated 21 May 2026

Other controls in Part II Division 1: the Personal Data Protection Principles (sections 5 to 12) – Malaysia PDPA 2010

10 Section 10: retention no longer than necessary and destruction or permanent deletion when no longer required
11 Section 11: accurate, complete, not misleading and up-to-date data
6(1)-(2) Section 6(1) and (2): consent, or one of the six statutory grounds, before processing; sensitive data only under section 40
7(1) Section 7(1): written notice to the data subject with the eight required items, including the contact details in regulation 4
7(2)-(3) Section 7(2) and (3): notice at first request or collection, or before a new use or third-party disclosure, in Malay and English
8 Sections 8 and 39: no disclosure beyond the collection purpose or the notified classes of third parties without consent or a section 39 ground
9(1) Section 9(1): practical security steps by data controllers and data processors, having regard to five factors
9(2) Sections 9(2) and 5(1a): data processors give sufficient security guarantees and are directly liable under the Security Principle

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All Malaysia PDPA 2010 controls