Malaysia PDPA 2010 9(1): Section 9(1): practical security steps by data controllers and data processors, having regard to five factors

A data controller and (since 1 April 2025) a data processor must, when processing personal data, take practical steps to protect it from loss, misuse, modification, unauthorised or accidental access or disclosure, alteration or destruction, having regard to the nature of the data and the harm that would result, where it is stored, the security built into the storage equipment, measures ensuring the reliability, integrity and competence of personnel with access, and measures ensuring secure transfer.