Malaysia PDPA 2010 9(2): Sections 9(2) and 5(1a): data processors give sufficient security guarantees and are directly liable under the Security Principle

Since 1 April 2025, where a data processor processes personal data for a data controller, the processor itself must provide sufficient guarantees about the technical and organisational security measures governing the processing and take reasonable steps to ensure compliance with them, and must comply with the Security Principle (s. 5(1a)); a processor in breach commits an offence under s. 5(2) (fine up to RM1,000,000, imprisonment up to three years or both). Regulation 6(3) still requires the controller to ensure its processors comply with the security standard.