Frameworks / Malaysia PDPA 2010 / MY-PDPA-Cross-Border-Transfer-Section-129-Whitelist-Abolition-2024-Adequacy-SCC-BCR-Processor-Direct-Marketing Malaysia PDPA 2010
Cross-Border Transfer and Processor - Malaysia PDPA
Malaysia PDPA 2010 MY-PDPA-Cross-Border-Transfer-Section-129-Whitelist-Abolition-2024-Adequacy-SCC-BCR-Processor-Direct-Marketing: Malaysia PDPA Cross-Border + Section 129 + Whitelist Abolition 2024 + Adequacy + SCC + BCR + Processor + Marketing Govern cross-border transfers + data processor relationships + direct marketing under Sections 4 + 129 + 43 as amended 2024. Original Section 129 whitelist approach (transferring only to Minister-gazetted whitelisted jurisdictions) ABOLISHED by 2024 Amendment + replaced with adequacy assessment + Standard Contractual Clauses (Malaysia SCC published by PDPC 2024) + Binding Corporate Rules + explicit consent + necessary for contract + vital interests + legal claims. Data processor obligations - 2024 Amendment introduced direct obligations on data processors (previously only data users) including security + breach notification + processor agreement + sub-processor authorisation + records of processing + cooperation with PDPC. Aligns with EU GDPR Article 28 processor regime. Direct marketing opt-out (Section 43) - unconditional free opt-out from electronic + telephone + postal marketing. Do Not Call Registry coordination with MCMC. Cookie consent + behavioural advertising under PDPC 2020 Guidelines + 2024 Amendment digital marketing rules.
What else in your programme already covers this This control maps to 356 controls across 109 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
APPI-A23 Security Control Measures APPI-A24 Supervision of Employees APPI-A26 Report of Leakage to the Commission and Notification to the Person APPI-A33 Request for Disclosure of Retained Personal Data APPI-A41 Preparation and Handling of Pseudonymized Personal Information APPI-A43 Preparation of Anonymized Personal Information BSI-03 Multi-factor authentication requirements BSI-04 Remote access controls BSI-05 Wireless access restrictions BSI-18 Incident response planning and testing BSI-20 Incident reporting and notification BSI-21 Forensic analysis capabilities GDPR-Art.10 Processing of personal data relating to criminal convictions GDPR-Art.11 Processing which does not require identification GDPR-Art.15 Right of access by the data subject GDPR-Art.19 Notification obligation regarding rectification, erasure or restriction GDPR-Art.45 Transfers on the basis of an adequacy decision GDPR-Art.9 Processing of special categories of personal data BB-DPA-14 Section 15 - Right to Data Portability BB-DPA-16 Section 22 - General Principle for Transfers BB-DPA-17 Section 24 - Appropriate Safeguards BB-DPA-20 Sections 50-60 - Registration and Responsibilities BB-DPA-21 Sections 61-69 - Data Privacy Officer AUPRV-3 APP 6-9 Use/Disclosure, Direct Marketing, Cross-Border, Government Identifiers AUPRV-4 APP 10-11 Quality, Security of Personal Information AUPRV-6 Sensitive Information, PIA, Privacy by Design, Children AUPRV-7 Notifiable Data Breaches (NDB) Scheme, Incident Response AUPRV-8 OAIC Cooperation, Vendor Management, Training, Complaints, Enforcement APP-1 APP 1 - Open and transparent management of personal information APP-3 APP 3 - Collection of solicited personal information APP-5 APP 5 - Notification of the collection of personal information APP-8 APP 8 - Cross-border disclosure of personal information DIQ-2 Data Quality Management DIQ-3 Metadata Management DSO-2 Data Security DSO-3 Data Access Management EHDS-HOLD-3 Dataset Descriptions and Catalogues EHDSREG-1 Mandatory Requirements for EHR Systems (Articles 14-29) EHDSREG-4 Digital Health Authorities, Governance, MyHealth@EU EHDSREG-5 Cross-Border Health Data Flows AT-DSG-11 Sections 42-45 - Data subject rights (law enforcement) AT-DSG-13 Section 36 - Scope of law enforcement processing AT-DSG-14 Section 38 - Lawfulness of law enforcement processing FFIEC-23 Regulatory reporting requirements FFIEC-24 Customer notification procedures FFIEC-25 Post-incident review and improvement FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c)) FTC-Safeguards-IR-Plan-BoardReporting-FTC-Notification Written Incident Response Plan + Board Reporting + FTC Breach Notification (16 CFR 314.4(h), (i), (j)) FTC-Safeguards-Scope-Defs Scope, Definitions and Financial Institution Applicability (16 CFR 314.1, 314.2) 3.10 Encrypt Sensitive Data in Transit 3.6 Encrypt Data on End-User Devices 3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary. PAKPDPB-5 Security of Processing and Personal Data Breach Notification PAKPDPB-6 Cross-Border Transfer and Data Localization PAKPDPB-8 Enforcement, Penalties, Complaints, Retention, Training PSPF24-1 Security Culture, Governance, Risk Management PSPF24-2 Information Security, Cybersecurity Maturity, Essential Eight PSPF24-4 Physical Security CPS234-21 Implementation of Information Security Controls CPS234-25 Internal Audit Review of Information Security Controls ASD37-31 Hunt to discover incidents (Very Good) ASD37-33 Capture network traffic (Limited) CA-10 Selects and Develops Control Activities CA-12 Deploys Through Policies and Procedures FDBR-ControllerObligations-DPA-Notice Controller + Processor Obligations + Data Protection Assessments (Fla. Stat. 501.707, 501.708, 501.71, 501.711) FDBR-Scope-Defs Scope, Applicability Thresholds and Definitions (Fla. Stat. 501.701, 501.702, 501.703, 501.704) DSOMM-1 Culture, Organization, Education, and Governance DSOMM-3 Build, Deployment, Infrastructure Hardening, and Secrets Management RUSPD-1 Scope, Definitions, Principles under 152-FZ RUSPD-4 Special Categories, Biometric Data D.1 Incident Response Planning D.2 Incident Reporting CYB-5 Cyber Incident Response Plan USMTSA-2 Cybersecurity Assessment and CSO Designation CPS230-13 Board Accountability for Operational Risk Management 4.4.7 Emergency and Incident Response DS-2 Ensure software supply chain security ICP-25 Supervisory Cooperation and Coordination 62351-8 Role-based access control (RBAC) NIS2I-6 Access Control, Asset Management, and Physical Security NISTPF-1 Identify-P - Business Environment, Data Processing Inventory, Ecosystem, and Risk Assessment 3.6.1 Procedures are defined and implemented to protect cryptographic keys used to protect stored account data against disclosure and misuse that include: • Access to keys is restricted to the fewest number of custodians necessary. NGCB-6 Incident Response, 72-Hour NGCB Notification, and Independent Investigation OWASPAPI-1 Broken Object Level Authorization (BOLA) and BFLA OWASPLLM-3 Sensitive Information Disclosure and Privacy (LLM02) RIDTPPA-2 Consumer Rights (Access, Correction, Deletion, Portability, Opt-Out) SGCYBER-1 Critical Information Infrastructure (CII) Designation and Registration TEFCAREC-1 Common Agreement Conformance and Onboarding USCOPPA-3 Data Minimisation, Retention, Erasure (Eraser Button) USSDWA-2 Cybersecurity Practices (Assessment, Access, Network, IR) VPSHR-3 Implementation Guidance and Reporting Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected .
Query this from an agent The graph holds this control, the 356 it maps to, and the evidence behind each claim, over MCP and REST.