Malaysia PDPA 2010
Sensitive Data and Children - Malaysia PDPA

Malaysia PDPA 2010 MY-PDPA-Sensitive-Personal-Data-Section-40-Health-Religious-Political-Sexual-Children-Explicit-Consent: Malaysia PDPA Sensitive Personal Data + Section 40 + Health + Religious + Political + Children + Explicit Consent

Process sensitive personal data and children data only under Section 40 explicit consent or narrow exceptions. Sensitive categories include physical or mental health condition + political opinion + religious or other beliefs + commission or alleged commission of any offence + sexual orientation (added 2024 Amendment) + biometric data (added 2024 Amendment) + financial data (PDPC guidance). Processing prohibited unless explicit consent + necessary for legal claim + vital interests + manifestly made public by data subject + employment law obligation + medical purposes by health professional + insurance underwriting. Children below 18 require parental or guardian explicit consent (post 2024 Amendment alignment with EU GDPR Article 8). Marketing to children restricted. Special protections for biometric authentication + facial recognition processing under CSM Guidelines. Public Consultation 3/2024 on Sensitive Data + Children Processing.

Maintained by Gerard BlokdykVerified against the published standard Control text last updated

What else in your programme already covers this

This control maps to 90 controls across 52 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

ISO 27043 · 4 controls

ISO/SAE 21434 · 4 controls

NIST Post-Quantum Cryptography Standards (FIPS 203, 204, 205) · 4 controls

  • PQC-2 FIPS 203 ML-KEM Implementation - Module-Lattice Key-Encapsulation Mechanism
  • PQC-5 Cryptographic Inventory and PQC Migration Roadmap
  • PQC-7 FIPS Validated Modules, HSM Readiness, and Algorithm Validation
  • PQC-8 Implementation Requirements - RNG, Side-Channel, Key Management, Operations, Incident Response

CISA Cross-Sector Cybersecurity Performance Goals (CPG) 2.0 · 3 controls

ISO/IEC 23837 - Security Requirements for Quantum Key Distribution · 3 controls

MARS-E · 3 controls

NIST SP 800-124 Revision 2 - Guidelines for Managing the Security of Mobile Devices · 3 controls

NIST SP 800-171A Rev 3 - Assessing CUI Security Requirements · 3 controls

AWWA Cybersecurity Guidance for the Water Sector (American Water Works Association) · 2 controls

FBI CJIS Security Policy · 2 controls

  • CJIS-8 Media Protection
  • CJIS-9 System and Communications Protection

ISO 13485 · 2 controls

ISO 27799 · 2 controls

OWASP ASVS · 2 controls

OWASP MASVS · 2 controls

OWASP Top 10:2025 · 2 controls

  • OWASPTOP10-2 A02:2025 Cryptographic Failures and Secret Management
  • OWASPTOP10-4 A04:2025 Insecure Design and Business Logic (incl. A11 API Abuse)

APPI · 1 control

  • APPI-A34 Request for Correction, Addition or Deletion

ASD Strategies to Mitigate Cyber Security Incidents · 1 control

  • ASD37-17 TLS encryption between email servers (Limited)

BSI IT-Grundschutz · 1 control

  • BSI-08 Cryptographic protection of data

Bahrain PDPL · 1 control

FFIEC IT Examination Handbook · 1 control

FIDO2 / WebAuthn · 1 control

FTC GLBA Safeguards Rule (16 CFR Part 314) · 1 control

  • FTC-Safeguards-9-Elements 9 Safeguard Elements - Access, Inventory, Encryption, Secure-Dev, MFA, Disposal, Change-Mgmt, Monitoring, Pen-Test (16 CFR 314.4(c))

Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (UAE PDPL) · 1 control

  • UAE-PDPL-Art.4_5 Lawful basis and principles for processing personal data (UAE PDPL Articles 4-5)

IEC 62351 - Power Systems Communication Security · 1 control

  • 62351-9 Cyber security key management

ISO 19011 · 1 control

  • 6.7 Conducting Audit Follow-up

ISO 22739:2024 - Blockchain and Distributed Ledger Technologies Vocabulary · 1 control

ISO 27005 · 1 control

  • 9.1 Risk communication and consultation

ISO 27017 · 1 control

ISO 27018 · 1 control

ISO/IEC 27010:2015 · 1 control

ISO/IEC 27011:2024 · 1 control

ISO/IEC 27400:2022 · 1 control

ISO/IEC 27557:2022 - Organisational Privacy Risk Management · 1 control

ISO/IEC 29115:2023 - Entity Authentication Assurance Framework · 1 control

MARS-E - Minimum Acceptable Risk Standards for Exchanges · 1 control

MDS2 (Medical Device) · 1 control

MITRE ATT&CK · 1 control

MITRE D3FEND · 1 control

MTCS (Singapore) · 1 control

Maryland Online Data Privacy Act of 2024 · 1 control

Mauritius DPA · 1 control

Mexico LFPDPPP · 1 control

Minnesota Consumer Data Privacy Act · 1 control

Monetary Authority of Singapore Technology Risk Management Guidelines · 1 control

Montana Consumer Data Privacy Act · 1 control

NIST Special Publication 800-34 Revision 1, Contingency Planning Guide for Federal Information Systems · 1 control

  • NISTSP34-3 Preventive Controls and Recovery Strategies: Backup, Alternate Sites, Equipment

OWASP API Security Top 10 - 2023 · 1 control

  • OWASPAPI-6 Security Misconfiguration and Secure API Design

Privacy Act 1988 (Australia) · 1 control

  • AUPRV-4 APP 10-11 Quality, Security of Personal Information

Singapore Government Instruction Manual on ICT&SS Management (IM8) · 1 control

South Korea ISMS-P · 1 control

Switzerland New Federal Act on Data Protection (nFADP/nDSG, 2023) · 1 control

Turkey KVKK · 1 control

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.

Query this from an agent

The graph holds this control, the 90 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpointAll Malaysia PDPA 2010 controls