Malaysia PDPA 2010 STD-6: Standard 2015 para. 6: retention standard (disposal records, 14-day form disposal, 24-month inactive data schedule)

To destroy or permanently delete data no longer required, the data controller must: check all legal retention requirements before destruction; keep data no longer than necessary unless another law requires longer; keep proper disposal records producible to the Commissioner; dispose of personal data collection forms used in commercial transactions within 14 days unless they carry legal value for the transaction; review and dispose of unwanted data in databases; maintain a disposal schedule for data inactive for 24 months; and not use removable media to store personal data without written top-management approval.