PDPA Amendment 2024 in Malaysia: cross-border transfer rules and hosting outside Malaysia
The 2024 amendment rewrote the rules for sending personal data outside Malaysia. Here is what the official texts say, and what it means if your server is in the EU. As of 30.09.2026.
Short answer
- 1The Personal Data Protection (Amendment) Act 2024 (Act A1727) changed section 129 of the PDPA 2010: the old rule that relied on a Ministerial whitelist of places was deleted, and a data controller may now transfer personal data outside Malaysia if the destination has a substantially similar law or ensures an adequate level of protection.
- 2The Personal Data Protection Commissioner explains how to apply that test in Guidelines No. 3/2025 on Cross Border Personal Data Transfer, issued on 29 April 2025. They also list other routes, such as the data subject's consent or reasonable precautions backed by binding corporate rules, contractual clauses or certification.
- 3Hosting on a server in the EU is a cross-border transfer if the data concerns people in Malaysia and you are the controller. Whether your transfer is lawful depends on your facts, so ask your legal adviser.
- 44hosting operates from datacentres in Frankfurt, not in Malaysia, and does not certify legal compliance for clients.
- 5As of 30.09.2026. This page is general information, not legal advice.
What the amendment changed about transfers abroad
Section 12 of Act A1727 amends section 129 of the PDPA 2010. It deletes subsection (1), the general prohibition on transfers outside Malaysia except to places specified by the Minister, and rewrites subsection (2) so that a data controller may transfer personal data to any place outside Malaysia where a law substantially similar to the Act is in force, or that ensures an adequate level of protection at least equivalent to the Act. It also deletes the former paragraph (h) from the list of exceptions in subsection (3).
The Act says it comes into operation on a date appointed by the Minister by gazette notification, and different provisions may start on different dates. Check the PDP website for the date that applies to each provision before you rely on it.
What the Commissioner's cross-border guidelines say
Guidelines No. 3/2025, issued by the Commissioner on 29 April 2025, state the conditions in paragraph 4. Besides the two tests above, a controller may transfer where the data subject has consented, where the transfer is necessary to perform a contract with the data subject, or where the controller has taken all reasonable precautions and exercised all due diligence that the data will not be processed abroad in a way that would breach the Act if the place were Malaysia.
For that last route, the guidelines name three mechanisms: binding corporate rules, contractual clauses, or certification under an approved scheme. To rely on a substantially similar law or an adequate level of protection, the guidelines expect a transfer impact assessment, and its findings are valid for no longer than three years.
Other new duties in the same Act
Act A1727 also adds section 12A, which requires a data controller, and a data processor acting for it, to appoint at least one data protection officer, and requires the controller to notify the Commissioner of the appointment.
New section 12B requires a controller who has reason to believe a personal data breach has occurred to notify the Commissioner as soon as practicable, in the manner and form the Commissioner determines, and to notify affected data subjects without unnecessary delay where significant harm is likely. The Commissioner has issued a circular on breach notification; read it on the PDP website for the exact procedure and timing.
Two Malaysian scenarios
A Selangor online shop using an EU VPS
The shop's customer records sit on a server in Frankfurt. As controller, the shop owner reviews which transfer route applies, records the decision, and keeps the contract with the hosting provider on file.
A Johor software firm with clients across the region
The firm hosts a client's application data as processor. It checks with the client, who is the controller, which mechanism the client relies on before moving the data to servers outside Malaysia.
Common mistakes
- Treating hosting abroad as a purely technical choice and not recording any transfer decision.
- Relying on the old Ministerial whitelist, which section 129 no longer uses.
- Assuming the hosting provider's certificate or contract replaces the controller's own assessment.
- Ignoring the new duties to appoint a data protection officer and to notify breaches.
How 4hosting helps
Our datacentres are in the EU (Frankfurt), not in Malaysia. We provide a data processing agreement under GDPR Article 28 and standard contractual clauses for transfers, and we invoice in EUR.
We align with ISO 27001 but hold no ISO 27001, SOC 2 or NIS2 certification, and we do not certify or sign legal compliance for you. Your legal adviser decides which transfer route applies to your data.
Talk to us about your hosting →Frequently asked questions
Is hosting in the EU allowed for Malaysian personal data?
Section 129 as amended allows transfers abroad under set conditions, and the Commissioner's Guidelines No. 3/2025 explain them. Whether your transfer meets them depends on your circumstances, so ask your legal adviser.
Does 4hosting certify PDPA compliance?
No. We align with ISO 27001 but hold no certificate, and we do not sign legal compliance for clients. We offer a data processing agreement and standard contractual clauses for transfers.
Where are the servers?
In the EU, in Frankfurt, not in Malaysia. Invoices are issued in EUR.