Data Protection Officer Malaysia: Who Must Appoint and How

1. What Is a Data Protection Officer Under Malaysia’s PDPA?

Quick Answer: A data protection officer (DPO) is the named person who oversees a business’s compliance with the Personal Data Protection Act 2010. Section 12A, added by the 2024 amendment, requires both data controllers and data processors to appoint one or more DPOs when they meet the Commissioner’s conditions. The requirement took effect on 1 June 2025.

The Personal Data Protection (Amendment) Act 2024 brought in the duty, and the Commissioner’s Guideline on the Appointment of Data Protection Officer, issued on 25 February 2025, sets out who must appoint and how. For marketers, three points matter:

• It covers processors too. An agency, CRM vendor or call centre handling your leads can need its own DPO. Our guide to agency data processor duties under PDPA covers that side.
• It does not shift liability. The guideline states that the business stays responsible for any breach of the Act, DPO or not.

For consent, opt-outs and breach reporting, our PDPA compliance checklist for marketers covers the full list. This post goes deeper on the DPO decision alone.

2. Who Must Appoint a DPO in Malaysia? The Three Tests

Quick Answer: You must appoint a DPO if you meet any one of three tests: personal data of more than 20,000 people, sensitive personal data including financial information of more than 10,000 people, or processing that involves regular and systematic monitoring. Headcount and revenue are not part of the test. One test is enough.

Paragraph 4.2 of the guideline lists the tests. They are “or” conditions, so a small company with a big lead database qualifies too.

The sensitive data test catches more forms than owners expect. If a lead form asks about medical conditions, beliefs or income bands, read our guide to sensitive personal data in lead forms first. If you store card details yourself rather than through a payment gateway, the PCI DSS rules for small online stores apply on top.

3. Does Retargeting Count as “Regular and Systematic Monitoring”?

Quick Answer: It can. The guideline’s own first example says any activity where people are tracked and profiled online or offline for behavioural advertising counts as regular and systematic monitoring. A retail website that uses algorithms to recommend products from searches and purchases is a second example. A loyalty programme run only to manage accounts may not count.

Paragraph 4.3 uses advertising and e-commerce examples directly. The table maps common activities against them. It is ZenWeb’s reading, not an official ruling; the guideline does not say how far “tracked and profiled” goes for basic pixel use.

Two practical notes. If you send hashed customer data to Meta, read Meta Conversions API and PDPA before your next upload. If your loyalty scheme also tracks spending patterns to target offers, it moves away from the “account management only” example; our guide to loyalty programme data under PDPA explains where that line sits.

4. How to Count Your Marketing Contacts Against the 20,000 Line

Quick Answer: Count unique people, not records, across every system that holds personal data: CRM, form submissions, email lists, WhatsApp contacts, booking tools and uploaded ad audiences. The guideline does not set a counting method or a date to measure on, so count conservatively and keep a dated record of how you did it.

“Data subjects” means people. One customer in your CRM, newsletter and WhatsApp list is one data subject. The guideline is silent on old, inactive records, so the safe reading is that anything you still hold counts. That is another reason to set a retention period, covered in how long you can keep leads under PDPA.

Here is the sum for a typical online retailer, using illustrative figures, not client data.

No single list comes near 20,000, yet combined the business is over the line. Bought or rented lists count too; see whether buying lead lists is legal under PDPA. Keep a short counting checklist:

1. List every system. CRM, e-commerce platform, form plugin, email tool, WhatsApp, booking app, spreadsheets.
2. Export and match. Remove duplicates by phone number or email.
3. Separate sensitive fields. Count people with health, belief or financial data on their own against the 10,000 line.
4. Date and file the result. Repeat at least once a year, or after a big campaign.

5. Who Can Be Your DPO? Can Your Head of Marketing Do It?

Quick Answer: Your DPO can be an existing employee or an outsourced individual or firm, full-time or part-time. There is no minimum professional qualification. But the guideline specifically says a Head of Marketing running campaigns should not take the role, because maximising reach and sales conflicts with safeguarding customer data.

Paragraph 6.2 names records managers and compliance officers as less likely to conflict. Whoever you pick, the guideline expects them to show:

• Knowledge of the Act. Act 709 and data protection practice in Malaysia.
• Understanding of your business. Including how marketing collects and uses data.
• IT and data security sense. Enough to question how forms, plugins and tracking store data.
• Integrity and governance. Plus the ability to build a data protection culture.
• Language and access. Proficient in Bahasa Melayu and English, and either resident in Malaysia (at least 180 days a year) or easily contactable.

If you outsource, the guideline recommends a contract of at least two years and a named lead contact at the provider. Put scope, duties and invoices in writing, with the same checks we list in what an SST invoice must show. The DPO also needs a direct line to senior management.

6. How to Appoint and Register a Data Protection Officer

Quick Answer: Appoint the DPO in writing, create a dedicated DPO email address, then register the appointment and business contact details on the Personal Data Protection System at daftar.pdp.gov.my within 21 days. Publish the contact on your website and privacy notice, and update any change within 14 days.

These steps follow paragraphs 7 and 15 of the guideline:

1. Record the test result. File your contact count and monitoring review, dated.
2. Choose and appoint. Issue an appointment letter or sign the outsourcing contract, with duties spelt out.
3. Create a dedicated DPO mailbox. It must be separate from the person’s own work email and monitored at all times, for example a role address on your domain.
4. Register on the SPDP portal. Submit the DPO’s business contact information through the Commissioner’s registration portal within 21 days of appointment. The Commissioner publishes a DPO registration user guide.
5. Publish the contact. On your website and official media, in your personal data protection notice, and in your security policies.
6. Announce it internally. Tell staff who the DPO is and when to involve them, including campaign launches and new tools.
7. Keep it current. Update the portal within 14 days of any change, and name an interim person to watch the mailbox if the DPO leaves.

One point is unclear. Paragraph 7.1 words the registration duty for data controllers, while section 12A requires processors to appoint too. Processors should confirm with the Commissioner or a lawyer how to register.

The 72-hour breach clock comes from the Commissioner’s Data Breach Notification Guideline. What to do in those first hours is in our guide to data breach notification steps.

7. What Your Website and Marketing Must Show About the DPO

Quick Answer: Publish the DPO’s business contact information on your official website and other official media, in your personal data protection notice, and in security policies. Official media includes social media pages. In practice, that means the privacy notice, the website footer or contact page, and the points where marketing collects data.

The DPO becomes the public contact for anyone asking what you hold about them. Make that route easy to find:

• Privacy notice. Add a DPO section with the role mailbox. Our guide to the bilingual privacy notice rule covers the Bahasa Malaysia version.
• Lead forms. Point the short notice under each form to the DPO contact, including on Facebook Lead Ads forms.
• WhatsApp and broadcasts. Give an opt-out and DPO route in your profile and first message; see WhatsApp marketing and PDPA consent.
• Request handling. Route access and deletion requests to the DPO mailbox, following PDPA steps for access and deletion requests.

If your CRM or form data is hosted overseas, the DPO should also review the transfer under the cross-border data transfer rules. Form security matters as much as the notice; see our guide to PDPA security for web systems covers it.

8. What If You Don’t Need a DPO Yet?

Quick Answer: Keep a written record of why you do not meet the tests; paragraph 4.5 of the guideline allows this. Every other PDPA duty still applies to you in full. Recheck the count whenever a campaign, new tool or new data field could push you over a threshold.

Falling under the tests is not an exemption from the Act. Consent, notice, security and retention rules apply to a 500-contact list as much as a 50,000-contact one. And the amended Act raised the maximum fine for breaching the data protection principles to RM1 million. If you are under the line:

• Name an internal privacy contact anyway. Someone still needs to answer requests and complaints.
• Watch for growth triggers. A lead generation push, a new recommendation plugin or a loyalty launch can tip you over.
• Check your tools. AI chat and enrichment tools add data quickly; see AI and PDPA rules for marketers.
• Review analytics consent. Our guide to consent mode and PDPA in GA4 keeps tracking tidy.

9. Conclusion: Let Your Data Decide, Not Your Size

The data protection officer Malaysia rule turns on data, not headcount. As at October 2026, you need a DPO if you hold personal data of more than 20,000 people, sensitive or financial data of more than 10,000, or you regularly profile people for advertising. Count unique contacts across every marketing tool, keep the DPO role away from campaign owners, register within 21 days, and publish one role mailbox wherever you collect data. Then make sure your agency’s own processor duties are clear too, as set out in your agency and PDPA.

10. Frequently Asked Questions

1. Is a data protection officer mandatory in Malaysia?

Yes, if you meet any of the three tests in the Commissioner’s guideline: more than 20,000 data subjects, more than 10,000 with sensitive or financial data, or regular and systematic monitoring. The requirement has applied since 1 June 2025.

2. Does a small company need a DPO?

Company size is not a test. A small online business with a large customer and lead database, or one that profiles visitors for behavioural advertising, can still need a DPO.

3. How do I register a DPO?

Register the DPO’s business contact information on the Personal Data Protection System at daftar.pdp.gov.my within 21 days of appointment, and update any change within 14 days.

4. Can I outsource the DPO role?

Yes. The guideline allows an outsourced individual or firm, and recommends a contract of at least two years with a named lead contact.

5. Is ZenWeb a DPO service provider?

No. ZenWeb handles the marketing and website side, such as PDPA-friendly forms, privacy notice placement and tracking. Confirm your legal position with a licensed lawyer.