Under the Amendment Act to PDPA, the data controller or data processor is required to appoint one or more DPO who shall be accountable to the data controller or data processor for the compliance with the PDPA. Such appointment will not discharge the data controller or data processor from all their duties and functions under the PDPA. This requirement has come into force on June 01, 2025.

The DPO Guidelines, provides that according to the Circular of Personal Data Protection Commissioner No. 01/2025 (Appointment of Data Protection Officer), the mandatory DPO appointment requirement applies only to data controllers or data processors where their processing of personal data involves:

• Personal data exceeding 20,000 data subjects;
• Sensitive personal data including financial information data exceeding 10,000 data subjects; or
• Involves activities that require regular and systematic monitoring of personal data.

Although the DPO Guidelines provides there is no minimum professional qualification required to being appointed as a DPO, they are required to demonstrate the following skills, qualities and expertise at a sound level:

• Knowledge on PDPA and requirements of data protection laws in the country;
• Understanding of the data controller or data processor’s business operations and the personal data processing operations that are carried out;
• Understanding of information technology and data security;
• Personal qualities such as integrity, understanding of corporate governance and high professional ethics; an
• Ability to promote data protection culture within the organisation.

To complement the DPO Guidelines, the DPO Competency Guideline was issued which outlines the core competencies expected, and the knowledge, skills and abilities expected of the DPO in those competencies to provide risk-based guidance to companies on appointing their DPO. Whereas the DPO Development Roadmap sets out a prospective development pathway and training roadmap to support the appointed DPOs. The DPO Training Provider Guidelines also provides a prospective framework to formally recognise and exercise oversight on training providers.

A DPO is allowed to carry out additional job functions beyond their data-specific roles as a DPO, provided it does not cause a conflict of interest. Additionally, it is also essential to note that a single DPO is allowed to serve multiple entities, provided the DPO is easily accessible to these entities receiving the DPO’s service. Hence, a data controller or data processer may appoint the DPO from existing employees or through an outsourcing service. To ensure responsiveness and accessibility, it is required the DPO shall be:

• Resident in Malaysia; or
• Easily contactable via any means; or
• Proficient in Bahasa Melayu (the local language) and English language

The data controller or data processor who is required to appoint a DPO is required to register their appointed DPO by providing a notification to the Commissioner.

The DPO’s contact information shall be published at least on the official website or other official media of the data controller or data processor, in the personal data protection notice and/or in the security policies and guidelines.