Pursuant to the Amendment Act, the data controllers may transfer any personal data of a data subject out of Malaysia to a country that has substantially similar laws or where the country ensures equivalent levels of protection to that of the PDPA. These amendments have come into force on April 01, 2025.

Even if these requirements are not satisfied, the cross-border transfer is permissible if it falls within the exceptions to this restriction under the PDPA, including the following:

• The data subject has given his or her consent to the transfer;
• The transfer is necessary for the performance of a contract between the data subject and the data controller;
• The data controller has taken all reasonable steps and exercised all due diligence to ensure that the personal data will not be processed in a manner that would contravene the PDPA; and
• The transfer is necessary to protect the data subject’s vital interests.

Additionally, the PDP Department has issued the Personal Data Protection Guidelines on Cross-Border Personal Data Transfer (CBPDT Guidelines) on April 29, 2025. The CBPDT Guidelines, among others, provides that the data controllers, who wish to transfer the data out of Malaysia on the ground that the destination has laws that are substantially similar to PDPA or has equivalent levels of protection, must conduct a Transfer Impact Assessment (TIA). The CBPDT Guidelines also recognised the adoption of cross border transfer mechanisms such as Binding Corporate Rules (BCRs), Standard Contractual Clauses (SCCs) and certifications under an approved certification scheme.

Under the CBPDT Guidelines, when a data controller enters into a contract with a third party or data processor, it shall include clauses on the processing of personal data, including the security of the data. The data controller is also responsible to ensure the data processor complies with the Security Principle and other subsidiary legislation, standard or guidelines relating to the protection of personal data.