Every WhatsApp message, call recording and chat transcript your team handles holds personal data. In Malaysia that puts it under the PDPA, the Personal Data Protection Act 2010, which was tightened by the Personal Data Protection (Amendment) Act 2024 in three stages during 2025. This guide explains what PDPA Malaysia requires when you serve customers on WhatsApp, phone, website chat, email and AI, which dates and duties are now in force, and a practical checklist for a support or sales team.
It is written for business owners and customer service managers, not lawyers. If you are choosing a platform to run these conversations, we cover where JomConnect, our AI omnichannel customer platform, stores data near the end.
This is general information as of October 2026, not legal advice. For your own obligations, speak to a lawyer or check the Department of Personal Data Protection (PDP).
PDPA Malaysia in one paragraph
The PDPA applies to anyone who processes personal data in commercial transactions. Under the amended Act the business that decides why and how data is used is the data controller (the old term was “data user”), and a provider that handles data on its behalf, such as a cloud inbox or call recording service, is a data processor. Controllers must follow seven principles: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access (Lee Hishammuddin Allen & Gledhill summary).
For customer conversations, those principles boil down to: tell people what you collect and why, use it only for that, keep it secure, delete it when you no longer need it, and let customers see and correct it.
The 2024 amendments and their dates
The amendments came into force in three phases: 1 January, 1 April and 1 June 2025 (Halim Hong & Quek; DFDL). The changes that matter for a customer service operation:
| In force from | Change | What it means for you |
|---|---|---|
| 1 Apr 2025 | Higher penalties | Breaching the data protection principles now carries a fine of up to RM1 million, up to 3 years’ jail, or both (was RM300,000 and 2 years) |
| 1 Apr 2025 | Processors directly liable for security | Your inbox, chatbot or recording provider has its own legal duty to keep data secure |
| 1 Apr 2025 | Biometric data is sensitive personal data | Voiceprints, fingerprints or face data need stricter handling |
| 1 Apr 2025 | New cross-border transfer rules (section 129) | The old “whitelist” is gone; you assess the destination yourself |
| 1 Jun 2025 | Data breach notification | Report breaches to the Commissioner within 72 hours |
| 1 Jun 2025 | Data protection officer (DPO) | Appoint and register a DPO if you cross the thresholds |
| 1 Jun 2025 | Data portability | Customers can ask for their data to be sent to another controller, subject to the Commissioner’s rules |
Sources for the table: DFDL and LHAG (penalties, processors, transfers), Sidley (penalties, processors, biometric data), HHQ (1 June 2025 items).
Breach notification: 72 hours and 7 days
Since 1 June 2025, a data controller must notify the Personal Data Protection Commissioner of a personal data breach as soon as practicable and within 72 hours. Where the breach causes or is likely to cause significant harm — financial loss, identity fraud risk, sensitive data exposed — the affected people must also be told, within 7 days of the notice to the Commissioner. A late notice needs a written explanation, and the Commissioner’s guideline expects a breach register kept for at least two years (CMS; DLA Piper). Reports are filed through the PDP’s data breach notification (DBN) service.
For a support team, the practical point is that 72 hours is short. A lost agent laptop, a WhatsApp export sent to the wrong group, or a shared inbox login used by a former staff member can all be breaches. Decide now who decides, who files, and how your provider tells you about an incident on their side.
Data protection officer
Under the Commissioner’s DPO guideline, controllers and processors must appoint a DPO if they process personal data of more than 20,000 people, sensitive personal data (including financial information) of more than 10,000 people, or carry out regular and systematic monitoring of personal data. The DPO must be proficient in Bahasa Malaysia and English, and the appointment must be notified to the Commissioner within 21 days (DLA Piper; HHQ). The PDP publishes a DPO registration guide.
A customer database of 20,000 contacts is not unusual for a clinic group, an e-commerce seller or a property agency. Count your WhatsApp contacts and CRM records before assuming you are under the line.
Cross-border transfers after section 129 changed
The amended section 129 took effect on 1 April 2025, and the Commissioner issued Cross Border Personal Data Transfer Guidelines on 29 April 2025. Personal data may go outside Malaysia where the destination has a law substantially similar to the PDPA or ensures an adequate level of protection, or where an exception applies, such as consent, a transfer necessary for a contract, or reasonable precautions and due diligence like contractual clauses (Skrine; LHAG). Most cloud software, including WhatsApp itself, stores data outside Malaysia, so this applies to nearly every business that uses SaaS.
Channel by channel: what PDPA Malaysia asks of you
- Use the official WhatsApp Business API through a shared inbox rather than staff personal phones. Data on a personal phone leaves with the employee, and you cannot control access or deletion.
- Link your privacy notice in the first reply or auto-greeting.
- Marketing broadcasts are direct marketing. Customers can object to direct marketing at any time, and you must stop when they do (LHAG). Keep an opt-out list that every agent and campaign respects.
Phone calls and call recording
A recording of an identifiable caller is personal data. The PDPA does not have a separate call-recording rule, so the general principles apply. The common practice is a short greeting such as “calls may be recorded for quality and training” in English and Bahasa Malaysia, a defined purpose, restricted access and a retention period with automatic deletion. Our call recording guide covers on-demand versus always-on recording; outbound teams should also read the outbound compliance rules.
Website chat, email and web forms
The Notice and Choice principle requires a written notice telling people what you collect, why, who it may be disclosed to and how to access or correct it, in both Bahasa Malaysia and English (section 7(3) of the Act; see Rajah & Tann on notice requirements). Link it under every chat widget and web form, and only ask for fields you need. An enquiry form rarely needs an IC number.
AI chatbots and AI summaries
An AI agent that answers customers processes their messages, and AI call summaries process the call. Ask your provider which AI services the data passes through, where they run, and whether customer data is used to train models. Keep the AI answering from your own knowledge base, and hand anything involving health, finances or identity checks to a person. Our AI chatbot guide covers a safe rollout.
PDPA checklist for a customer service team
- Bilingual privacy notice (Bahasa Malaysia and English), linked from WhatsApp greetings, chat widget, web forms and email signatures.
- A call recording announcement on every recorded line.
- One shared inbox instead of personal phones; named logins, no shared passwords.
- Roles and permissions so agents see only the conversations their team handles.
- Retention periods for chats, recordings and tickets, with deletion actually happening.
- A direct marketing opt-out list applied to WhatsApp, SMS and calls.
- A breach plan: who decides, who files with the Commissioner within 72 hours, who tells customers.
- A count of how many people’s data you hold, to see whether you need a DPO.
- A written record of where each provider stores data and the section 129 basis for any transfer.
- A data processing agreement with each provider that requires them to tell you promptly about a breach.
Where JomConnect stores data, and what that means
JomConnect brings WhatsApp Business (official API), website live chat, email, phone calls, SMS, web forms and fax into one shared inbox, with an AI agent, tickets and call recording. It is hosted in Singapore and provided on Malaysian PDPA terms.
Because the hosting is outside Malaysia, using JomConnect is a cross-border transfer under section 129, as it is for most cloud software your business already uses. Singapore has its own Personal Data Protection Act 2012 and a regulator, which is relevant when you assess the destination; recording that assessment and your chosen basis is your decision as the data controller, and your lawyer can confirm it. JomConnect gives you the controls the checklist needs: roles, teams and permissions, named user logins, one customer history instead of data scattered across phones, and call recording in the same place as chats. It is set up, trained and supported by JomCloud, and priced by quote. For how the channels fit together, see our omnichannel customer service guide, or for ticket workflows, our ticketing system guide.