The PDPA used to stop at your door. Your business was the data controller, you carried the liability, and the cloud provider, the analytics tool, and the payment gateway sitting behind your website were just vendors. If they leaked your customer data, the regulator came after you, and you chased them in a separate commercial dispute.
That arrangement ended on 1 April 2025. Under the Personal Data Protection (Amendment) Act 2024, the data processor is now directly bound by the PDPA. Your hosting provider, your SaaS tools, your payment processor, and the agency that built your website all carry legal exposure in their own right.
I’m Eric, the Technical Founder at Nodesify Technology. We build software for Malaysian enterprises out of Johor, and the most dangerous gap I see in 2026 is not in the website code. It is in the vendor stack: the contracts nobody reviewed, the analytics scripts loading personal data offshore, the cloud region chosen for latency rather than legality.
This guide is the companion to our Malaysia PDPA Compliance for Website Development guide. That article covers the seven principles and how they shape a build. This one covers what happens when your data leaves your system and enters someone else’s: processor contracts, data residency, transfer limitation, and the vendor risk checklist we run on every Nodesify engagement.
Controller vs. Processor: The Distinction That Now Matters
The PDPA draws a line between two roles.
A data controller is the entity that decides why and how personal data is processed. If you operate a Malaysian e-commerce site, you are the controller of your customer data.
A data processor is the entity that processes personal data on behalf of the controller. Your hosting provider, your email marketing platform, your CRM, your analytics vendor, and the development agency that maintains your system are typically processors.
Under the original PDPA 2010, only controllers carried criminal liability. Processors were treated as an extension of the controller. The 2024 amendment changed that. From 1 April 2025, data processors must comply with the Security Principle, and a processor that fails to protect personal data can be prosecuted directly by the Personal Data Protection Department (PDPD / JPDP).
The penalty exposure is serious. A processor breach of the Security Principle carries up to RM1,000,000 and/or 3 years’ imprisonment under the amended Act. This is why your vendor contracts now matter as much as your own security.
What a Malaysia-Compliant Data Processing Agreement Must Contain
Most SME vendor contracts I review are not PDPA-compliant. They are standard SaaS terms of service written under US or EU law, with no Malaysia-specific obligations. A PDPA-compliant Data Processing Agreement (DPA) between a controller and a processor should cover the following.
| DPA Clause | What It Must Specify |
|---|---|
| Purpose limitation | The processor may only process personal data on the controller’s documented instructions. |
| Security measures | The technical and organisational measures the processor will apply to satisfy the Security Principle. |
| Sub-processors | Whether the processor may engage sub-processors, and the controller’s right to object. |
| Data location | Where personal data will be stored and processed, including any cross-border transfer. |
| Breach notification | The processor’s duty to notify the controller of a breach within a defined window, so the controller can meet its own notification duty. |
| Return or deletion | What happens to personal data at the end of the contract: return and/or certified deletion. |
| Audit rights | The controller’s right to audit the processor’s compliance, or evidence of an independent audit. |
| DPO contact | The named Data Protection Officer or contact for both parties. |
If your hosting, CRM, analytics, or payment vendor cannot sign a DPA covering those clauses, you have a gap the PDPD will eventually find. And under the amended Act, both you and the vendor now share the liability for that gap.
Data Residency and the Transfer Limitation Principle
Where your customer data physically lives is now a legal question, not just an engineering one.
The PDPA’s Transfer Limitation Principle restricts the transfer of personal data outside Malaysia unless an exception applies. The 2024 amendments tightened this area. Permitted transfers generally require one of the following:
- Consent from the data subject to the transfer.
- The transfer is necessary for the performance of a contract with the data subject.
- The destination has been approved by the PDP Commissioner, or the recipient is bound by a binding corporate code of conduct or contractual clauses offering comparable protection.
The practical implication is that your cloud region decision matters. A Malaysian e-commerce site hosting customer personal data on a Singapore region, a US region, or a global anycast edge without a transfer mechanism is operating in a grey zone. The cleanest architecture is to keep personal data at rest inside Malaysia where feasible, and to rely on consent or contractual clauses where it is not.
This interacts with MCMC cloud licensing, which we cover in our Malaysia cybersecurity laws guide. The provider must be licensed, and the data must be transferable lawfully. Both conditions must hold simultaneously.
The Vendor Risk Checklist for Malaysian Enterprises
Here is the checklist we run against any third party that will touch a Malaysian client’s personal data. If you are about to launch or rebuild a site, ask every vendor on this list to evidence each row.
Hosting and Infrastructure
- Provider is MCMC-licensed where it operates as a Cloud Service Provider in Malaysia.
- Data at rest sits in a region that satisfies the Transfer Limitation Principle, or a transfer mechanism is in place.
- A signed DPA covering the Security Principle, breach notification, and deletion at exit.
- Evidence of controls aligned to ISO/IEC 27001 Annex A or an equivalent framework. We discuss that framework in our ISO/IEC 27001 alignment guide.
Analytics and Tag Managers
- Scripts that transmit personal data (including identifying cookie or device data) load only after consent.
- A server-side or consent-mode deployment so data does not leave the device before consent is captured.
- A documented data flow showing what personal data the vendor receives and where it is stored.
Payment Processors
- Provider is licensed or authorised under the relevant Malaysian financial services regime (e.g. Bank Negara approval for payment systems).
- PCI DSS compliance evidenced for card data flows.
- A DPA that addresses the processor’s role in handling payer personal data.
CRM, Email, and Marketing Tools
- A signed DPA with the clauses listed above.
- Consent records stored in a way that satisfies the Notice and Choice Principle.
- Clear deletion and export tooling to support data portability and the Access Principle.
Chat and Customer Support Tools
- Vendor processes personal data only on the controller’s instructions.
- Consent captured before any personal data is sent through the widget.
- A DPA and a defined breach notification window.
The Development Agency Itself
- The agency is a Malaysian-registered entity carrying legal accountability under Malaysian jurisdiction.
- The agency, as a data processor under the 2024 amendments, has implemented the Security Principle.
- Access to production personal data is least-privilege, logged, and revocable.
That last item is where the agency choice becomes a PDPA decision, not just a procurement one. An offshore freelancer operating outside Malaysian jurisdiction cannot be practically held to the processor obligations by the PDPD. A Malaysian-registered partner can.
What Changed for Processors in the 2024 Amendment
For context, here is what the Personal Data Protection (Amendment) Act 2024 (Act A1727) changed specifically for processors and the controller-processor relationship.
- Processors are now bound by the Security Principle. Before 1 April 2025, only controllers carried criminal liability for security failures. Processors now share it.
- Mandatory breach notification applies to both roles. Section 6 of the Amendment Act requires notification of a notifiable data breach to the PDP Commissioner. A processor that discovers the breach must notify its controller fast enough for the controller to meet its own window.
- Mandatory Data Protection Officer. Both controllers and processors must appoint a DPO. Your vendor must name one.
- Data portability. Processors must be capable of returning personal data in a structured, machine-readable format when the data subject exercises portability rights.
The combined effect is that the processor relationship is now a regulated one, not just a commercial one. We cover the full amendment and the headline penalty figures in our PDPA compliance guide.
Frequently Asked Questions About PDPA Data Processor Obligations
What is a data processor under the Malaysian PDPA?
A data processor is an entity that processes personal data on behalf of a data controller. Common examples include cloud hosting providers, email marketing platforms, customer relationship management tools, payment processors, and the development agency that builds or maintains your website. The data controller decides why and how data is processed; the processor acts on the controller’s instructions.
Are data processors liable under the Malaysian PDPA?
Yes. From 1 April 2025, under the Personal Data Protection (Amendment) Act 2024, data processors must comply with the Security Principle and can be prosecuted directly by the Personal Data Protection Department. A processor that fails to protect personal data faces a fine of up to RM1,000,000 and/or imprisonment of up to 3 years.
Do I need a Data Processing Agreement with my cloud vendor?
Yes. A Data Processing Agreement between you (the controller) and your cloud or SaaS vendor should specify purpose limitation, security measures, sub-processor rules, data location, breach notification duties, deletion at contract end, and audit rights. Without a signed DPA covering these clauses, both you and the vendor carry unallocated PDPA risk.
Can Malaysian personal data be stored outside Malaysia?
Yes, but only where an exception to the Transfer Limitation Principle applies. Permitted bases include the data subject’s consent, necessity for contract performance, or approval by the PDP Commissioner. In practice, the cleanest architecture keeps personal data at rest inside Malaysia where feasible, and uses a transfer mechanism where cross-border processing is required.
Does the PDPA apply to offshore vendors I hire to build my website?
The PDPA applies to the processing of personal data of Malaysian data subjects, regardless of where the processor is located. The practical issue is enforcement. An offshore vendor is harder for the PDPD to reach and harder for you to hold accountable in a Malaysian contract. Using a Malaysian-registered development partner as your processor keeps legal accountability inside Malaysian jurisdiction.
Get Your Vendor Stack Compliant
The 2024 PDPA amendment made your vendor stack a legal exposure, not just a technical one. Hosting providers, analytics tools, payment processors, CRM platforms, and the agency that builds your software are all data processors now, and they all share the Security Principle liability. The cheapest moment to fix that exposure is when you scope the architecture, not when a breach letter arrives.
That is what we do at Nodesify Technology. We engineer software for Malaysian enterprises from our Johor HQ, and as a Malaysian-registered data processor we carry the PDPA accountability inside Malaysian jurisdiction on every domestic contract. Start with a Technical Roadmap and Architecture Audit and we will review your vendor stack, your DPA coverage, and your data residency position before a single line of code gets written.
Industry Statistics & Citations
- Third-Party Risk: Over 60% of data breaches reported globally involve vulnerabilities introduced by third-party vendors or cloud service providers.
- Vendor Auditing: Only 35% of Malaysian SMEs regularly audit their cloud vendors for PDPA compliance, exposing them to massive vicarious liability.
- Citation: Ponemon Institute, “Data Risk in the Third-Party Ecosystem”, 2024.
To learn more about digital transformation strategies, regulatory compliance (PDPA & Cybersecurity Act 2024), and system modernization roadmaps, read our comprehensive Ultimate Guide to Enterprise Digital Transformation in Malaysia.
