If you run an online marketplace, a direct-to-consumer store, or any platform that takes orders online, you are almost certainly processing personal data of customers, sellers, or the individuals behind your business users. The Personal Data Protection (Amendment) Act 2024 introduced a set of new obligations under the Personal Data Protection Act 2010, and the Personal Data Protection Commissioner has since issued guidelines that put practical detail around them.

For most e-commerce operators, the question is not whether the PDPA applies. It is which of the newer obligations actually bite, and what needs to be in place before they do.

We have prepared a downloadable note setting out three areas that tend to be the most relevant to e-commerce operations.

1. Do you need a Data Protection Officer?

The DPO appointment thresholds are alternatives, so meeting any one of them is enough. Two are volume-based: personal data relating to more than 20,000 data subjects, or sensitive personal data (including financial information) relating to more than 10,000 data subjects.

The third threshold is the one e-commerce businesses most often overlook: activities involving regular and systematic monitoring of personal data. The DPO Guideline specifically gives the example of a retail website using algorithms to monitor users’ searches and purchases in order to make recommendations. If your platform runs a recommendation engine, that criterion deserves a proper look — regardless of how many customers you have.

Appointing a DPO is only the start. There are requirements around the DPO’s residency and language proficiency, independence and reporting line, a dedicated business e-mail account, registration with the Commissioner within 21 days of appointment, and publication of contact details.

2. Would you be ready if a breach happened tomorrow?

A personal data breach is broader than a hacking incident. A misconfigured storage bucket exposing order records, a bulk e-mail that discloses customer details to the wrong recipients, or a compromised seller or administrator account can each qualify.

Where a breach causes or is likely to cause significant harm, the data controller must notify the Commissioner as soon as practicable and within 72 hours. Where affected individuals must be notified, that must follow without unnecessary delay and no later than 7 days after the initial notification.

Seventy-two hours is not long. It covers detection, escalation, assessment against the significant harm criteria, and preparation of the notification. It is worth noting that the statutory notification obligation sits with the data controller, not the data processor, so if your fulfilment partner, payment gateway or cloud provider suffers the incident, the exposure is still yours. Your contracts should require them to tell you promptly and assist.

3. Where does your data actually go?

Cross-border transfer questions frequently arise from arrangements nobody thinks of as “transfers”: hosting on servers outside Malaysia, an overseas group company handling customer support, or engineers in another jurisdiction with access to production systems.

Section 129 of the PDPA sets out the bases on which a transfer outside Malaysia is permitted. The practical exercise is to identify where your data goes, who touches it, and which basis you rely on for each route — and to document that reasoning before anyone asks.

Download the full note

Our note, “Data Protection: What E-Commerce Businesses Should Check”, sets out the thresholds, timelines and requirements in table form, with a “Check your position” list for each of the three areas so you can work through it against your own operations.

Enter your e-mail address below and we will send you the download link.