“ Unlike other countries, the penalty/remedy are in the forms of criminal sanctions. There are 12 new criminal act/offenses created by the act ” - Prof Abu Bakar Munir, Adviser to government of Malaysia on Personal Data Protection (PDPA)

“ ... if you don't protect the data adequately enough, if your system is hacked ” are sufficient grounds to get you prosecuted.

Source from BFM89.9 (Click here for the full podcast)

Just sending information about your company being compliant to PDPA doesn’t mean anything in compliancy with the act. While the act does not prohibit collecting data within parameters and principles, there are breaches that could easily lead to prosecution.

PDPA is here, like it or not, it's fully enforced and in power. Here are some important principles, that we as companies should be aware of.

	Consent of individuals are needed for collecting personal data
	Disclosing of data must require consent
	Collect only what is adequate not excessively
	Data that are collected for certain purpose, after it has served its purpose it should not be retained

Breaching these principles could result in the management of a company to be prosecuted up to RM500,000 or 2 years jail or both.