PDPA 2010 section 4: personal data is information about an identified or identifiable person in respect of commercial transactions (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 4 (definitions of "personal data" and "commercial transactions"))

The Act covers information about people that arises in commercial transactions, so customer tickets, email, chat and call recordings are in scope. Information from which no person can be identified, alone or with other information the data controller holds, is not personal data; the Act has no separate category for pseudonymised data.

Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text

In the source's own words

““personal data” means any information in respect of commercial transactions, which- (a) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with the intention that it should wholly or partly be processed by means of such equipment; or (c) is recorded as part of a relevant filing system or with the intention that it should form part of a relevant filing system, that relates directly or indirectly to a data subject, who is identified or identifiable from that information or from that and other information in the possession of a data controller”

Where it was read

PDPA 2010 section 4: personal data is information about an identified or identifiable person in respect of commercial transactions, Malaysia, checked 18 Oct 2026
Everything read from this source (6)