PDPA 2010 sections 6 and 7: consent to process, and written notice before using data for another purpose or disclosing it to a third party (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 6(1)(a) and s. 7(2)(c))
A data controller needs the data subject's consent to process personal data and must give written notice before it uses the data for a new purpose or discloses it to a third party. Section 6(2) lists narrow necessity grounds (contract performance, legal obligation, vital interests, justice, statutory functions) and on my reading none fits a commercial licence, which is both a new purpose and a disclosure to a third party.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“in the case of personal data other than sensitive personal data, process personal data about a data subject unless the data subject has given his consent to the processing of the personal data; ... in any other case, before the data controller- (i) uses the personal data of the data subject for a purpose other than the purpose for which the personal data was collected; or (ii) discloses the personal data to a third party.”
Where it was read
Also read from the same source
- PDPA 2010 section 4: personal data is information about an identified or identifiable person in respect of commercial transactions (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 4 (definitions of "personal data" and "commercial transactions"))
- PDPA 2010 sections 8 and 39: no disclosure for a new purpose or to an unlisted third party without consent (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 8 and s. 39)
- PDPA 2010 section 39(d): disclosure on a reasonable belief that the data subject would have consented (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 39(d) and (e))
- PDPA 2010 section 45(2)(c): processing for statistics or research is exempt from the consent and disclosure principles (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 45(2)(c))
- PDPA 2010 section 129 (as amended 2024): transfer outside Malaysia needs a similar law, adequate protection, or a listed condition (Personal Data Protection Act 2010 [Act 709], reprint as at 15 September 2026 (Commissioner of Law Revision, Malaysia), s. 129(2), (3)(a), (3)(f) and (5), as amended by the Personal Data Protection (Amendment) Act 2024 [Act A1727], s. 12)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in these 2 guides