The PDPA 2024 amendments: what changed, and what it means for an NPO holding donor data

Does the PDPA even apply to an NPO?

A committee member asks "are we even covered by this?" and it's fair — nobody sent your temple or clan association a letter telling you the Act applies.

The Personal Data Protection Act 2010 (Act 709) applies to a person who processes, or controls the processing of, personal data "in respect of commercial transactions" ^{[3, s.2(1)]} — defined broadly as "any transaction of a commercial nature, whether contractual or not, which includes any matters relating to the supply or exchange of goods or services, agency, investments, financing, banking and insurance" ^{[3, s.4]}. Nothing in the 2024 amendments touched this definition, and neither the Act nor the JPDP's published FAQ addresses non-profit organisations by name ^[6].

What that leaves you with, honestly:

• If your organisation sells anything — tickets, merchandise, tablet dedications for a fee, memberships, hall rentals — that data is "in respect of a commercial transaction" without much argument. (Whether a ritual offering is a donation or a sale is its own question — see Donation or sale?.)
• A pure donation, given with nothing expected in return, sits less clearly inside "any transaction of a commercial nature." No JPDP guideline, circular or FAQ we could find takes a position on this specifically.
• In practice, most NPOs' data processing is mixed, so treating the whole organisation as in scope is the safer working assumption.

Practical tip: don't wait for a definitive answer before you act. Apply the Act's principles — notice, consent, security, retention — to donor data as practice, and confirm your position with a data protection consultant or the JPDP (03-7456 3888, [email protected]) if you need a firm answer for board minutes or a funder's due diligence.

What the 2024 amendments actually changed

The Personal Data Protection (Amendment) Act 2024 (Act A1727) received Royal Assent on 9 October 2024 and was gazetted on 17 October 2024 ^[1]. It didn't commence all at once — the Minister of Digital appointed three separate commencement dates by gazette notification on 19 December 2024 (published 24 December 2024, P.U.(B) 522/2024) ^[2]:

Source: Act A1727 itself ^[1] for what each section does, and P.U.(B) 522/2024 ^[2] for the dates — the gazetted answer to "when did this actually start."

Two smaller changes, neither a new obligation:

• Deceased individuals are no longer "data subjects" ^{[1, s.3(f)]}. Records naming deceased family members — a memorial tablet, an ancestor listing — fall outside the Act's protections, though your own retention practices are still your call.
• Cross-border transfer was reworked. The old s.129 gave the Minister sole power to specify, by Gazette, which countries a controller could transfer data to. The amended section drops that step: a controller may transfer directly where the destination's law is substantially similar to Act 709 or offers equivalent protection — or under specific grounds including consent, contractual or legal necessity, vital interests, or the controller's own due diligence, among others (one narrower ground, "public interest," was removed) ^{[1, s.12; 3, s.129]}. Relevant if you use an overseas email platform, cloud backup or payment processor.

Do you need a Data Protection Officer?

"Who would even be our DPO?" is the real question behind this one, for an organisation run mostly by volunteers.

Section 12A requires a data controller (and, separately, a processor) to appoint one or more DPOs "accountable... for the compliance with this Act" ^{[1, s.6]}. The JPDP's Guideline on the Appointment of Data Protection Officer (v1.0, 25 Feb 2025) sets the mandatory conditions ^[4]: appoint a DPO if your processing involves —

1. personal data exceeding 20,000 data subjects; or
2. sensitive personal data (including financial information) exceeding 10,000 data subjects; or
3. activities requiring regular and systematic monitoring of personal data — the guideline's examples are behavioural-advertising tracking, wearable health data, or CCTV, not the kind of processing a typical donor database does ^{[4, §4.2–4.3]}.

For most temple committees, clan associations and mid-sized charities, the 20,000-donor threshold is the one to watch, and many won't cross it. If you do, the guideline still allows a DPO to be appointed "from among existing employees or through outsourcing services," and to serve part-time ^{[4, §6.3–6.5]}. That wording is built around "employees," not volunteers — for a body with no paid staff, our own reading is that an active committee member taking on the role would fit its spirit, but that's this article's interpretation, not a guideline quote; confirm with the JPDP if you need certainty. The DPO must be resident in Malaysia (180 days a year) or easily contactable, and bilingual (Bahasa Melayu/English) ^{[4, §6.10]}. Once appointed, you have 21 days to register their details via SPDP (daftar.pdp.gov.my) ^{[4, §7.1]}.

Practical tip: even if you're comfortably under the thresholds, keep a short written note of your donor count and why a DPO isn't mandatory — the guideline explicitly allows organisations to "keep a record on the reasons for not appointing" one ^{[4, §4.5]}.

If donor data leaks from a laptop or a spreadsheet

This is the scenario that keeps a treasurer up at night: a volunteer's laptop with the donor spreadsheet goes missing, or a donor list gets emailed to the wrong person.

Section 12B makes this a legal duty, and — unlike the DPO requirement — it applies to any data controller in the Act's scope, regardless of size. The JPDP's Guideline on Data Breach Notification (v1.0, 25 Feb 2025) sets out the mechanics ^[5]:

• A "personal data breach" is any breach, loss, misuse or unauthorised access of personal data — the guideline's own examples include "an employee accidentally losing/misplacing a company-issued laptop containing unencrypted personal data" ^{[5, §4.2]}.
• You must notify the Commissioner if the breach causes or is likely to cause "significant harm" — financial loss, sensitive personal data being involved, risk of identity fraud, or affecting more than 1,000 data subjects ("significant scale") ^{[5, §5.2–5.3]}.
• The deadline is 72 hours. §6.1's own wording sets the clock running "from the occurrence of the personal data breach" — but §6.2's worked examples run it from when you're informed or become aware instead (a lost USB key: the clock starts "as soon as the data controller is informed of the loss," not from whenever the key actually went missing) ^{[5, §6.1–6.2]}. Work to the awareness standard in §6.2 — that's the guideline's own applied rule.
• If the breach is likely to cause significant harm to the data subjects themselves, you must also notify them — within 7 days of your notification to the Commissioner ^{[5, §9.1]}.
• You must keep a breach register for at least 2 years, covering every breach you assess — including ones that didn't meet the notification threshold ^{[5, §14.1]}.
• Failing to notify the Commissioner is itself an offence: a fine of up to RM250,000 or up to 2 years' imprisonment, or both ^{[1, s.6 (new s.12B(3))]}.

Practical tips:

• Write down, in one page, who assesses a missing laptop or USB drive, who decides whether it's notifiable, and who submits the form. The 72-hour clock is shorter than most committees' meeting cycle.
• Encryption matters: the guideline treats a lost laptop with unencrypted donor data very differently from one with encrypted data a thief can't actually read ^{[5, §4.2, §5.4]}.
• Notify via the official form on pdp.gov.my, or by email to [email protected] ^{[5, §7.1]} — bookmark it before you need it.

Donors asking for their own data

A donor calls and asks: "what do you have on me, and can you send it to me, or to another organisation?"

The 2024 amendments added a data portability right (new s.43A): a data subject can ask a controller to transmit their personal data directly to another controller of their choice, subject to technical feasibility ^{[1, s.9]}. The transmission must happen "within the period as may be prescribed" ^{[1, s.9]} — we could not locate a regulation setting that period, so treat the timeline as not yet confirmed. This sits alongside the pre-existing data access and correction rights, unchanged by the 2024 amendments.

Practical tip: you don't need a formal portability request to answer "what do you have on me" quickly — see how DonorCARE handles that below.

What this means for your organisation

1. Work out whether — and where — the Act applies to you. Any part of your income that's a sale is in scope without argument; treat donor data the same way as good practice elsewhere.
2. Count your donor records. Nowhere near 20,000 total, or 10,000 with sensitive/financial data? You likely don't need a mandatory DPO — but write down that you checked.
3. If you do cross the threshold, appoint someone, register within 21 days, and make sure they're contactable and bilingual.
4. Write a one-page breach response plan now — who assesses, who decides on notification, and how you'd hit the 72-hour and 7-day deadlines.
5. Encrypt what leaves the office — a laptop, a USB drive, an exported spreadsheet.
6. Know how you'd answer a donor who asks what you hold on them, and be ready for a portability request even though its timeline isn't yet prescribed.
7. Review your position whenever the JPDP issues something new — this area moved through three commencement dates and two guidelines in under a year.