Malaysia Personal Data Protection Department, public consultation paper 1/2026 (AI framework): AI use creates no separate legal basis, new AI purposes need new notice and consent (Jabatan Perlindungan Data Peribadi, Kertas Konsultasi Awam Bil. 1/2026, Kerangka Kecerdasan Buatan (AI) dan Perlindungan Data Peribadi, consultation 5 to 23 Oct. 2026 (in Malay), paras 5.1 and 7.4)
Proposal, not law (comments open to 23 October 2026). Translation: using an AI system creates no separate legal basis for processing personal data and all such processing must follow the Act; where a controller wants to process for a purpose not stated in its notice it must give new notice, and where consent is required under the Act, new consent too. So there is no AI-training exception in Malaysian privacy law.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“5.1 Penggunaan sistem AI tidak mewujudkan asas undang-undang yang berasingan bagi pemprosesan data peribadi. ... Sekiranya pengawal data bercadang untuk memproses data peribadi melalui sistem AI bagi tujuan yang tidak dinyatakan sebelum ini dalam notis bertulis, pengawal data hendaklah memberikan notis bertulis yang baharu atau dipinda kepada subjek data sebelum memulakan pemprosesan tersebut. Sekiranya persetujuan diperlukan di bawah Akta 709, persetujuan baharu juga hendaklah diperoleh.”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide