Commissioner's Cross Border Personal Data Transfer Guidelines (29 April 2025): consent route needs a notice and recorded consent (Personal Data Protection Commissioner Malaysia, Guidelines on Cross Border Personal Data Transfer (CBPDT), Version 1.0, 29 April 2025, paras 4.3, 7.2 and 7.3)
To use the consent route a holder must first give the data subject a written notice naming the class of third parties the data goes to and the purpose of the transfer, then obtain and record consent. The Commissioner also expects any transfer out of Malaysia to be told to data subjects in the notice.
Dated 18 Oct 2026Source checked 18 Oct 2026Basis: primary text
In the source's own words
“In the event that data controller carries out or intends to carry out the transfer of personal data out of Malaysia, the data controller shall through its personal data protection notice or such other written notice inform data subject about the transfer. ... After the data subject has been provided with the personal data protection notice, data controller must obtain consent of data subject for the personal data transfer. The consent must be recorded and maintained in accordance with the requirements of the Personal Data Protection Regulations.”
Where it was read
Also read from the same source
- Commissioner's Cross Border Personal Data Transfer Guidelines: the holder itself finds whether the receiving country has a similar law, using a transfer impact assessment (Personal Data Protection Commissioner Malaysia, Guidelines on Cross Border Personal Data Transfer (CBPDT), Version 1.0, 29 April 2025, paras 5.1 and 5.3)
- Commissioner's Cross Border Personal Data Transfer Guidelines: contractual clauses, binding corporate rules or certification count as reasonable precautions (Personal Data Protection Commissioner Malaysia, Guidelines on Cross Border Personal Data Transfer (CBPDT), Version 1.0, 29 April 2025, paras 12.1, 12.7.2 and 12.8)
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide