PDPA Data Breach Notification for Advertisers

The short version

If you run Meta lead ads in Malaysia, you hold a file of other people's names, phone numbers and email addresses. Since 1 June 2025, losing control of that file has a statutory consequence.

Section 12B of the Personal Data Protection Act 2010 (Act 709) was inserted by section 6 of the Personal Data Protection (Amendment) Act 2024 Act A1727, which received Royal Assent on 9 October 2024 and was gazetted on 17 October 2024. It came into force on 1 June 2025 under P.U. (B) 522, the commencement order dated 19 December 2024 and gazetted on 24 December 2024, which staged the amending Act across three dates and put sections 6 and 9 at the last of them.

Subsection (1) says that where a data controller has reason to believe that a personal data breach has occurred, it shall as soon as practicable notify the Commissioner in the manner and form as determined by the Commissioner. Subsection (2) adds that where the breach causes or is likely to cause any significant harm to the data subject, the controller shall notify the data subject, again in the manner and form determined by the Commissioner, without unnecessary delay. Subsection (3) makes contravention of subsection (1) an offence carrying a fine not exceeding RM250,000 or imprisonment not exceeding 2 years or both.

Those are the only numbers in the Act. Every other figure you will read about Malaysian breach notification, the 72 hours, the 7 days, the 30 days, the thousand people, comes from two instruments the Commissioner issued under the manner-and-form delegation: Circular of the Personal Data Protection Commissioner Bil. 2/2025 on data breach notification, effective 1 June 2025, and the Personal Data Protection Guideline: Data Breach Notification, Version 1.0, issued on 25 February 2025 under section 48(g) of Act 709.

This is a guide to what those instruments say, written for someone who runs a business. It is not legal advice.

Registration is class-gated. Notification is not.

Ask a Malaysian SME owner about the PDPA and you will often hear a version of this: we are not a licensed business, we never registered, so it does not really apply to us. That belief is half right in a way that is worse than being wrong.

Registration under Act 709 is genuinely class-gated. Section 14(1) lets the Minister specify classes of data users by order, and only those classes have to register. Then section 13(2) deals with everyone else, and its wording is the load-bearing sentence in this whole area. A data user who belongs to a class of data users not specified in the order made under subsection 14(1) shall comply with all the provisions of this Act other than the provisions of this Division relating to the registration of data users and matters connected thereto.

Read the exclusion. It covers the registration provisions of that Division, and matters connected to registration. It does not cover the Act. An unlisted business is expressly required to comply with all the provisions of this Act apart from the registration machinery.

Section 12B is not registration machinery. It sits in the new Division 1a of Part II, inserted years after section 13 was drafted, and it contains no class gate of its own. The result is an asymmetry that catches people out: the obligation you probably know about, registration, may not apply to you, while the obligation with a criminal penalty attached does. A two-person agency in Puchong that collects and holds lead data for a property developer is not outside section 12B by virtue of never having registered, and neither is the developer.

If you take one thing from this page, take that. Not registering was never an opt-out, and after 1 June 2025 the gap between the two duties has teeth.

What a breach looks like when your data lives in a lead form

The DBN Guideline sets out breach scenarios at paragraph 4.2. Three of them describe, almost exactly, how advertiser lead data actually goes missing:

• an employee emailing personal data to the wrong recipient
• an external party gaining access by unlawful means to the data controller's network or user accounts, and extracting personal data
• a system misconfiguration leading to the loss of personal data or inadvertent sharing of personal data with a third party

Now hold those against the way lead data moves through a normal Malaysian advertising operation.

The instant lead form is filled in on Facebook or Instagram. Somebody downloads the CSV, or an automation connector pushes rows into a Google Sheet, or the leads land in a CRM. From there the file travels: to the sales team on WhatsApp, to the agency for reporting, to a freelancer building a remarketing audience, into an inbox where it sits indefinitely because nobody deletes attachments. By the end of a quarter, the same lead list exists in five places and two of them belong to companies you do not control.

Each of those hops maps to a scenario in paragraph 4.2 of the DBN Guideline. Forwarding the export to the wrong WhatsApp group is the wrong-recipient case. A Sheet whose sharing setting is anyone with the link is the misconfiguration case. Somebody phishing a colleague's login and pulling the lead history out of the account is the unlawful-access case, and note the Guideline's wording specifically includes user accounts, not just networks, which is the shape most advertiser incidents take.

One scoping decision is worth making early, because it keeps the whole exercise tractable. Build your breach response around the copies of the data that are in your own hands: the export sitting on a laptop, the rows in your CRM, the master Sheet, the credentials to the account. Those are the copies you can inventory, count, secure and account for to the Commissioner, and in the ordinary advertiser incident they are also the copies that leak.

Notifiable or not: the significant harm test

Not every breach has to be reported. Paragraph 5.1 of the DBN Guideline says so directly: only breaches causing or likely to cause significant harm are notifiable. Paragraph 5.2 then gives five limbs, and any one of them is enough.

Paragraph 5.4 of the same Guideline supplies the counter-example, and it is useful precisely because it is unglamorous. A stolen encrypted laptop holding the email addresses only of 200 employees is stated as not notifiable. Two facts are doing the work there: the data was encrypted, and it consisted of one low-sensitivity field.

Compare that with a lead export. It is almost never one field. The entire purpose of a lead form is to collect a contact route plus qualifying information, and the qualifying question is usually the sensitive part: budget, timeline, medical concern, loan amount, child's age. And the file is almost never encrypted, because a CSV in a downloads folder or a shared Sheet is not encrypted in any sense that paragraph 5.4 would recognise. The Guideline's non-notifiable example and the typical advertiser incident sit at opposite ends of the same test.

The thousand-row line, measured against a real lead list

Paragraph 5.3 of the DBN Guideline defines significant scale as affected data subjects exceeding one thousand. Two things about that number get misread constantly.

First, exceeding means exceeding. Exactly 1,000 is below the line on the instrument's own words. This is not a point worth building a strategy on, but it is worth knowing when you count.

Second, and much more important, one thousand is not a floor. It is one of five doors into the significant harm test, and it is the only door with a number on it. A breach affecting 40 people can be notifiable through any of the other four limbs, and the Guideline never suggests otherwise.

With that clear, the scale limb is worth measuring against your own file, because advertisers systematically underestimate how fast they cross it. Lead volume is cumulative, and the breach exposes the file, not the campaign.

Do that arithmetic with your own numbers rather than a borrowed benchmark. Take the leads your account actually produces in an average week and multiply by the number of weeks you have been running and never deleting. Fourteen a week is a modest campaign by any reading, and fourteen a week crosses one thousand in about seventy-two weeks. The file that leaks is rarely one campaign's export anyway. It is the CRM, or the master Sheet, or the all-time download, which means the count is every lead you have ever collected and still hold. A business that has run lead ads for two years and never purged is past a thousand rows without having thought about it once.

This is where retention and section 12B quietly intersect. Data you deleted cannot leak, and rows you no longer hold do not count towards significant scale. Nobody purges a lead list for compliance reasons. It is still the single cheapest thing you can do to shrink your exposure under this regime.

The trap: the thousand does not gate customer notification

This is the provision that changes what you actually have to do, and it is easy to miss because it sits in the Guideline's chapter on telling data subjects rather than alongside the notifiable-breach test.

Paragraph 8.2 of the DBN Guideline applies the same significant harm test to notifying data subjects, but expressly disapplies the significant scale limb from that assessment. The thousand-person threshold governs whether the scale of a breach makes it notifiable in itself. It does not govern whether you have to tell the people affected.

Work through what that means for a leak of 250 leads from a clinic enquiry form. On scale alone, 250 is nowhere near the line, so limb 5.2.5 gives you nothing. But the data consists of health-adjacent enquiry detail, which engages 5.2.3, and the combination of name, mobile and email engages 5.2.4. The breach is notifiable to the Commissioner through those limbs, and because scale is irrelevant to the data-subject assessment, the 250 people have to be told as well.

Reverse it and the asymmetry is starker. A business cannot reason its way to silence by pointing at a small headcount. The number that would have excused a scale-based notification has been removed from the customer-notification question altogether. If the compromised data can hurt the individual, the individual hears about it, whether there are 12 of them or 12,000.

Where the deadlines actually come from

This section exists because the sourcing is often reported wrong, and because being wrong about it in front of a lawyer or an insurer is expensive.

Section 12B(1) contains no deadline. It says as soon as practicable, and then delegates: in the manner and form as determined by the Commissioner. Section 12B(2) likewise says only without unnecessary delay. Neither the 72 hours nor the 7 days appears anywhere in Act 709 or in Act A1727.

Both numbers come from the Commissioner exercising that delegation. Circular Bil. 2/2025 sets the 72-hour window at paragraph 4(4) and the 7-day window at paragraph 5(2). The DBN Guideline states the same periods at paragraphs 6.1 and 9.1 respectively. The circular took effect on 1 June 2025 under its paragraph 10, the same day section 12B commenced, which is why the statute and its operating instructions started life together.

A note on numbering, since it causes confusion: cite the breach circular as Bil. 2/2025. The data protection officer circular is Bil. 1/2025. The regulator's English-language document index reverses the two, but the circular itself, the Malay index and the DBN Guideline's own cross-references at paragraphs 1.4 and 3.1 all agree on 2/2025. If you are drafting a policy that will be read by someone who checks, use the numbering the primary documents use.

The runbook

Written as a sequence rather than a summary, this is what the two instruments require between the moment you find out and the moment the file closes.

The order matters and it is not the order most teams work in. The instinct after an incident is to close the hole, work out exactly what went out, brief the boss, and then think about the regulator. The instruments assume the opposite: notify first on what you know, then fill in the detail across the following weeks. Paragraph 4(6) of the circular exists precisely so that an incomplete picture is not a reason to stay silent past 72 hours.

Two operational consequences follow. Whoever holds your Business Manager access needs to know that a suspected compromise is reportable, because that person will find out first and is rarely the person who reads circulars. And nothing in the circular or the Guideline carves weekends or public holidays out of the 72 hours. Malaysia has plenty of both, so a Thursday evening discovery before a long weekend is a real scheduling problem unless someone has thought about it in advance.

When the clock starts

Paragraph 6.1 of the DBN Guideline measures the 72 hours from the occurrence of the breach. Paragraph 6.2 of the same document works through how that lands in practice, and one of its examples sets the clock from the confirmation of an account compromise.

For an advertiser, that example is the common case. You notice unfamiliar campaigns in the ad account, or a login from somewhere you have never been, or a colleague reports a phishing message that worked. There is usually a gap of hours or days between the first sign and the point where you can say with confidence that someone was inside. The statutory trigger in section 12B(1) is reason to believe, which is a lower standard than confirmation and lower than proof.

The practical discipline is to write down two timestamps: when the first indication arrived, and when you could articulate a reason to believe personal data was accessed or extracted. If you later have to explain your timeline under paragraph 4(5) of the circular, those two entries are the difference between a documented judgment and a guess reconstructed from memory. If your account has been taken over, the containment steps are a separate exercise from the notification, and both run at once; the recovery side is covered in the hacked ad account walkthrough.

Your agency, your CRM, your processors

Most advertisers do not hold their lead data alone. The agency has a copy, the CRM vendor holds the live database, a developer built the integration, and a call centre works the list.

Paragraph 7(2) of Circular Bil. 2/2025 puts the obligation squarely on the controller to bind its processors by contract to notify and assist in the event of a breach. This is a drafting instruction, and it is the clause most likely to be missing from an agreement written before June 2025. If your agency contract is a one-page scope of work with a monthly fee and no data clause, you have no contractual route to find out about a breach on their side, and the 72-hour clock is running against you regardless.

The wider position on processors changed with the 2024 amendments too. New subsection 5(1a) of Act 709 applies the Security Principle directly to data processors, which they were previously outside. That does not transfer your notification duty to them. It means a processor now has direct exposure of its own, which gives you a reason to raise the clause that did not exist before the amendments.

Where more than one controller is involved in the same incident, paragraph 7.6 of the DBN Guideline provides that each of them files separately. Do not assume the agency notifying covers you, and do not assume you notifying covers a client whose leads you were collecting. Two controllers, two notifications. Agree in advance who tells whom and how fast, because a partner who sits on the news for four days has consumed your entire window.

When you cannot reach the people

Direct notification is the default under paragraph 9.1 of the DBN Guideline, but the same document recognises that it is not always possible. Paragraphs 10.3 and 10.4 of the Guideline permit public communication where direct notice is impracticable or would require a disproportionate effort, and they name the acceptable channels: the controller's website, printed media, social media posts on the controller's official pages, and push notification.

That third channel is worth pausing on, because it is the one an advertiser already operates. If you cannot reach a set of leads directly, a notice posted to your official Facebook or Instagram page is inside the Guideline's own list of acceptable public channels.

Two cautions. Public communication is the fallback, not the shortcut, and the trigger is impracticability or disproportionate effort, not inconvenience. A lead list with valid mobile numbers on every row is not a hard case for direct contact. And a public post is public, which means it will be read by customers who were not affected, by competitors, and by anyone searching your brand name later. Draft it as carefully as you would draft an ad, then have someone who was not in the incident read it cold.

The records you keep, and for how long

Paragraph 4(7) of Circular Bil. 2/2025 requires breach records to be kept, physical and electronic, for at least 2 years. That is a floor, not a target, and it means the file you assemble in the first week has to survive two annual laptop refreshes and at least one staff departure.

A workable record for a lead-data incident holds: the timestamps described above, what data fields were involved and for how many data subjects, how the count was reached, which limbs of paragraph 5.2 of the DBN Guideline you assessed and what you concluded on each, what was submitted to the Commissioner and when, what was sent to data subjects and when, and what changed afterwards. Keep the working, not just the conclusion. The limb-by-limb assessment is the part that is hardest to reconstruct from memory, and an analysis you can still produce two years later is worth more than a decision nobody wrote down.

A worked pass: the showroom that lost its sheet

A car dealership in Shah Alam has run lead ads for eighteen months. The form asks for name, phone, email, preferred model and financing interest. Everything lands in one Google Sheet the sales manager maintains, currently 2,400 rows. On a Friday afternoon a junior shares the Sheet with a new agency contact and, to save time, sets it to anyone with the link. On Monday somebody notices the setting.

Occurrence and belief. The misconfiguration is scenario (vi) in paragraph 4.2 of the DBN Guideline on its face. The reason to believe arrives on Monday morning when the setting is seen, and the honest position is that the link was open across the weekend. Both timestamps go in the log.

Notifiable? Financing interest engages limb 5.2.1, because it speaks to a person's financial position. Name plus mobile plus email in one row engages 5.2.4. And 2,400 rows exceeds one thousand, so 5.2.5 is met independently. Three limbs, and any one would have been enough. This is notifiable to the Commissioner.

The clock. Notification to the Commissioner is due within 72 hours. The dealership does not yet know whether anyone actually opened the link, and it does not need to: it files what it has inside the window and completes the picture under paragraph 4(6) of the circular as the access logs come back, with the whole submission closed inside 30 days.

The customers. Paragraph 8.2 of the DBN Guideline removes the scale limb from this question, but the other limbs remain satisfied, so the 2,400 people are told within 7 days of the Commissioner notification. Every row has a mobile number, so direct contact is practicable and the public-communication route in paragraph 10.3 of the Guideline is not available as a substitute.

The agency. Under paragraph 7.6 of the Guideline, if the agency is a controller in its own right for that data it files separately. Under paragraph 7(2) of the circular, the dealership should already have had a contract obliging the agency to notify and assist, and discovering on Monday that it does not is the second finding of the incident.

Afterwards. The records are kept for at least two years. And the obvious remediation is not a new tool: it is deleting the rows that stopped being useful a year ago, so that the next incident, if there is one, has less to expose. If lead capture is central to your acquisition, the mechanics of what you collect and where it goes are worth revisiting alongside this, and how lead ads are built is the place to start.

What to do this week

None of this requires a project, and most of it requires no budget.

Find every copy of your lead data. Sheets, CRM, downloads folders, email attachments, the agency's drive. Write the list down. Most businesses are surprised by item four or five.

Count the rows. If the total exceeds one thousand, limb 5.2.5 is live for you on scale alone, and it will keep getting more live every month you do not delete anything.

Read your form questions as a stranger would. If any of them touch health, finances, children or anything a scammer could use as an opening, you are in limb territory that has no numeric threshold at all.

Decide now who files, and find the form before you need it. Paragraph 4(4) of the circular requires the specified information inside 72 hours, and section 12B(1) leaves the manner and form to the Commissioner, so the submission channel is whatever the Commissioner currently publishes. Look it up on a quiet afternoon rather than at hour 60 of a live incident. One named person, a deputy, and a written note of where the notification goes, kept somewhere findable at 9pm on a public holiday.

Get a data clause into the agency contract. Paragraph 7(2) of the circular puts that obligation on you, and the conversation is easier now that subsection 5(1a) gives processors their own exposure under the Security Principle.

Then check the rest of your position, because section 12B did not arrive alone. Section 6 of Act A1727 inserted section 12A alongside it and both commenced on the same day, so the data protection officer requirement landed on 1 June 2025 too. The consent and notice questions sitting underneath your tracking setup are worked through in the Meta Pixel consent guide. Read those alongside this one, then have a Malaysian adviser check what you actually publish and what you actually do.

One last practical note. Reading Act 709 on its own will not show you section 12B at all, because the section was inserted into it by section 6 of Act A1727. Keep the amending Act open next to the principal one, or you will be reading a version of the law that stopped being current on 1 June 2025.