Data controller registration

Where this applies

This record is scoped to Malaysia. Scope is part of the claim: a rule that binds one part of a country does not bind the whole of it, and this library states the scope its sources state.

Instrument

Personal Data Protection Act 2010 (Act 709), s.15, and the Personal Data Protection (Class of Data Users) Order 2013

Who it binds

Entities in 13 legally specified classes of data users processing personal data connected to commercial transactions, established in Malaysia or using equipment in Malaysia

What it requires

Covered classes of data users must register with the Personal Data Protection Department (JPDP) and visibly display the registration certificate at the workplace. Unregistered processing by a covered class carries a fine not exceeding RM500,000 or imprisonment not exceeding 3 years, or both; failing to display the certificate carries a fine not exceeding RM10,000 or imprisonment not exceeding 1 year, or both — both figures quoted directly from JPDP's own page.

Related records and requirements

• Data protection fee (ICO registration) (United Kingdom) — The ICO data protection fee is a statutory annual fee owed by organisations that process personal data (unless exempt) — a registration/fee duty to the authority, not a certificate.
• VERBİS registration under the KVKK (Türkiye) — Türkiye's Art. 16(2) requires registration with the Data Controllers' Registry (VERBİS) before processing personal data begins — separate from KVKK's substantive compliance rules.