Malaysia's Personal Data Protection Act 2010 (PDPA) has no cookie rule of its own, but any cookie that processes personal data, such as _ga or _fbp, needs consent and a clear notice under its general principles. The Personal Data Protection (Amendment) Act 2024 has applied in full since 1 June 2025: higher fines of up to RM 1,000,000, breach notification, data portability, and a Data Protection Officer for organisations above the thresholds in the Commissioner's 2025 guideline.
How the PDPA 2010 applies to cookies
Malaysia's Personal Data Protection Act 2010 (PDPA) came into force on 15 November 2013. Unlike the EU's ePrivacy Directive, the PDPA contains no specific provisions on cookies, local storage, or other online tracking technologies.
That does not mean cookies fall outside the law. Section 6 of the PDPA requires consent before processing personal data in a commercial transaction. If a cookie collects, stores, or transmits personal data - think _ga tying a session to a user profile, or _fbp linking browsing behaviour to an advertising identity - the general data protection principles of the PDPA apply. The practical result: any cookie that processes personal data requires user consent and a clear privacy notice.
The PDPA originally applied only to data processed within Malaysia, and only to commercial transactions. Public sector bodies were excluded. This narrower scope set it apart from broader frameworks such as the GDPR.
The 2024 amendments, now in force
The Personal Data Protection (Amendment) Act 2024 represents the first major overhaul since the law was enacted. The Dewan Rakyat passed it on 16 July 2024 and the Dewan Negara on 31 July 2024, and its provisions came into force in three phases: 1 January, 1 April and 1 June 2025.
Key changes that affect cookie compliance:
Terminology shift - "Data user" is now "data controller", aligning Malaysian law with international norms.
Higher penalties - Maximum fines for breaching data protection principles rose from RM 300,000 to RM 1,000,000, with up to three years' imprisonment.
Mandatory data breach notification - Data controllers must notify the Commissioner and affected data subjects when a breach is likely to cause significant harm.
Data Protection Officer (DPO) - Controllers and processors above set thresholds must appoint a DPO, a duty that echoes GDPR Article 37.
Data portability - From June 2025, individuals can request their data in a structured, commonly used format.
Direct liability for data processors - Processors now carry their own security duty and can be penalised directly for failing it.
The amendments also removed the white-list regime for cross-border data transfers. Data controllers may now transfer personal data outside Malaysia if the receiving jurisdiction offers a level of protection substantially similar to the PDPA.
Seven data protection principles under the PDPA
The PDPA is built on seven principles. Each one has implications for how you handle cookies on a website aimed at Malaysian visitors.
| Principle | PDPA section | Cookie relevance |
|---|---|---|
| General Principle | Section 6 | Consent required before processing personal data via cookies |
| Notice and Choice | Section 7 | Cookie banner must explain what data is collected and why |
| Disclosure | Section 8 | Third-party cookies (analytics, advertising) must be disclosed |
| Security | Section 9 | Cookie data must be protected against unauthorised access |
| Retention | Section 10 | Cookies should not store personal data longer than necessary |
| Data Integrity | Section 11 | Data collected through cookies must be accurate and up to date |
| Access | Section 12 | Users can request access to personal data held about them |
The Notice and Choice Principle is the most directly relevant to cookie consent. It requires data controllers to inform individuals about the purpose of data collection and give them a genuine choice before processing begins.
Who enforces the PDPA, and the penalties
The Personal Data Protection Commissioner enforces the PDPA, supported by the Jabatan Perlindungan Data Peribadi (JPDP), or Personal Data Protection Department, under the Ministry of Digital. The Commissioner also issues the guidelines that give the amendments their detail, such as the DPO and breach notification guidelines that took effect on 1 June 2025.
The penalties that matter most for a website:
Breaching the data protection principles, including processing personal data without consent - fine up to RM 1,000,000 and/or up to three years' imprisonment
Failing to notify a data breach - a separate offence under the amended Act
As of October 2026, the Commissioner has published no cookie-specific fine, but the general processing rules apply. A website dropping marketing cookies without consent is processing personal data without a lawful basis under Section 6.
PDPA and GDPR: the differences for cookies
If your website serves both EU and Malaysian visitors, you are likely already meeting a higher standard under the GDPR. The differences worth noting:
| Aspect | Malaysia PDPA | EU GDPR |
|---|---|---|
| Cookie-specific rules | None - general consent principles apply | ePrivacy Directive requires consent for non-essential cookies |
| Scope | Commercial transactions | All personal data processing |
| Maximum fine | RM 1,000,000 and/or 3 years' imprisonment | EUR 20,000,000 or 4% of global turnover |
| Breach notification | Mandatory since 1 June 2025: within 72 hours to the Commissioner | 72-hour notification to DPA |
| DPO requirement | Above thresholds: more than 20,000 data subjects, more than 10,000 for sensitive or financial data, or regular and systematic monitoring | Required in specific circumstances |
| Cross-border transfers | Adequacy-based (white-list removed) | Adequacy decisions, SCCs, BCRs |
| Extraterritorial reach | Limited | Applies to non-EU entities targeting EU residents |
The PDPA's fines are significantly lower than the GDPR's, but the 2024 amendments closed several gaps. The DPO thresholds are numeric, which makes it easier to tell whether you need one than under the GDPR's "large scale" test.
Cookie checklist for Malaysian websites
Audit your site against these requirements:
Run a cookie scan to identify every cookie and tracking script on your site, including third-party tags like
_ga,_fbp, and_gcl_au.Classify cookies by purpose - separate strictly necessary cookies (like
PHPSESSID) from analytics and advertising cookies.Display a cookie banner that explains what data you collect, the purpose, and which third parties receive it. The Notice and Choice Principle requires this before processing begins.
Obtain consent before setting non-essential cookies - do not rely on implied consent or pre-ticked boxes.
Publish a cookie policy detailing each cookie's name, provider, purpose, and duration. Link it from your banner.
Check whether you need a DPO - the thresholds are in the Commissioner's DPO guideline, in force since 1 June 2025.
Enable data subject access requests - Section 12 gives individuals the right to access their personal data.
Set retention limits - configure cookie durations to match your stated retention periods.
If your site also targets visitors in Indonesia, Singapore, or Thailand, consider a region-aware approach where your cookie banner adapts its behaviour based on visitor location. The global compliance hub summarises each country's rules.
Consent requirements: what counts as valid consent
Section 6 of the PDPA states that consent may take any form, provided it can be recorded and maintained by the data controller. This is less prescriptive than the GDPR's requirements under Article 7, and the 2024 amendments did not change the consent provisions.
Granular, specific consent is still good practice. A single checkbox covering all cookies and all data processing purposes makes it hard to show the visitor made a genuine choice about each purpose. Offering category-level choices - strictly necessary, functional, analytics, and marketing - gives that evidence.
Withdrawal of consent must also be straightforward. The PDPA has given individuals the right to withdraw consent since 2010, and a withdrawal route as easy as the original opt-in is the practical way to honour it.
Questions about Malaysian cookie consent
Does the Malaysia PDPA require a cookie banner?
The PDPA does not mention cookies specifically, but its Notice and Choice Principle (Section 7) requires you to inform users and obtain consent before processing personal data. If your cookies collect personal data, a cookie banner is the most practical way to meet this obligation.
What is the maximum fine for non-compliance with the PDPA?
Following the 2024 amendments, the maximum fine for breaching data protection principles is RM 1,000,000, with up to three years' imprisonment.
Do strictly necessary cookies need consent under the PDPA?
Strictly necessary cookies like PHPSESSID that do not process personal data beyond basic session management do not trigger the PDPA's consent requirement. If a cookie processes personal data for purposes beyond what is strictly necessary, consent is required.
Does the PDPA apply to websites outside Malaysia?
The PDPA's extraterritorial reach is limited compared to the GDPR. It primarily applies to data processed within Malaysia in commercial transactions. If your business has no presence in Malaysia, the risk of direct enforcement is low, but following it is sensible if you actively target Malaysian users.
How does the Malaysia PDPA compare to Indonesia's PDP Law?
Both laws require consent for personal data processing. Indonesia's PDP Law (2022) has a broader scope and administrative fines of up to 2% of annual revenue. Malaysia's PDPA is more established but was narrower until the 2024 amendments brought it closer to international standards.
Is a Data Protection Officer required under the amended PDPA?
Only above the thresholds in the Commissioner's DPO guideline, in force since 1 June 2025: personal data of more than 20,000 people, sensitive or financial data of more than 10,000 people, or regular and systematic monitoring. This applies to controllers and processors.
Check what your site sets for Malaysian visitors
If you are not sure which cookies your site sets, start with a free scan. Kukie.io detects and categorises your cookies and blocks the non-essential ones until visitors choose, so every visitor gets a clear choice.
