Skip to contentFree 30 minute call with Pali
Book a callClient login

Free tool

PDPA privacy notice generator in BM and English

Answer a few questions about the personal data your business collects and get a Personal Data Protection Notice in Bahasa Malaysia and English, built from the eight items section 7 of the PDPA 2010 requires. Copy it onto your website or forms, or download it. Everything stays in your browser.

Last updated

Your answers

Nothing you type leaves this page.

What personal data do you collect?

What do you use it for?

Write it in BM and English if you can, e.g. Warranty claims / Tuntutan waranti.

Who do you share it with?
Is any of it stored or sent outside Malaysia?

Most cloud email, CRM and website hosts store data abroad.

How long do you keep it?
Must people give you this data?

Leave empty to use: we may not be able to provide our products or services.

Contact for access and correction requests

Required when you process data of over 20,000 people, sensitive data of over 10,000, or monitor people regularly.

Worked example

Notice created, 6 data types, transfers outside Malaysia

An online shop that takes orders, payments and newsletter sign-ups:

Bahasa Malaysia

Notis Perlindungan Data Peribadi

Kedai Contoh Sdn. Bhd. (No. pendaftaran 202401000001) ("kami") memproses data peribadi anda mengikut Akta Perlindungan Data Peribadi 2010. Notis ini menerangkan data peribadi yang kami kumpul, tujuan kami menggunakannya, pihak yang menerimanya dan cara menghubungi kami mengenainya.

Data peribadi yang kami proses

Kami memproses data peribadi anda yang berikut:

  • Nama anda
  • Nombor telefon
  • Alamat e-mel
  • Alamat
  • Butiran pembayaran, seperti rujukan bank atau kad
  • Pengecam dalam talian, seperti kuki dan alamat IP

Dari mana kami memperoleh data

Kami mengumpul data peribadi anda terus daripada anda, contohnya apabila anda mengisi borang kami, menghubungi kami atau membeli daripada kami, dan daripada orang yang anda benarkan bertindak bagi pihak anda.

Sebahagian data, seperti kuki dan alamat IP, dikumpul secara automatik apabila anda menggunakan laman web kami.

Tujuan kami menggunakannya

Kami menggunakan data peribadi anda untuk:

  • memproses dan menghantar pesanan anda
  • menjawab pertanyaan dan aduan anda
  • membuat bil dan menerima bayaran
  • menghantar berita dan tawaran kepada anda, jika anda bersetuju

Pihak yang menerima data anda

Kami mungkin mendedahkan data peribadi anda kepada:

  • penyedia pembayaran yang memproses bayaran anda
  • syarikat penghantaran dan kurier
  • penyedia hosting awan dan perkhidmatan IT yang menyimpan data bagi pihak kami
  • agensi kerajaan dan pengawal selia, apabila dikehendaki oleh undang-undang

Kami hanya berkongsi data yang diperlukan oleh setiap pihak bagi tujuan di atas.

Pemindahan ke luar Malaysia

Sebahagian data peribadi anda mungkin dipindahkan ke dan disimpan di luar Malaysia, contohnya di pelayan penyedia awan atau perisian kami. Kami hanya memindahkannya seperti yang dibenarkan oleh seksyen 129 Akta dan mengambil langkah untuk memastikan data itu terus dilindungi.

Tempoh penyimpanan

Kami menyimpan data peribadi anda sepanjang anda menjadi pelanggan kami dan selama tempoh yang dikehendaki oleh undang-undang selepas itu.

Apabila data itu tidak lagi diperlukan, kami memusnahkan atau memadamnya secara kekal.

Adakah anda wajib memberikannya?

Maklumat yang ditanda wajib perlu diberikan. Maklumat lain adalah secara sukarela.

Jika anda tidak memberikan data peribadi yang diperlukan, kami mungkin tidak dapat menyediakan produk atau perkhidmatan kami kepada anda.

Hak anda

Anda boleh bertanya sama ada kami menyimpan data peribadi anda, meminta salinannya, dan meminta kami membetulkannya jika ia salah, tidak lengkap atau tidak terkini (seksyen 30 dan 34 Akta). Fi yang ditetapkan mungkin dikenakan bagi permintaan akses.

Anda juga boleh meminta kami menghantar data peribadi anda kepada organisasi lain pilihan anda, jika ini boleh dilaksanakan secara teknikal (seksyen 43A Akta).

Hantar permintaan, pertanyaan dan aduan anda kepada pihak yang dinyatakan di bawah.

Pilihan anda

Anda boleh mengehadkan cara kami memproses data peribadi anda, atau menarik balik persetujuan anda, dengan menulis kepada kami melalui saluran di bawah.

Anda boleh meminta kami berhenti menghantar mesej pemasaran pada bila-bila masa dengan menulis kepada kami.

Jika anda memberikan data peribadi orang lain kepada kami, seperti ahli keluarga atau kakitangan, pastikan mereka mengetahui notis ini.

Jika anda mengehadkan pemprosesan atau menarik balik persetujuan, kami mungkin tidak dapat menyediakan sebahagian perkhidmatan kami.

Cara menghubungi kami

Untuk akses, pembetulan, pertanyaan atau aduan, hubungi kami:

  • E-mel: privacy@example.com.my

Mengenai notis ini

Notis ini disediakan dalam Bahasa Malaysia dan bahasa Inggeris. Kemas kini terakhir: 22 Oktober 2026.

English

Personal Data Protection Notice

Kedai Contoh Sdn. Bhd. (registration no. 202401000001) ("we") processes your personal data in line with the Personal Data Protection Act 2010. This notice explains what personal data we collect, why we use it, who we share it with and how you can contact us about it.

The personal data we process

We process the following personal data about you:

  • Your name
  • Phone number
  • Email address
  • Address
  • Payment details, such as bank or card references
  • Online identifiers, such as cookies and IP address

Where we get it

We collect your personal data directly from you, for example when you fill in our forms, contact us or buy from us, and from people you authorise to act for you.

Some data, such as cookies and IP address, is collected automatically when you use our website.

Why we use it

We use your personal data to:

  • process and deliver your orders
  • answer your questions and complaints
  • bill you and collect payment
  • send you news and offers, if you agree

Who we share it with

We may disclose your personal data to:

  • payment providers that process your payments
  • delivery and courier companies
  • cloud hosting and IT service providers that store data for us
  • government agencies and regulators, when required by law

We share only what each party needs for the purposes above.

Transfers outside Malaysia

Some of your personal data may be transferred to and stored outside Malaysia, for example on the servers of our cloud or software providers. We transfer it only as allowed by section 129 of the Act and take steps to keep it protected.

How long we keep it

We keep your personal data while you are our customer and for as long as the law requires after that.

When it is no longer needed, we destroy or permanently delete it.

Do you have to give it?

The details marked as required are obligatory. Everything else is voluntary.

If you do not give us the required personal data, we may not be able to provide our products or services to you.

Your rights

You may ask whether we hold your personal data, request a copy of it, and ask us to correct it if it is wrong, incomplete or out of date (sections 30 and 34 of the Act). A prescribed fee may apply to an access request.

You may also ask us to send your personal data to another organisation of your choice, where this is technically feasible (section 43A of the Act).

Send your requests, questions and complaints to the contact below.

Your choices

You may limit how we process your personal data, or withdraw your consent, by writing to us at the contact below.

You can ask us to stop sending you marketing messages at any time by writing to us.

If you give us personal data about other people, such as family members or staff, please make sure they know about this notice.

If you limit our processing or withdraw your consent, we may not be able to provide some of our services.

How to contact us

For access, correction, questions or complaints, contact us:

  • Email: privacy@example.com.my

About this notice

This notice is available in Bahasa Malaysia and English. Last updated: 22 October 2026.

Show both versions together, or link to both, wherever you first ask for personal data.

Want your forms and website PDPA-ready?

A notice is step one. Pali builds the forms, records and requests behind it.

  • Consent checkbox on every form, with each consent recorded and dated
  • This notice published on your site in BM and English, linked from every form
  • Retention and deletion that runs on a schedule, not on memory
  • An access and correction request flow, on secure hosting
Price
From RM 900
Timeline
About 1 week for a site, 5 weeks for a portal
WhatsApp PaliBook a free 30 minute call See website and app development

What must a PDPA privacy notice include?

Section 7(1) of the Act lists eight items. Every notice here covers all of them.

  1. 7(1)(a)That personal data is being processed, with a description of that data.
  2. 7(1)(b)The purposes it is collected and further processed for.
  3. 7(1)(c)Any information you hold on where the data came from.
  4. 7(1)(d)The right to request access and correction, and how to contact you with inquiries or complaints.
  5. 7(1)(e)The classes of third parties you disclose it to, or may disclose it to.
  6. 7(1)(f)The choices and means you offer to limit processing, including data about other people.
  7. 7(1)(g)Whether giving the data is obligatory or voluntary.
  8. 7(1)(h)If obligatory, what happens if the person does not give it.
  • Section 7(3): the notice must be in the national language and in English.
  • Section 7(2): give it as soon as practicable, when you first ask for or collect the data, or before a new use or a disclosure to a third party.

What did the 2024 amendments change?

The Personal Data Protection (Amendment) Act 2024 came into force in three stages.

In forceWhat changed
1 January 2025Administrative changes only. No new duties for businesses.
1 April 2025"Data user" is now "data controller". Deceased people are no longer data subjects.
1 April 2025Biometric data, such as fingerprints and face scans, became sensitive personal data.
1 April 2025Data processors must follow the Security Principle. The maximum penalty for breaching the principles rose from a fine of RM 300,000 or 2 years' jail, or both, to RM 1,000,000 or 3 years, or both.
1 April 2025The whitelist of approved countries was removed. You may transfer data abroad where the law there is substantially similar or protection is adequate, or under an exception such as consent.
1 June 2025Data controllers and processors must appoint a Data Protection Officer when they meet the thresholds.
1 June 2025Data breaches must be reported to the Commissioner as soon as practicable, and to affected people when significant harm is likely. Failing to notify the Commissioner can mean a fine up to RM 250,000, up to 2 years' jail, or both.
1 June 2025People can ask you to send their data to another organisation (data portability), where technically feasible.

The Commissioner's guidance treats a breach of over 1,000 people, or of sensitive data, as significant. Secondary sources report a 72 hour deadline to notify the Commissioner and 7 days after that for affected people.

How does this generator work?

  1. 01Each answer switches a fixed, reviewed paragraph on or off. Nothing is written by AI.
  2. 02Every notice covers the eight section 7(1) items, the retention principle and the rights to access, correction and portability.
  3. 03Health data adds an explicit-consent section, transfers abroad add a section 129 paragraph, and a DPO adds their contact.
  4. 04It all runs in your browser. Your answers are not sent or saved, and usage stats never include them.

Sources

Checked on 22 October 2026, official pdp.gov.my documents first.

Register a Data Protection Officer with the Commissioner at daftar.pdp.gov.my

Last updated

Questions about PDPA privacy notices

Does my small business need a PDPA privacy notice?

Yes, if you process personal data in commercial transactions. Section 7 requires a written notice to each person whose data you collect, whatever your size. A form, an order page and a WhatsApp booking all count.

Must the notice be in both BM and English?

Yes. Section 7(3) of the Act says the notice must be in the national language and in English, and people must have a clear way to exercise their choices in both languages. This tool writes both from the same answers.

Do I need explicit consent?

For sensitive personal data, yes. That covers health, political opinions, religious beliefs, offences and, since the 2024 amendments, biometric data. Use a separate unticked box and keep a record of each consent.

Do I need a Data Protection Officer?

You must appoint one if you process personal data of over 20,000 people, sensitive data of over 10,000, or monitor people regularly and systematically. Register the appointment within 21 days.

Is this notice legal advice?

No. It is a starting template built from the items the Act requires. Check it against how your business really uses data, and talk to a lawyer for complex processing such as health records, children or large databases.

You've reached the end, so now

Tell me what you're building.

A free 30 minute call is the fastest way to find out if I can help.

Book a free callGet a price in 2 minutes
Or ask for a free 5-minute audit

Penang |