Malaysia PDPD Opens Consultation on AI and Personal Data Protection Framework (October 2026)
On 5 October 2026, Malaysia's Personal Data Protection Department (PDPD) published a consultation paper on a proposed Artificial Intelligence and Personal Data Protection Framework — lifecycle-based guidance for how organisations that develop, procure, deploy or support AI systems should comply with the Personal Data Protection Act 2010 (PDPA) when processing personal data. Submissions are due by 23 October 2026 (via a designated Google Form or the Unified Public Consultation Platform).
Key proposals, per Baker McKenzie's client alert:
- No new legal basis: "AI does not create a separate legal basis for processing personal data." Organisations must identify and document the applicable legal basis, ensure necessity and proportionality, provide clear privacy notices, and obtain fresh consent where personal data will be used for a materially different purpose.
- Development and deployment: Data Protection by Design embedded across AI design, training, testing and validation; adequate and relevant datasets; accuracy; anonymisation/pseudonymisation; validation before deployment and monitoring in use.
- Third-party AI and cross-border transfers — the cross-border hook: "Before procuring or integrating third-party AI systems, organisations should conduct due diligence, define roles and data-processing responsibilities contractually, assess cross-border transfers and applicable safeguards, and maintain ongoing vendor oversight." AI vendor contracts now need transfer-mapping against Malaysia's post-amendment transfer grounds (substantially similar law / adequate protection / listed grounds — see Malaysia Launches Cross-Border Personal Data Transfer Guidelines, Shifting Adequacy Burden to Data Controllers).
- Data subject rights: existing PDPA rights (access, correction, withdrawal of consent, portability) continue to apply, "including in relation to AI-generated or derived personal data, where applicable."
- Governance and evidence: assign accountability, conduct risk/impact assessments (DPIAs where appropriate), test/monitor/audit, and retain records — "The emphasis is not only on compliance, but on maintaining evidence that governance arrangements operate effectively."
Context: the Framework sits alongside a proposed AI Governance Bill which Baker McKenzie reports is "expected to be tabled in Parliament, at the latest by Q1 2027", intended to establish overarching governance principles, institutional responsibilities and safeguards. Together the two instruments signal Malaysia building a structured AI governance regime on top of its amended PDPA — following its April 2025 shift to risk-based cross-border transfer guidelines and the 2024–2025 PDPA overhaul (Malaysia Implements Major PDPA Overhaul and Launches Risk-Based Cross-Border Transfer Guidelines).
What a compliance team should do now (per the alert): map each AI use case to PDPA compliance; verify Data Protection by Design is embedded in practice across the AI lifecycle; and re-examine vendor review and contracting processes against the Framework's proposals — and comment by 23 October if the positions affect your AI stack.