What Should You Do After a Data Breach? (PDPA Duties)

After a personal data breach, a Malaysian business must contain it and assess the harm. If the breach is likely to cause significant harm or affects more than 1,000 people, it must notify the Personal Data Protection Commissioner within 72 hours. Affected individuals must hear within seven days where significant harm is likely. These duties became mandatory on 1 June 2025, and missing them carries its own penalty. This is general information, not legal advice.

First, contain and assess the breach

Contain the breach before anything else, so more data does not leak while you respond. Take the affected system offline or lock it down, revoke exposed credentials, and stop the leak at its source. Turning on two-factor authentication for every admin login closes the most common way back in.

Then assess the scope: what personal data was involved, whose, and how many people. This assessment drives every decision that follows, including whether you must notify individuals at all.

If a hacked website caused the breach, the technical cleanup runs in parallel, covered in how to clean a hacked website. Containment and notification are duties you carry whatever software failed.

Notify the Commissioner within 72 hours

Notify Malaysia's Personal Data Protection Commissioner as soon as practicable, and within 72 hours, when the breach causes or is likely to cause significant harm. The JPDP's breach notification guideline also counts any breach affecting more than 1,000 people. This became a legal duty on 1 June 2025 under the amended PDPA.

The guideline counts the 72 hours from the breach, and its worked examples start the clock once you confirm a breach has actually happened. A slow investigation cannot buy you time. Malaysia's data breach notification guidelines set the window at "as soon as practicable and within 72 hours" (DLA Piper, 2025).

If you cannot gather every detail in time, you still notify on time and send the rest in stages, within 30 days of the first notice. A late-but-complete report does not beat an on-time initial one. The general duties this sits within are in our PDPA guide.

Notify affected individuals within 7 days

Tell affected individuals within seven days of notifying the Commissioner, where the breach is likely to cause them significant harm. The seven-day clock runs from your notification to the Commissioner, not from the breach itself.

"Significant harm" is defined broadly. It includes physical harm, financial loss, a negative effect on someone's credit or property, misuse for illegal purposes, sensitive personal data, or data that could enable identity fraud.

So a leak of names and emails may not trigger individual notice, while a leak of IC numbers or financial records almost certainly does. A breach affecting more than 1,000 people still goes to the Commissioner, even when individuals need no notice. When in doubt, a data protection professional can help you judge the threshold.

The penalties for getting it wrong

The penalties changed sharply under the 2024 amendment, so a breach is no longer a quiet internal matter. The maximum fine for breaching the data protection principles rose from RM300,000 to RM1,000,000, and the maximum jail term from two years to three.

Failing to notify a breach carries its own separate penalty, on top of any liability for the breach. For not notifying the Commissioner as required, the new section 12B of the PDPA sets a fine of up to RM250,000. The court can add up to two years' jail, or impose both.

Failure	Maximum penalty
Breaching the data protection principles	Up to RM1,000,000, up to 3 years' jail, or both
Failing to notify a breach	Up to RM250,000, up to 2 years' jail, or both

Sources: Personal Data Protection (Amendment) Act 2024 (Act A1727), via the Personal Data Protection Department.

Prevent the next breach

Most breaches are preventable with the same boring maintenance that prevents most hacks. Keep software updated, hold a tested off-server backup, and limit who can reach personal data.

In our experience maintaining Malaysian SME websites, many owners have no backup until the day they need one. Restoring a good backup is quick, while rebuilding a compromised site is slow. An incident plan works the same way. Deciding now who calls the Commissioner, who reviews the logs, and who talks to customers turns a panic into a checklist.

Security costs less before an incident than after. It belongs in your maintenance budget, not your wish list.

Frequently asked questions

Does every data breach have to be reported?

No. You notify the Commissioner when a breach is likely to cause significant harm or affects more than 1,000 people, as soon as practicable and within 72 hours. Affected individuals must hear within seven days of that report, but only where the breach is likely to cause them significant harm. Financial loss and identity fraud are the common examples.

What counts as a data breach under the PDPA?

Any loss, misuse, or unauthorized access to personal data you hold. That covers a hacked website leaking customer records, a lost laptop with client files, a misconfigured database left public, or an email sent to the wrong list. The trigger is personal data being exposed or lost, not whether an attacker was involved. Accidental exposure counts.

What happens if I miss the 72-hour deadline?

You face a separate penalty for late or missing notification, on top of any liability for the breach itself. The amended PDPA sets the fine for failing to notify at up to RM250,000, up to two years' jail, or both. A late report is still better than none, so notify as soon as you can. The guideline then requires a written explanation of the delay, with evidence such as the incident timeline.

Do small businesses have to comply?

Yes. The PDPA breach duties apply by the data you hold, not your company size. A one-person business that stores customer names, emails, or IC numbers carries the same 72-hour notification duty as a large firm when a breach meets the threshold. What scales with size is the depth of your response plan, not whether the rules reach you, a point covered in our PDPA guide.

Should I tell customers even when notice is not strictly required?

Often yes, as a trust decision rather than a legal one. Where harm is unlikely, the PDPA may not require individual notice, but telling customers plainly can protect the relationship better than silence that surfaces later. Weigh the reputational cost of them hearing it elsewhere. For a specific case, a data protection professional can advise on both the duty and the disclosure.

Have a plan before you need one

Storming Solutions builds custom-coded websites for Malaysian businesses from Kuala Lumpur, and maintains existing WordPress sites, with secure data handling and backups built in from the first page. We cannot promise a site will never be breached, because nobody honest can, but we can make sure you are not writing your response plan at hour one of the 72.

If you are unsure whether your site collects data safely, or what your breach duties are, ask us for a review or see our web development page. For a live breach or a specific legal question, contact the Commissioner and a qualified data protection professional without delay.