PDPA registration in Malaysia is not needed by every business. This guide is for SME owners and new business owners. It explains who must register as a data controller with the Personal Data Protection Department (JPDP), how the registration works, and what the penalties are. The short answer: you must register only if your business falls into one of the 13 classes set by the government, but the Personal Data Protection Act 2010 (Act 709) still applies to you either way.
A data controller is a person or business that decides how personal data is collected and used. Older texts call this a "data user". The Personal Data Protection (Amendment) Act 2024 (Act A1727) replaces "data user" with "data controller", but some official titles still use the old term. Both words mean the same party in this guide.
Key Takeaways
- Section 15 of Act 709 requires businesses in the 13 classes to apply for registration.
- Classes include communication, banking, insurance, health, tourism, education, real estate and, under the service class, wholesale and retail, audit, accounting, law, engineering and architect businesses.
- Registration is done online through the Personal Data Protection System (SPDP) of JPDP.
- Not registering can lead to a fine of up to RM500,000, or imprisonment of up to three years, or both.
- Registering as a data controller is separate from appointing and registering a Data Protection Officer (DPO).
Who Must Do PDPA Registration in Malaysia
The 13 classes come from two government orders, P.U.(A) 336/2013 and P.U.(A) 326/2016. If your business is in one of these classes, you must apply for registration. If it is not, you do not need a registration certificate, but JPDP says other organisations that control commercial processing of personal data are still bound by Act 709.
| Class | Who is covered (summary) |
|---|---|
| 1. Communication | Licence holders under the Communications and Multimedia Act 1998 and the Postal Services Act 2012 |
| 2. Banking and financial institutions | Licensed banks, Islamic banks and development financial institutions |
| 3. Insurance | Licensed insurers and takaful operators |
| 4. Health sector | Private healthcare facilities, private medical and dental clinics, and pharmacist bodies corporate |
| 5. Tourism and hospitality | Tour operators, travel agents, tourist guides, tourism training institutions and registered tourist accommodation |
| 6. Transportation | The airlines named in the Order |
| 7. Education | Registered private higher education institutions and private schools |
| 8. Direct selling and direct marketing | Licensees under the Direct Sales and Anti-Pyramid Scheme Act 1993 |
| 9. Service | Companies and partnerships in law, audit, accounting, engineering or architecture; wholesale and retail; private employment agencies |
| 10. Real estate | Licensed housing developers |
| 11. Utility | The utility companies named in the Order |
| 12. Pawnbroker | Licensees under the Pawnbrokers Act 1972 |
| 13. Money lenders | Licensees under the Moneylenders Act 1951 |
Many SMEs fall under class 9 because of wholesale and retail, or because they are an accounting, audit or engineering firm. Check the exact wording of your class on the JPDP page before you decide.
How to Register as a Data Controller
Registration is online. The steps shown by JPDP are:
- Create an account in the Personal Data Protection System (SPDP).
- Submit the registration application and the supporting document for your class.
- Pay the registration fee. Registration is complete only after payment.
- Download the certificate once JPDP has verified your application.
JPDP says it reviews applications within 14 working days and sends the status to your registered email. The fee depends on the type of business and the validity period you choose, so check the fee page of JPDP before you apply. The certificate has an expiry date, so note the renewal date in your compliance calendar. You must also display the certificate at your business premises.
Penalties for Not Registering
| Problem | Maximum penalty shown by JPDP |
|---|---|
| Not registering when your business is in the 13 classes | Fine up to RM500,000, or imprisonment up to three years, or both |
| Not displaying the certificate at the business premises | Fine up to RM10,000, or imprisonment up to one year, or both (Regulation 8, P.U.(A) 337/2013) |
| Processing personal data after the certificate has expired without renewal | Fine up to RM250,000, or imprisonment up to two years, or both |
| Processing personal data without a certificate or after cancellation | Listed by JPDP as a criminal offence |
These are maximum penalties. The court decides the actual outcome, so check with JPDP or a lawyer if you receive a notice.
Registration Is Not the Same as DPO Registration
A Data Protection Officer (DPO) is the person responsible for your personal data compliance. Since 1 June 2025, JPDP requires a DPO when your processing involves personal data of more than 20,000 people, sensitive personal data of more than 10,000 people, or regular and systematic monitoring such as tracking online behaviour. You must notify JPDP within 21 days of appointing the DPO, and update any change of DPO details within 14 days.
JPDP states that data controller registration is not a requirement before DPO registration. Treat them as two separate tasks. For DPO, breach and impact assessment rules, read our PDPA compliance checklist for Malaysian SMEs.
Checklist Before You Apply
- Check the JPDP list of 13 classes and find out whether your business falls into one.
- Collect the evidence document that JPDP lists for your class, such as your licence or registration.
- Create your SPDP account and submit the application.
- Pay the fee and download the certificate, then display it at your premises.
- Write the certificate expiry date in your compliance calendar and renew before it lapses.
Conclusion
PDPA registration depends on your business class, not on your company size. If you are unsure, start with the JPDP class list, then plan your wider compliance using our guides on business compliance in Malaysia and corporate compliance requirements.
How Conzlab can help: Conzlab can help you check whether your business falls into one of the 13 classes and prepare your documents for the SPDP application as part of a compliance check. Contact Conzlab to discuss your situation.
Official Sources
- JPDP: Registration of Data Controller
- JPDP: 13 Classes of Data Controller
- JPDP: Frequently Asked Questions
- JPDP: Personal Data Protection (Amendment) Act 2024
Last updated: 11 November 2026. This article is general information, not tax or legal advice. Rules can change, so check with the agency before you act.
Frequently Asked Questions
No. Only businesses in the 13 classes set by the government must register. Other businesses that control commercial processing of personal data are still bound by Act 709.
JPDP states that it reviews an application within 14 working days and sends the status to the registered email. The registration is complete only after the fee is paid.
No. They are two separate tasks. JPDP states that data controller registration is not a prerequisite for DPO registration.
Yes. JPDP states that the certificate must be displayed at the business premises. Not displaying it can lead to a fine of up to RM10,000, or imprisonment of up to one year, or both.
PDPA Registration Malaysia: Does Your Business Need It?