Working on safeguarding cross-border data transfer

THE foundation of every cross-border data flow mechanism is trust. This is especially pertinent as countries confront numerous barriers in cross-border data flows, primarily due to differing regulatory demands and interpretations.

But what constitutes trust requires clarification, and that clarity is bound to different interpretations and implementations in different countries.

One of the proposed amendments to the Personal Data Protection Act 2010 (PDPA 2010) is to revise the provision relating to transfer of personal data outside of Malaysia. This entails eliminating the Whitelist policy and fortifying the adequacy requirement.

Currently, under Section 129(1) of PDPA 2010, “A data user shall not transfer any personal data of a data subject to a place outside Malaysia unless to such place as specified by the Minister, upon the recommendation of the Commissioner...”

As a result of our continuous efforts to put Malaysia on the global data transfer safe map, the Personal Data Protection Commissioner Malaysia (PDP) was accepted as a member of the Apec (Asia Pacific Economic Cooperation) Cross-border Privacy Enforcement Arrangement (CPEA) in August 2023.

Currently, the PDP is actively preparing to participate in the Apec Cross Border Privacy Rules (CBPR), a government-backed data privacy certification that companies can voluntarily join to demonstrate their compliance with international data privacy standards.

Recently, PDP collaborated with the Personal Information Protection Commission of Japan (PPC Japan) and Personal Information Protection Commission of Korea (PIPC Korea) in developing personal data protection policies and privacy enhancement technology.

Simultaneously, PDP is developing guidelines on cross-border data transfer mechanisms to facilitate businesses in ensuring that cross-border data transfer occurs in a secure and guided manner.

The proposed amendments to PDPA 2010 and our participation in global cross-border data flow platforms such as DFFT (Data Free Flow with Trust) and CBPR indicate our determination to enhance trust at domestic and international.

Earning trust is essential, whether on a global or domestic scale.