PERSONAL DATA PROTECTION ACT 2010
(1) This Act may be cited as the Personal Data Protection Act 2010 .
(2) This Act comes into operation on a date to be appointed by the Minister by notification in the Gazette , and the Minister may appoint different dates for different provisions of this Act.
(1) This Act applies to:-
(a) any person who processes; and
(b) any person who has control over or authorizes the processing of,
any personal data in respect of commercial transactions.
(2) Subject to subsection (1), this Act applies to a person in respect of personal data if:-
(a) the person is established in Malaysia and the personal data is processed, whether or not in the context of that establishment, by that person or any other person employed or engaged by that establishment; or
(b) the person is not established in Malaysia, but uses equipment in Malaysia for processing the personal data otherwise than for the purposes of transit through Malaysia.
(3) A person falling within paragraph (2)(b) shall nominate for the purposes of this Act a representative established in Malaysia.
(4) For the purposes of subsections (2) and (3), each
(1) This Act shall not apply to the Federal Government and State Governments.
(2) This Act shall not apply to any personal data processed outside Malaysia unless that personal data is intended to be further processed in Malaysia.
In this Act, unless the context otherwise requires:-
"credit reporting agency" has the meaning assigned to it in the Credit Reporting Agencies Act 2010 [Act 710] ;
"this Act" includes regulations, orders, notifications and other subsidiary legislation made under this Act;
"register" means the Register of Data Users, Register of Data User Forums or Register of Codes of Practice;
"personal data" means any information in respect of commercial transactions, which:-
(a) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose;
(b) is recorded with the intention that it should wholly or partly be processed by means of such equipment; or
5 PART II PERSONAL DATA PROTECTION Division 1 Personal Data Protection Principles-5. Personal Data Protection Principles.
(1) The processing of personal data by a data user shall be in compliance with the following Personal Data Protection Principles, namely:-
(a) the General Principle;
(b) the Notice and Choice Principle;
(c) the Disclosure Principle;
(d) the Security Principle;
(e) the Retention Principle;
(f) the Data Integrity Principle; and
(g) the Access Principle,
as set out in sections 6, 7, 8, 9, 10, 11 and 12.
(2) Subject to sections 45 and 46, a data user who contravenes subsection (1) commits an offence and shall, on conviction, be liable to a fine not exceeding three hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
6 PART II PERSONAL DATA PROTECTION Division 1 Personal Data Protection Principles-6. General Principle.
(1) A data user shall not:-
(a) in the case of personal data other than sensitive personal data, process personal data about a data subject unless the data subject has given his consent to the processing of the personal data; or
(b) in the case of sensitive personal data, process sensitive personal data about a data subject except in accordance with the provisions of section 40.
(2) Notwithstanding paragraph (1)(a), a data user may process personal data about a data subject if the processing is necessary:-
(a) for the performance of a contract to which the data subject is a party;
(b) for the taking of steps at the request of the data subject with a view to entering into a contract;
(c) for compliance with any legal obligation to which the data user is the subject, other than an obligation imposed by a contract;
(d) in order to protect the vital interests of
7 PART II PERSONAL DATA PROTECTION Division 1 Personal Data Protection Principles-7. Notice and Choice Principle.
(1) A data user shall by written notice inform a data subject:-
(a) that personal data of the data subject is being processed by or on behalf of the data user, and shall provide a description of the personal data to that data subject;
(b) the purposes for which the personal data is being or is to be collected and further processed;
(c) of any information available to the data user as to the source of that personal data;
(d) of the data subject's right to request access to and to request correction of the personal data and how to contact the data user with any inquiries or complaints in respect of the personal data;
(e) of the class of third parties to whom the data user discloses or may disclose the personal data;
(f) of the choices and means the data user offers the data subject for limiting the processing of personal data, including personal data relating to other persons who may be identif
8 PART II PERSONAL DATA PROTECTION Division 1 Personal Data Protection Principles-8. Disclosure Principle.
Subject to section 39, no personal data shall, without the consent of the data subject, be disclosed:-
(a) for any purpose other than:-
(i) the purpose for which the personal data was to be disclosed at the time of collection of the personal data; or
(ii) a purpose directly related to the purpose referred to in subparagraph (i); or
(b) to any party other than a third party of the class of third parties as specified in paragraph 7(1)(e).
9 PART II PERSONAL DATA PROTECTION Division 1 Personal Data Protection Principles-9. Security Principle.
(1) A data user shall, when processing personal data, take practical steps to protect the personal data from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction by having regard:-
(a) to the nature of the personal data and the harm that would result from such loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction;
(b) to the place or location where the personal data is stored;
(c) to any security measures incorporated into any equipment in which the personal data is stored;
(d) to the measures taken for ensuring the reliability, integrity and competence of personnel having access to the personal data; and
(e) to the measures taken for ensuring the secure transfer of the personal data.
(2) Where processing of personal data is carried out by a data processor on behalf of the data
10 PART II PERSONAL DATA PROTECTION Division 1 Personal Data Protection Principles-10. Retention Principle.
(1) The personal data processed for any purpose shall not be kept longer than is necessary for the fulfilment of that purpose.
(2) It shall be the duty of a data user to take all reasonable steps to ensure that all personal data is destroyed or permanently deleted if it is no longer required for the purpose for which it was to be processed.
11 PART II PERSONAL DATA PROTECTION Division 1 Personal Data Protection Principles-11. Data Integrity Principle.
A data user shall take reasonable steps to ensure that the personal data is accurate, complete, not misleading and kept up-to-date by having regard to the purpose, including any directly related purpose, for which the personal data was collected and further processed.
12 PART II PERSONAL DATA PROTECTION Division 1 Personal Data Protection Principles-12. Access Principle.
A data subject shall be given access to his personal data held by a data user and be able to correct that personal data where the personal data is inaccurate, incomplete, misleading or not up-to-date, except where compliance with a request to such access or correction is refused under this Act.
13 Division 2 Registration-13. Application of this Division.
(1) This Division shall apply to a data user who belongs to a class of data users as specified in the order made under subsection 14(1).
(2) A data user who belongs to a class of data users not specified in the order made under subsection 14(1) shall comply with all the provisions of this Act other than the provisions of this Division relating to the registration of data users and matters connected thereto.
14 Division 2 Registration-14. Registration of data users.
(1) The Minister may, upon the recommendation of the Commissioner, by order published in the Gazette , specify a class of data users who shall be required to be registered as data users under this Act.
(2) The Commissioner shall, before making his recommendation under subsection (1), consult with:-
(a) such bodies representative of data users belonging to that class; or
(b) such other interested persons.
15 Division 2 Registration-15. Application for registration.
(1) A person who belongs to the class of data users as specified in the order made under subsection 14(1) shall submit an application for registration to the Commissioner in the manner and form as determined by the Commissioner.
(2) Every application for registration shall be accompanied with the prescribed registration fee and such documents as may be required by the Commissioner.
(3) The Commissioner may in writing at any time after receiving the application and before it is determined, require the applicant to provide such additional documents or information within the time as specified by the Commissioner.
(4) If the requirement under subsection (3) is not complied with, the application for registration shall be deemed to have been withdrawn by the applicant and shall not be further proceeded with by the Commissioner, but without prejudice to a fresh application being made by the applicant.
16 Division 2 Registration-16. Certificate of registration.
(1) After having given due consideration to an application under subsection 15(1), the Commissioner may:-
(a) register the applicant and issue a certificate of registration to the applicant in such form as determined by the Commissioner; or
(b) refuse the application.
(2) The certificate of registration may be issued subject to such conditions or restrictions as the Commissioner may think fit to impose.
(3) Where the Commissioner refuses the application for registration in pursuance of subsection (1), he shall inform the applicant by a written notice that the application has been refused and the reasons for the refusal.
(4) A person who belongs to the class of data users as specified in the order made under subsection 14(1) and who processes personal data without a certificate of registration issued in pursuance of paragraph 16(1)(a) commits an offence and shall, on conviction, be liabl
17 Division 2 Registration-17. Renewal of certificate of registration.
(1) A data user may make an application for the renewal of the certificate of registration not later than ninety days before the date of expiry of the certificate of registration in the manner and form as determined by the Commissioner and the application shall be accompanied with the prescribed renewal fee and such documents as may be required by the Commissioner, but no application for renewal shall be allowed where the application is made after the date of expiry of the certificate of registration.
(2) When renewing a certificate of registration, the Commissioner may vary the conditions or restrictions imposed upon the issuance of the certificate of registration or impose additional conditions or restrictions.
(3) The Commissioner may refuse to renew a certificate of registration:-
(a) if the data user has failed to comply with any of the provisions of this Act;
(b) if the data user has failed to comply w
18 Division 2 Registration-18. Revocation of registration.
(1) The Commissioner may revoke the registration of a data user if the Commissioner is satisfied that:-
(a) the data user has failed to comply with any of the provisions of this Act;
(b) the data user has failed to comply with any conditions or restrictions imposed upon the issuance of the certificate of registration;
(c) the issuance of the certificate of registration was induced by a false representation of fact by the data user; or
(d) the data user has ceased to carry on the processing of personal data.
(2) Notwithstanding subsection (1), the Commissioner shall not revoke the registration of a data user unless the Commissioner is satisfied that, after giving the data user an opportunity of making any representation in writing he may wish to make, the registration should be revoked.
(3) Where the registration of the data user is revoked, the Commissioner shall issue a notice
19 Division 2 Registration-19. Surrender of certificate of registration.
(1) Where the certificate of registration is revoked in pursuance of section 18, the holder of the certificate shall, within seven days from the date of service of the notice of revocation of registration, surrender the certificate to the Commissioner.
(2) A person who fails to comply with subsection (1) commits an offence and shall, on conviction, be liable to a fine not exceeding two hundred thousand ringgit or to imprisonment for a term not exceeding two years or to both.
20 Division 2 Registration-20. Register of Data Users.
(1) The Commissioner shall maintain a Register of Data Users in accordance with section 128.
(2) The Register of Data Users shall contain the names of data users who have been registered in pursuance of this Division and any other particulars regarding such data users as may be determined by the Commissioner.
21 Division 3 Data User Forum and Code of Practice-21. Data user forum.
(1) The Commissioner may designate a body as a data user forum in respect of a specific class of data users for the purposes of this Act by notifying that body in writing, if the Commissioner is satisfied that:-
(a) the membership of the body is open to all data users of that class;
(b) the body is capable of performing as required under the relevant provisions of this Act; and
(c) the body has a written constitution.
(2) The body shall agree in writing to be a data user forum before the designation is registered by the Commissioner in the Register of Data User Forums.
(3) The Commissioner may decide that an existing body that was previously designated as a data user forum under subsection (1) is no longer a data user forum for the purposes of this Act, if he is satisfied that the body no longer meets the requirements as set out in that subsection.
(4) Where the Commissioner dec
22 Division 3 Data User Forum and Code of Practice-22. Register of Data User Forums.
(1) The Commissioner shall maintain a Register of Data User Forums in accordance with section 128.
(2) The Register of Data User Forums shall contain the names of data user forums which have been designated and registered in pursuance of this Division and any other particulars regarding such data user forums as may be determined by the Commissioner.
23 Division 3 Data User Forum and Code of Practice-23. Code of practice.
(1) A data user forum may prepare a code of practice:-
(a) on its own initiative; or
(b) upon request by the Commissioner.
(2) The data user forum shall, in preparing a code of practice under subsection (1), consider matters including:-
(a) the purpose for the processing of personal data by the data user or class of data users;
(b) the views of the data subjects or groups representing data subjects;
(c) the views of the relevant regulatory authority, if any, to which the data user is subject to; and
(d) that the code of practice, upon having regard to all of the matters in paragraphs (a), (b) and (c) and any other matters, offers an adequate level of protection for the personal data of the data subjects concerned.
(3) The Commissioner may register the code of practice prepared pursuant to subsection (1), if the Commissioner is satisfied
24 Division 3 Data User Forum and Code of Practice-24. Commissioner may issue code of practice.
(1) The Commissioner may issue a code of practice, if:-
(a) a code of practice is not prepared under paragraph 23(1)(a);
(b) the Commissioner is satisfied that a code of practice for a specific class of data users is unlikely to be prepared by the relevant data user forum within the period as specified by the Commissioner; or
(c) there is no data user forum to develop the relevant code of practice for the class of data users.
(2) The Commissioner shall, before issuing a code of practice under subsection (1), consider matters including:-
(a) the purpose for the processing of personal data by the data user or class of data users;
(b) the views of the data users or groups representing data users, to which the code of practice is applicable;
(c) the views of the data subjects or groups representing data subjects;
(d) the views of the relevant regulatory
25 Division 3 Data User Forum and Code of Practice-25. Applicable code of practice.
(1) The Commissioner shall ensure that there is only one code of practice registered for a class of data users at a given time.
(2) All data users belonging to a class of data users shall comply with the relevant registered code of practice that is applicable to that class of data users at a given time.
(3) Where a code of practice is registered by the Commissioner under section 23 or 24, the Commissioner shall notify, in such manner as he may determine, the relevant class of data users to whom the code of practice is applicable:-
(a) of the identity of the code of practice concerned and the date on which the code of practice is to take effect; and
(b) of the specific requirements under this Act for which the code of practice is issued and registered.
(4) If there is any uncertainty or ambiguity as to which code of practice is applicable to a particular data user or class of data users,
26 Division 3 Data User Forum and Code of Practice-26. Revocation, etc, of code of practice.
(1) The Commissioner may revoke, amend or revise, whether in whole or in part, any code of practice registered under this Act:-
(a) on his own accord; or
(b) upon an application by the data user forum or such bodies representing the data users.
(2) The Commissioner shall, before revoking, amending or revising a code of practice under subsection (1), consult with:-
(a) such data users or bodies representative of data users to which the code of practice shall apply, whether in whole or in part; and
(b) such other interested persons,
as the Commissioner thinks fit.
(3) Where any code of practice has been revoked, amended or revised under subsection (1), the Commissioner:-
(a) shall enter the particulars of such revocation, amendment or revision in the Register of Codes of Practice; and
(b) shall notify the relevant dat
27 Division 3 Data User Forum and Code of Practice-27. Submission of new code of practice by data user forum.
(1) A data user forum may submit a new code of practice to replace an existing code of practice.
(2) The new code of practice submitted in pursuance of subsection (1) shall be subject to the provisions of this Division.
28 Division 3 Data User Forum and Code of Practice-28. Register of Codes of Practice.
(1) The Commissioner shall maintain a Register of Codes of Practice in accordance with section 128.
(2) The Register of Codes of Practice shall contain:-
(a) particulars of codes of practice registered under section 23 or 24 and any revocation, amendment or revision to such codes of practice under section 26; and
(b) any opinion made by the Commissioner under section 25, including particulars of withdrawal of previous opinions.
29 Division 3 Data User Forum and Code of Practice-29. Non-compliance with code of practice.
A data user who fails to comply with any provision of the code of practice that is applicable to the data user commits an offence and shall, on conviction, be liable to a fine not exceeding one hundred thousand ringgit or to imprisonment for a term not exceeding one year or to both.
30 Division 4 Rights of Data Subject-30. Right of access to personal data.
(1) An individual is entitled to be informed by a data user whether personal data of which that individual is the data subject is being processed by or on behalf of the data user.
(2) A requestor may, upon payment of a prescribed fee, make a data access request in writing to the data user:-
(a) for information of the data subject's personal data that is being processed by or on behalf of the data user; and
(b) to have communicated to him a copy of the personal data in an intelligible form.
(3) A data access request for any information under subsection (2) shall be treated as a single request, and a data access request for information under paragraph (2)(a) shall, in the absence of any indication to the contrary, be treated as extending also to such request under paragraph (2)(b).
(4) In the case of a data user having separate entries in respect of personal data held for different purpos
31 Division 4 Rights of Data Subject-31. Compliance with data access request.
(1) Subject to subsection (2) and section 32, a data user shall comply with a data access request under section 30 not later than twenty-one days from the date of receipt of the data access request.
(2) A data user who is unable to comply with a data access request within the period specified in subsection (1) shall before the expiration of that period:-
(a) by notice in writing inform the requestor that he is unable to comply with the data access request within such period and the reasons why he is unable to do so; and
(b) comply with the data access request to the extent that he is able to do so.
(3) Notwithstanding subsection (2), the data user shall comply in whole with the data access request not later than fourteen days after the expiration of the period stipulated in subsection (1).
32 Division 4 Rights of Data Subject-32. Circumstances where data user may refuse to comply with data access request.
(1) A data user may refuse to comply with a data access request under section 30 if:-
(a) the data user is not supplied with such information as he may reasonably require:-
(i) in order to satisfy himself as to the identity of the requestor; or
(ii) where the requestor claims to be a relevant person, in order to satisfy himself:-
(A) as to the identity of the data subject in relation to whom the requestor claims to be the relevant person; and
(B) that the requestor is the relevant person in relation to the data subject;
(b) the data user is not supplied with such information as he may reasonably require to locate the personal data to which the data access request relates;
(c) the burden or expense of providing access is disproportionate to the risks to the data subject's privacy in relation to the personal data in the case in quest
33 Division 4 Rights of Data Subject-33. Notification of refusal to comply with data access request.
Where a data user who pursuant to section 32 refuses to comply with a data access request under section 30, he shall, not later than twenty-one days from the date of receipt of the data access request, by notice in writing, inform the requestor:-
(a) of the refusal and the reasons for the refusal; and
(b) where paragraph 32(1)(e) is applicable, of the name and address of the other data user concerned.
34 Division 4 Rights of Data Subject-34. Right to correct personal data.
(1) Where:-
(a) a copy of the personal data has been supplied by the data user in compliance with the data access request under section 30 and the requestor considers that the personal data is inaccurate, incomplete, misleading or not up-to-date; or
(b) the data subject knows that his personal data being held by the data user is inaccurate, incomplete, misleading or not up-to-date,
the requestor or data subject, as the case may be, may make a data correction request in writing to the data user that the data user makes the necessary correction to the personal data.
(2) Where a data user does not hold the personal data, but controls the processing of the personal data in such a way as to prohibit the data user who holds the personal data from complying, whether in whole or in part, with the data correction request under subsection (1) which relates to the personal data, the first-mentioned data u
35 Division 4 Rights of Data Subject-35. Compliance with data correction request.
(1) Subject to subsections (2), (3) and (5) and section 36, where a data user is satisfied that the personal data to which a data correction request relates is inaccurate, incomplete, misleading or not up-to-date, he shall, not later than twenty-one days from the date of receipt of the data correction request:-
(a) make the necessary correction to the personal data;
(b) supply the requestor with a copy of the personal data as corrected; and
(c) subject to subsection (4), where:-
(i) the personal data has been disclosed to a third party during the twelve months immediately preceding the day on which the correction is made; and
(ii) the data user has no reason to believe that the third party has ceased using the personal data for the purpose, including any directly related purpose, for which the personal data was disclosed to the third party,
take all practicable step
36 Division 4 Rights of Data Subject-36. Circumstances where data user may refuse to comply with data correction request.
(1) A data user may refuse to comply with a data correction request under section 34 if:-
(a) the data user is not supplied with such information as he may reasonably require:-
(i) in order to satisfy himself as to the identity of the requestor; or
(ii) where the requestor claims to be a relevant person, in order to satisfy himself:-
(A) as to the identity of the data subject in relation to whom the requestor claims to be the relevant person; and
(B) that the requestor is the relevant person in relation to the data subject;
(b) the data user is not supplied with such information as he may reasonably require to ascertain in what way the personal data to which the data correction request relates is inaccurate, incomplete, misleading or not up-to-date;
(c) the data user is not satisfied that the personal data to which the data correct
37 Division 4 Rights of Data Subject-37. Notification of refusal to comply with data correction request.
(1) Where a data user who pursuant to section 36 refuses to comply with a data correction request under section 34, he shall, not later than twenty-one days from the date of receipt of the data correction request, by notice in writing, inform the requestor:-
(a) of the refusal and the reasons for the refusal; and
(b) where paragraph 36(1)(e) is applicable, of the name and address of the other data user concerned.
(2) Without prejudice to the generality of subsection (1), where personal data to which the data correction request relates is an expression of opinion and the data user is not satisfied that the expression of opinion is inaccurate, incomplete, misleading or not up-to-date, the data user shall:-
(a) make a note, whether annexed to the personal data or elsewhere:-
(i) of the matters in respect of which the expression of opinion is considered by the requ
38 Division 4 Rights of Data Subject-38. Withdrawal of consent to process personal data.
(1) A data subject may by notice in writing withdraw his consent to the processing of personal data in respect of which he is the data subject.
(2) The data user shall, upon receiving the notice under subsection (1), cease the processing of the personal data.
(3) The failure of the data subject to exercise the right conferred by subsection (1) does not affect any other rights conferred on him by this Part.
(4) A data user who contravenes subsection (2) commits an offence and shall, on conviction, be liable to a fine not exceeding one hundred thousand ringgit or to imprisonment for a term not exceeding one year or to both.
39 Division 4 Rights of Data Subject-39. Extent of disclosure of personal data.
Notwithstanding section 8, personal data of a data subject may be disclosed by a data user for any purpose other than the purpose for which the personal data was to be disclosed at the time of its collection or any other purpose directly related to that purpose, only under the following circumstances:
(a) the data subject has given his consent to the disclosure;
(b) the disclosure:-
(i) is necessary for the purpose of preventing or detecting a crime, or for the purpose of investigations; or
(ii) was required or authorized by or under any law or by the order of a court;
(c) the data user acted in the reasonable belief that he had in law the right to disclose the personal data to the other person;
(d) the data user acted in the reasonable belief that he would have had the consent of the data subject if the data subject had known of the disclosing of the personal data
40 Division 4 Rights of Data Subject-40. Processing of sensitive personal data.
(1) Subject to subsection (2) and section 5, a data user shall not process any sensitive personal data of a data subject except in accordance with the following conditions:
(a) the data subject has given his explicit consent to the processing of the personal data;
(b) the processing is necessary:-
(i) for the purposes of exercising or performing any right or obligation which is conferred or imposed by law on the data user in connection with employment;
(ii) in order to protect the vital interests of the data subject or another person, in a case where:-
(A) consent cannot be given by or on behalf of the data subject; or
(B) the data user cannot reasonably be expected to obtain the consent of the data subject;
(iii) in order to protect the vital interests of another person, in a case where consent by or on behalf of the data subject has been unrea
41 Division 4 Rights of Data Subject-41. Repeated collection of personal data in same circumstances.
(1) Where a data user:-
(a) has complied with the provisions of the Notice and Choice Principle under section 7 in respect of the collection of personal data from the data subject, referred to as the "first collection" ; and
(b) on any subsequent occasion again collects personal data from that data subject, referred to as the "subsequent collection" ,
the data user is not required to comply with the provisions of the Notice and Choice Principle in respect of the subsequent collection if:-
(A) to comply with those provisions in respect of that subsequent collection would be to repeat, in the same circumstances, what was done to comply with that principle in respect of the first collection; and
(B) not more than twelve months have elapsed between the first collection and the subsequent colle
42 Division 4 Rights of Data Subject-42. Right to prevent processing likely to cause damage or distress.
(1) Subject to subsection (2), a data subject may, at any time by notice in writing to a data user, referred to as the "data subject notice", require the data user at the end of such period as is reasonable in the circumstances, to:-
(a) cease the processing of or processing for a specified purpose or in a specified manner; or
(b) not begin the processing of or processing for a specified purpose or in a specified manner,
any personal data in respect of which he is the data subject if, based on reasons to be stated by him:-
(A) the processing of that personal data or the processing of personal data for that purpose or in that manner is causing or is likely to cause substantial damage or substantial distress to him or to another person; and
(B) the damage or distress is or would be unwarranted.
(2) Subsection (1) shall not apply where:-
43 Division 4 Rights of Data Subject-43. Right to prevent processing for purposes of direct marketing.
(1) A data subject may, at any time by notice in writing to a data user, require the data user at the end of such period as is reasonable in the circumstances to cease or not to begin processing his personal data for purposes of direct marketing.
(2) Where the data subject is dissatisfied with the failure of the data user to comply with the notice, whether in whole or in part, under subsection (1), the data subject may submit an application to the Commissioner to require the data user to comply with the notice.
(3) Where the Commissioner is satisfied that the application of the data subject under subsection (2) is justified or justified to any extent, the Commissioner may require the data user to take such steps for complying with the notice.
(4) A data user who fails to comply with the requirement of the Commissioner under subsection (3) commits an offence and shall, on conviction, be liable to a fine not exceeding two hundred
44 Division 4 Rights of Data Subject-44. Record to be kept by data user.
(1) A data user shall keep and maintain a record of any application, notice, request or any other information relating to personal data that has been or is being processed by him.
(2) The Commissioner may determine the manner and form in which the record is to be maintained.
45 PART III EXEMPTION-45. Exemption.
(1) There shall be exempted from the provisions of this Act personal data processed by an individual only for the purposes of that individual's personal, family or household affairs, including recreational purposes.
(2) Subject to section 46, personal data:-
(a) processed for:-
(i) the prevention or detection of crime or for the purpose of investigations;
(ii) the apprehension or prosecution of offenders; or
(iii) the assessment or collection of any tax or duty or any other imposition of a similar nature,
shall be exempted from the General Principle, Notice and Choice Principle, Disclosure Principle and Access Principle and other related provisions of this Act;
(b) processed in relation to information of the physical or mental health of a data subject shall be exempted from the Access Principle and other related provisions of this Act of which the applicatio
46 PART III EXEMPTION-46. Power to make further exemptions.
(1) The Minister may, upon the recommendation of the Commissioner, by order published in the Gazette exempt:-
(a) the application of any of the Personal Data Protection Principles under this Act to any data user or class of data users; or
(b) any data user or class of data users from all or any of the provisions of this Act.
(2) The Minister may impose any terms or conditions as he thinks fit in respect of any exemption made under subsection (1).
(3) The Minister may at any time, on the recommendation of the Commissioner, by order published in the Gazette , revoke any order made under subsection (1).
47 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-47. Appointment of Commissioner.
(1) The Minister shall appoint any person as the "Personal Data Protection Commissioner" for the purposes of carrying out the functions and powers assigned to the Commissioner under this Act on such terms and conditions as he thinks desirable.
(2) The appointment of the Commissioner shall be published in the Gazette .
(3) The Commissioner appointed under subsection (1) shall be a body corporate having perpetual succession and a common seal.
(4) The Commissioner may sue and be sued in his corporate name.
48 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-48. Functions of Commissioner.
The Commissioner shall have the following functions:
(a) to advise the Minister on the national policy for personal data protection and all other related matters;
(b) to implement and enforce the personal data protection laws, including the formulation of operational policies and procedures;
(c) to promote and encourage associations or bodies representing data users to prepare codes of practice and to disseminate to their members the codes of practice for the purposes of this Act;
(d) to cooperate with bodies corporate or government agencies for the purpose of performing his functions;
(e) to determine in pursuance of section 129 whether any place outside Malaysia has in place a system for the protection of personal data that is substantially similar to that as provided for under this Act or that serves the same purposes as this Act;
(f) to undertake or cause to be undertaken research into an
49 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-49. Powers of Commissioner.
(1) The Commissioner shall have all such powers to do all things necessary or expedient for or in connection with the performance of his functions under this Act.
(2) Without prejudice to the generality of subsection (1), the powers of the Commissioner shall include the power:-
(a) to collect such fees as may be prescribed by the Minister;
(b) to appoint such agents, experts, consultants or any other persons as he thinks fit to assist him in the performance of his functions;
(c) to formulate human resource development and cooperation programmes for the proper and effective performance of his functions;
(d) to enter into contracts;
(e) to acquire, purchase, take, hold and enjoy any movable or immovable property of every description for the performance of his functions, and to convey, assign, surrender, yield up, charge, mortgage, demise, transfer or otherwise dispose of, or deal with such prop
50 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-50. Appointment of Deputy Commissioners and Assistant Commissioners.
(1) The Commissioner may, with the approval of the Minister, from time to time, appoint such number of public officers as Deputy Commissioners and such number of persons as Assistant Commissioners as are necessary to assist the Commissioner in the performance of his functions and the exercise of his powers under this Act.
(2) The Deputy Commissioners and Assistant Commissioners appointed under subsection (1) shall hold office for such periods, receive such remuneration, allowances or benefits, and shall be subject to such terms and conditions of service as the Commissioner, with the approval of the Minister, may determine.
(3) The Deputy Commissioners and Assistant Commissioners appointed under subsection (1) shall be subject to the supervision, direction and control of the Commissioner.
51 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-51. Appointment of other officers and servants.
The Commissioner may employ on such terms and conditions as he thinks desirable such officers and servants as may be necessary to assist him in the performance of his functions and the exercise of his powers under this Act.
52 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-52. Loans and advances to officers and servants.
The Commissioner may grant loans and advances to the officers and servants under section 51 for such purposes and on such terms and conditions as the Commissioner may determine.
53 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-53. Tenure of office.
Subject to such conditions as may be specified in his instrument of appointment, the Commissioner shall, unless he sooner resigns or vacates his office or his appointment is sooner revoked, hold office for a term not exceeding three years and may be eligible for reappointment.
54 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-54. Revocation of appointment and resignation.
(1) The Minister may at any time revoke the appointment of the Commissioner and shall state the reason for such revocation.
(2) The Commissioner may at any time resign his office by giving a written notice addressed to the Minister fourteen days prior to the intended date of resignation.
55 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-55. Temporary exercise of functions and powers of Commissioner.
(1) The Minister may temporarily appoint a Deputy Commissioner to perform the functions and powers of the Commissioner for the period when:-
(a) the Commissioner is by reason of illness, leave of absence or any other cause unable to perform his functions for any substantial period; or
(b) the office of the Commissioner is vacant.
(2) A person appointed under subsection (1) shall, during the period in which he is performing the functions and exercising the powers of the Commissioner under this section, be deemed to be the Commissioner.
56 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-56. Vacation of office.
The office of the Commissioner shall be vacated:-
(a) if he dies;
(b) if there has been proved against him, or he has been convicted of, a charge in respect of:-
(i) an offence involving fraud, dishonesty or moral turpitude;
(ii) an offence under any law relating to corruption; or
(iii) any other offence punishable with imprisonment (in itself only or in addition to or in lieu of a fine) for more than two years;
(c) if his conduct, whether in connection with his duties as a Commissioner or otherwise, has been such as to bring discredit on the office of the Commissioner;
(d) if he becomes bankrupt;
(e) if he is of unsound mind or is otherwise incapable of discharging his duties;
(f) if his appointment is revoked by the Minister; or
(g) if his resignation is accepted by the Minister.
57 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-57. Remuneration and allowances.
The Commissioner shall be paid such remuneration and allowances as the Minister may determine after consultation with the Minister of Finance.
58 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-58. Delegation of Commissioner's functions and powers.
(1) The Commissioner may, subject to such conditions, limitations or restrictions as he may think fit to impose, delegate any of his functions or powers imposed or conferred upon him under this Act, except his power of delegation, to the Deputy Commissioners or Assistant Commissioners, and any function or power so delegated may be performed and exercised by the officer in the name and on behalf of the Commissioner.
(2) The delegation under subsection (1) shall not preclude the Commissioner himself from performing or exercising at any time the delegated functions or powers.
59 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-59. Direction by Minister.
(1) The Commissioner shall be responsible to the Minister.
(2) The Minister may give to the Commissioner directions of a general character consistent with the provisions of this Act relating to the performance of the functions and powers of the Commissioner and the Commissioner shall give effect to such directions.
60 PART IV APPOINTMENT, FUNCTIONS AND POWERS OF COMMISSIONER-60. Returns, reports, accounts and information.
(1) The Commissioner shall furnish to the Minister and any such public authority as may be directed by the Minister, the returns, reports, accounts and information with respect to his activities as the Minister may require or direct.
(2) Without prejudice to the generality of subsection (1), the Commissioner shall, as soon as practicable after the end of each financial year, cause to be made and transmitted to the Minister and if so directed by the Minister to any other public authority, a report dealing with the activities of the Commissioner during the preceding financial year, and the report shall be in such form and shall contain such information relating to the proceedings and policies of the Commissioner as the Minister may specify.
61 PART V PERSONAL DATA PROTECTION FUND-61. Establishment of Fund.
(1) For the purposes of this Act, a fund to be known as the "Personal Data Protection Fund" is established.
(2) The Fund shall be controlled, maintained and operated by the Commissioner.
(3) The Fund shall consist of:-
(a) such sums as may be provided by Parliament for the purposes of this Act from time to time;
(b) fees, costs and any other charges imposed by or payable to the Commissioner under this Act;
(c) all monies derived from the sale, disposal, lease, hire or any other dealings with the movable or immovable property vested in or acquired by the Commissioner;
(d) all monies as may be paid to the Commissioner from time to time for loans given by the Commissioner; and
(e) all other monies or property which may in any manner become payable to or vested in the Commissioner in respect of any matter incidental to his functions and powers.
62 PART V PERSONAL DATA PROTECTION FUND-62. Expenditure to be charged on Fund.
The Fund may be expended for the following purposes:
(a) paying any expenditure lawfully incurred by the Commissioner;
(b) paying any expenses incurred for organizing campaigns, research, studies and publication of materials for the protection of personal data;
(c) paying the remuneration, allowances, benefits and other expenses of the Commissioner, Deputy Commissioners, Assistant Commissioners, members of the Advisory Committee, members, officers and servants of the Appeal Tribunal and officers and servants of the Commissioner, including the granting of loans and advances, superannuation allowances, retirement benefits and gratuities;
(d) paying any other expenses, expenditure, fees and costs, including fees for the engagement of consultants, and legal fees and costs, properly incurred or accepted, or deemed fit by the Commissioner in the performance of his functions and the exercise of his powers;
63 PART V PERSONAL DATA PROTECTION FUND-63. Conservation of Fund.
It shall be the duty of the Commissioner to conserve the Fund by so performing his functions and exercising his powers under this Act as to secure that the total revenues of the Commissioner are sufficient to meet all sums properly chargeable to its revenue account, including depreciation and interest on capital, taking one year with another.
64 PART V PERSONAL DATA PROTECTION FUND-64. Reserve fund.
The Commissioner shall establish and maintain a reserve fund within the Fund.
65 PART V PERSONAL DATA PROTECTION FUND-65. Financial year.
The financial year of the Commissioner shall begin on 1 January and end on 31 December of each year.
66 PART V PERSONAL DATA PROTECTION FUND-66. Limitation on contracts.
The Commissioner shall not, without the approval of the Minister and the concurrence of the Minister of Finance, enter into any contract under which the Commissioner is to pay or receive an amount exceeding two million ringgit.
67 PART V PERSONAL DATA PROTECTION FUND-67. Bank accounts.
The Commissioner shall open and maintain an account or accounts with such financial institution or financial institutions in Malaysia as the Commissioner, after consulting with the Minister, thinks fit; and every such account shall be operated upon as far as practicable by cheques signed by such persons as may be authorized by the Minister.
68 PART V PERSONAL DATA PROTECTION FUND-68. Accounts and audit.
The Commissioner shall cause proper accounts to be kept and maintained in respect of the Fund and in compliance with the provisions of the Statutory Bodies (Accounts and Annual Reports) Act 1980 [Act 240] .
69 PART V PERSONAL DATA PROTECTION FUND-69. Expenditure and preparation of estimates.
(1) The expenditure of the Commissioner up to such amount as may be authorized by the Minister for any one year shall be defrayed out of the Fund.
(2) Before 1 June of each year, the Commissioner shall submit to the Minister an estimate of the expenditure for the following year in such form and containing such particulars as the Minister may direct.
(3) The Minister shall, before 1 January of the following year, notify the Commissioner of the amount authorized for expenditure generally or of the amounts authorized for each description of expenditure based on the estimate prepared under subsection (2).
(4) The Commissioner may at any time submit to the Minister a supplementary estimate of its expenditure for any one year and the Minister may allow the whole or any part of the additional expenditure to be included in the supplementary estimate.
70 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-70. Establishment of Advisory Committee.
There is established a Personal Data Protection Advisory Committee.
71 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-71. Functions of Advisory Committee.
(1) The functions of the Advisory Committee shall be:-
(a) to advise the Commissioner on all matters relating to personal data protection, and the due administration and enforcement of this Act; and
(b) to advise the Commissioner on any matter referred by him to the Advisory Committee.
(2) The Commissioner shall not be bound to act upon the advice of the Advisory Committee.
72 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-72. Members of Advisory Committee.
The Advisory Committee shall consist of the following members to be appointed by the Minister:-
(a) a Chairman;
(b) three members from the public sector; and
(c) at least seven but not more than eleven other members.
73 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-73. Tenure of office.
A member appointed under section 72 shall, unless he sooner resigns or vacates his office or his appointment is sooner revoked, hold office for such period not exceeding three years as the Minister may determine at the time of his appointment, and shall be eligible for reappointment; but no member shall hold office for more than two consecutive terms.
74 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-74. Revocation of appointment and resignation.
(1) The Minister may at any time revoke the appointment of any member of the Advisory Committee and shall state the reason for such revocation.
(2) A member of the Advisory Committee appointed under section 72 may at any time resign from his office by giving a written notice addressed to the Minister fourteen days prior to the intended date of resignation.
75 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-75. Temporary exercise of functions of Chairman.
(1) The Minister may temporarily appoint any member of the Advisory Committee to act as the Chairman for the period when:-
(a) the Chairman is by reason of illness, leave of absence or any other cause unable to perform his functions for any substantial period; or
(b) the office of the Chairman is vacant.
(2) A member appointed under subsection (1) shall, during the period in which he is performing the functions of the Chairman under this section, be deemed to be the Chairman.
76 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-76. Vacation of office.
The office of a member of the Advisory Committee shall be vacated:-
(a) if he dies;
(b) if there has been proved against him, or he has been convicted of, a charge in respect of:-
(i) an offence involving fraud, dishonesty or moral turpitude;
(ii) an offence under any law relating to corruption; or
(iii) any other offence punishable with imprisonment (in itself only or in addition to or in lieu of a fine) for more than two years;
(c) if his conduct, whether in connection with his duties as a member of the Advisory Committee or otherwise, has been such as to bring discredit on the Advisory Committee;
(d) if he becomes bankrupt;
(e) if he is of unsound mind or is otherwise incapable of discharging his duties;
(f) in the case of the Chairman, if he absents himself from a meeting of the Advisory Committee without leave in writing of the
77 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-77. Allowances.
The Chairman and all other members of the Advisory Committee may be paid such allowances as the Minister may determine after consultation with the Minister of Finance.
78 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-78. Time and place of meetings.
(1) The Advisory Committee is to hold as many meetings as are necessary for the efficient performance of its functions and such meetings are to be held at such places and times as the Chairman may decide, provided that the Chairman shall not allow more than two months to lapse between meetings.
(2) The Chairman shall call for a meeting if requested to do so in writing by the Minister or by at least four members of the Advisory Committee.
79 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-79. Advisory Committee may invite others to attend meetings.
(1) The Advisory Committee may invite any person to attend any meeting or deliberation of the Advisory Committee for the purpose of assisting it on any matter under discussion.
(2) A person invited under subsection (1) shall be paid such allowances as may be determined by the Commissioner.
80 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-80. Minutes.
(1) The Advisory Committee shall cause minutes of all its meetings to be maintained and kept in a proper form.
(2) Minutes made of meetings of the Advisory Committee shall, if duly signed, be admissible in evidence in all legal proceedings without further proof.
(3) Every meeting of the Advisory Committee in respect of the proceedings of which minutes have been so made shall be deemed to have been duly convened and held and all members thereat to have been duly qualified to act.
81 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-81. Procedure.
The Advisory Committee may regulate its own procedure.
82 PART VI PERSONAL DATA PROTECTION ADVISORY COMMITTEE-82. Members to devote time to business of Advisory Committee.
The members of the Advisory Committee shall devote such time to the business of the Advisory Committee as is necessary to discharge their duties effectively.
83 PART VII APPEAL TRIBUNAL-83. Establishment of Appeal Tribunal.
There is established an Appeal Tribunal for the purpose of reviewing any of the matters on appeal as set out in section 93.
84 PART VII APPEAL TRIBUNAL-84. Powers of Appeal Tribunal.
(1) The Appeal Tribunal shall have the power:-
(a) to summon parties to the proceedings or any other person to attend before it to give evidence in respect of an appeal;
(b) to procure and receive evidence on oath or affirmation, whether written or oral, and examine all such persons as witnesses as the Appeal Tribunal considers necessary;
(c) where a person is so summoned, to require the production of any information, document or other thing in his possession or under his control which the Appeal Tribunal considers necessary for the purposes of the appeal;
(d) to administer any oath, affirmation or statutory declaration, as the case may require;
(e) where a person is so summoned, to allow the payment for any reasonable expenses incurred in connection with his attendance;
(f) to admit evidence or reject evidence adduced, whether oral or documentary, and whether admissible or inadmissible under
85 PART VII APPEAL TRIBUNAL-85. Members of Appeal Tribunal.
(1) The Appeal Tribunal shall consist of the following members who shall be appointed by the Minister:
(a) a Chairman; and
(b) at least two other members, or such greater number of members as the Minister thinks necessary.
(2) The Minister shall appoint a person who is a member of the Judicial and Legal Service of the Federation for at least ten years to be the Chairman of the Appeal Tribunal.
(3) The appointment of the members of the Appeal Tribunal shall be published by notification in the Gazette .
86 PART VII APPEAL TRIBUNAL-86. Secretary to Appeal Tribunal and other officers, etc.
(1) The Minister shall appoint a Secretary to the Appeal Tribunal on such terms and conditions as he thinks desirable.
(2) The Secretary to the Appeal Tribunal shall be responsible for the administration and management of the functions of the Appeal Tribunal.
(3) The Minister may appoint such number of officers and servants as the Minister thinks fit to assist the Secretary to the Appeal Tribunal in carrying out his functions under subsection (2).
(4) The Secretary to the Appeal Tribunal shall have the general control of the officers and servants of the Appeal Tribunal.
(5) For the purposes of this Act, the Secretary to the Appeal Tribunal and the officers appointed under subsection (3) shall be deemed to be officers of the Appeal Tribunal.
87 PART VII APPEAL TRIBUNAL-87. Tenure of office.
A member of the Appeal Tribunal appointed under subsection 85(1) shall, unless he sooner resigns or vacates his office or his appointment is sooner revoked:-
(a) hold office for a term not exceeding three years; and
(b) shall be eligible for reappointment upon the expiry of his term of office, but shall not be appointed for more than two consecutive terms.
88 PART VII APPEAL TRIBUNAL-88. Resignation and revocation of appointment.
(1) The Minister may at any time revoke the appointment of a member of the Appeal Tribunal and shall state the reason for such revocation.
(2) A member of the Appeal Tribunal appointed under subsection 85(1) may at any time resign from his office by giving a written notice addressed to the Minister fourteen days prior to the intended date of resignation.
89 PART VII APPEAL TRIBUNAL-89. Temporary exercise of functions of Chairman.
(1) The Minister may temporarily appoint any member of the Appeal Tribunal to act as the Chairman for the period when:-
(a) the Chairman is by reason of illness, leave of absence or any other cause unable to perform his functions for any substantial period; or
(b) the office of the Chairman is vacant.
(2) A member appointed under subsection (1) shall, during the period in which he is performing the functions of the Chairman under this section, be deemed to be the Chairman.
90 PART VII APPEAL TRIBUNAL-90. Vacation of office.
The office of a member of the Appeal Tribunal shall be vacated:-
(a) if he dies;
(b) if there has been proved against him, or he has been convicted of, a charge in respect of:-
(i) an offence involving fraud, dishonesty or moral turpitude;
(ii) an offence under any law relating to corruption; or
(iii) any other offence punishable with imprisonment (in itself only or in addition to or in lieu of a fine) for more than two years;
(c) if his conduct, whether in connection with his duties as a member of the Appeal Tribunal or otherwise, has been such as to bring discredit on the Appeal Tribunal;
(d) if he becomes bankrupt;
(e) if he is of unsound mind or otherwise incapable of discharging his duties;
(f) if he fails to comply with his obligations under section 92;
(g) if his performance as a member of the Appeal Tribunal has been
91 PART VII APPEAL TRIBUNAL-91. Allowances.
(1) The Chairman of the Appeal Tribunal appointed under paragraph 85(1)(a) shall be paid such fixed allowances and other allowances as the Minister may determine.
(2) The other members of the Appeal Tribunal appointed under paragraph 85(1)(b) shall be paid:-
(a) daily sitting allowances during the sitting of the Appeal Tribunal; and
(b) lodging, travelling and subsistence allowances,
as the Minister may determine.
92 PART VII APPEAL TRIBUNAL-92. Disclosure of interest.
(1) A member of the Appeal Tribunal shall disclose, as soon as practicable, to the Chairman any interest, whether substantial or not, which might conflict with the member's duties as a member of the Appeal Tribunal in a particular matter.
(2) If the Chairman is of the opinion that the member's interest is in conflict with his duties as a member of the Appeal Tribunal, the Chairman shall inform all the parties to the matter of the conflict.
(3) If none of the parties to the matter objects to the conflict, the member may continue to execute his duties as a member of the Appeal Tribunal in relation to that matter.
(4) If a party to the matter objects to the conflict, the member of the Appeal Tribunal shall not continue to execute his duties as a member of the Appeal Tribunal in relation to that matter.
(5) The failure by the member to disclose his interest under subsection (1) shall:-
(a) invalidate the
93 PART VII APPEAL TRIBUNAL-93. Appeal to Appeal Tribunal.
(1) Any person who is aggrieved by the decision of the Commissioner under this Act relating to matters, including:-
(a) the registration of a data user under Division 2 of Part II;
(b) the refusal of the Commissioner to register a code of practice under subsection 23(5);
(c) the failure of the data user to comply with a data access request or data correction request under Division 4 of Part II;
(d) the issuance of an enforcement notice under section 108;
(e) the refusal of the Commissioner to vary or revoke an enforcement notice under section 109; and
(f) the refusal of the Commissioner to carry out or continue an investigation initiated by a complaint under Part VIII,
may appeal to the Appeal Tribunal by filing a notice of appeal with the Appeal Tribunal.
(2) The notice of appeal shall be made in writing to the Appeal Tribunal within thirty days from the date of
94 PART VII APPEAL TRIBUNAL-94. Record of decision of Commissioner.
(1) The aggrieved person referred to in subsection 93(1) may, on his own initiative, request in writing from the Commissioner a statement of the grounds for his decision.
(2) Subject to subsection (3), the Commissioner shall, upon receiving the written request under subsection (1), provide to the aggrieved person, upon the payment of a prescribed fee, a copy of a statement of the grounds for his decision.
(3) Where a notice of appeal has been filed with the Appeal Tribunal under subsection 93(1), the Commissioner shall, if he has not already written the grounds for his decision in respect of the matter stated in the notice under subsection 93(1), record in writing the grounds for his decision, and the written grounds shall form part of the record of proceedings before the Appeal Tribunal.
95 PART VII APPEAL TRIBUNAL-95. Stay of decision pending appeal.
(1) A decision of the Commissioner shall be valid, binding and enforceable pending the decision of an appeal by the Appeal Tribunal, except where an appeal against an enforcement notice has been made to the Appeal Tribunal in accordance with subsection 93(2), or a stay of the decision of the Commissioner has been applied for under subsection (2) and granted by the Appeal Tribunal.
(2) An aggrieved person may apply in writing to the Appeal Tribunal for a stay of the decision of the Commissioner on or after the notice of appeal has been filed with the Appeal Tribunal.
96 PART VII APPEAL TRIBUNAL-96. Composition of Appeal Tribunal.
(1) Every proceeding of the Appeal Tribunal shall be heard and disposed of by three members or such greater uneven number of members of the Appeal Tribunal as the Chairman may in any particular case determine.
(2) In the absence of the Chairman, the senior member of the Appeal Tribunal shall preside.
97 PART VII APPEAL TRIBUNAL-97. Sitting of Appeal Tribunal.
(1) The Appeal Tribunal shall sit on such dates and at such places as the Chairman may appoint.
(2) The Chairman may cancel or postpone any sitting of the Appeal Tribunal or change the place of the sitting which has been appointed under subsection (1).
(3) The Secretary to the Appeal Tribunal shall by written notice inform the parties to the appeal of any change to the date or place of any sitting of the Appeal Tribunal.
98 PART VII APPEAL TRIBUNAL-98. Procedure of Appeal Tribunal.
The Appeal Tribunal may regulate its own procedure.
99 PART VII APPEAL TRIBUNAL-99. Decision of Appeal Tribunal.
(1) The decision of the Appeal Tribunal on any matter shall be decided on a majority of members of the Appeal Tribunal.
(2) A decision of the Appeal Tribunal shall be final and binding on the parties to the appeal.
100 PART VII APPEAL TRIBUNAL-100. Enforcement of decision of Appeal Tribunal.
A decision given by the Appeal Tribunal may, by leave of the Sessions Court, be enforced in the same manner as a judgment or order to the same effect, and where leave is so given, judgment may be entered in terms of the decision.
101 PART VIII INSPECTION, COMPLAINT AND INVESTIGATION-101. Inspection of personal data system.
(1) The Commissioner may carry out an inspection of:-
(a) any personal data system used by data users for the purpose of ascertaining information to assist the Commissioner in making recommendations to the relevant data user relating to the promotion of compliance with the provisions of this Act, in particular the Personal Data Protection Principles, by the relevant data user; or
(b) any personal data system used by data users belonging to a class of data users for the purpose of ascertaining information to assist the Commissioner in making recommendations to the class of data users to which the relevant data user belongs relating to the promotion of compliance with the provisions of this Act, in particular the Personal Data Protection Principles, by the class of data users to which the relevant data user belongs.
(2) For the purposes of this section:-
"data us
102 PART VIII INSPECTION, COMPLAINT AND INVESTIGATION-102. Relevant data user, etc, to be informed of result of inspection.
Where the Commissioner has completed an inspection of a personal data system, he shall in such manner and at such time as he thinks fit inform the relevant data user or class of data users to which the relevant data user belongs of:-
(a) the results of the inspection;
(b) any recommendations arising from the inspection that the Commissioner thinks fit to make relating to the promotion of compliance with the provisions of this Act, in particular the Personal Data Protection Principles, by the relevant data user or the class of data users to which the relevant data user belongs; and
(c) such other comments arising from the inspection as he thinks fit.
103 PART VIII INSPECTION, COMPLAINT AND INVESTIGATION-103. Reports by Commissioner.
(1) The Commissioner may, after completing the inspection of any personal data system used by data users belonging to a class of data users, publish a report:-
(a) setting out any recommendations arising from the inspection that the Commissioner thinks fit to make relating to the promotion of compliance with the provisions of this Act, in particular the Personal Data Protection Principles, by the class of data users to which the relevant data users belong; and
(b) in such manner as he thinks fit.
(2) A report published under subsection (1) shall be so framed as to prevent the identity of any individual from being ascertained.
104 PART VIII INSPECTION, COMPLAINT AND INVESTIGATION-104. Complaint.
Any individual or relevant person may make a complaint in writing to the Commissioner about an act, practice or request:-
(a) specified in the complaint;
(b) that has been done or engaged in, or is being done or engaged in, by the data user specified in the complaint;
(c) that relates to personal data of which the individual is the data subject; and
(d) that may be a contravention of the provisions of this Act, including any codes of practice.
105 PART VIII INSPECTION, COMPLAINT AND INVESTIGATION-105. Investigation by Commissioner.
(1) Where the Commissioner receives a complaint under section 104, the Commissioner shall, subject to section 106, carry out an investigation in relation to the relevant data user to ascertain whether the act, practice or request specified in the complaint contravenes the provisions of this Act.
(2) Where the Commissioner has reasonable grounds to believe that an act, practice or request has been done or engaged in, or is being done or engaged in, by the relevant data user that relates to personal data and such act, practice or request may be a contravention of the provisions of this Act, the Commissioner may carry out an investigation in relation to the relevant data user to ascertain whether the act, practice or request contravenes the provisions of this Act.
(3) The provisions of Part IX shall apply in respect of investigations carried out by the Commissioner under this Part.
106 PART VIII INSPECTION, COMPLAINT AND INVESTIGATION-106. Restriction on investigation initiated by complaint.
(1) The Commissioner may refuse to carry out or continue an investigation initiated by a complaint if he is of the opinion that, having regard to all the circumstances of the case:-
(a) the complaint, or a complaint of a substantially similar nature, has previously initiated an investigation as a result of which the Commissioner was of the opinion that there has been no contravention of the provisions of this Act;
(b) the act, practice or request specified in the complaint is trivial;
(c) the complaint is frivolous, vexatious or is not made in good faith; or
(d) any investigation or further investigation is for any other reason unnecessary.
(2) Notwithstanding the generality of the powers conferred on the Commissioner by this Act, the Commissioner may refuse to carry out or continue an investigation initiated by a complaint:-
(a) if:-
(i) the co
107 PART VIII INSPECTION, COMPLAINT AND INVESTIGATION-107. Commissioner may carry out or continue investigation initiated by complaint notwithstanding withdrawal of complaint.
Where the Commissioner is of the opinion that it is in the public interest so to do, he may carry out or continue an investigation initiated by a complaint notwithstanding that the complainant has withdrawn the complaint and, in any such case, the provisions of this Act shall apply to the complaint and the complainant as if the complaint had not been withdrawn.
108 PART VIII INSPECTION, COMPLAINT AND INVESTIGATION-108. Enforcement notice.
(1) Where, following the completion of an investigation about an act, practice or request specified in the complaint, the Commissioner is of the opinion that the relevant data user:-
(a) is contravening a provision of this Act; or
(b) has contravened such a provision in circumstances that make it likely that the contravention will continue or be repeated,
then the Commissioner may serve on the relevant data user an enforcement notice:-
(A) stating that he is of that opinion;
(B) specifying the provision of this Act on which he has based that opinion and the reasons why he is of that opinion;
(C) directing the relevant data user to take such steps as are specified in the enforcement notice to remedy the contravention or, as the case may be, the matters occasioning it within such period as is specified in the enforcement notice; and
(D) directing, where necess
109 PART VIII INSPECTION, COMPLAINT AND INVESTIGATION-109. Variation or cancellation of enforcement notice.
The Commissioner may, on his own initiative or on the application of a relevant data user, vary or cancel the enforcement notice served under subsection 108(1) by notice in writing to the relevant data user if the Commissioner is satisfied with the action taken by the relevant data user to remedy the contravention.
110 PART IX ENFORCEMENT-110. Authorized officers.
The Commissioner may in writing authorize any officer appointed under sections 50 and 51 or any public officer to exercise the powers of enforcement under this Act.
111 PART IX ENFORCEMENT-111. Authority card.
(1) The Commissioner shall issue to each authorized officer an authority card which shall be signed by the Commissioner.
(2) Whenever the authorized officer exercises any of the powers of enforcement under this Act, he shall produce on demand to the person against whom the power is being exercised the authority card issued to him under subsection (1).
112 PART IX ENFORCEMENT-112. Power of investigation.
(1) An authorized officer may investigate the commission of any offence under this Act.
(2) For the avoidance of doubt, it is declared that for the purposes of this Act, the authorized officer shall have all or any of the special powers of a police officer of whatever rank in relation to police investigations in seizable cases as provided for under the Criminal Procedure Code [Act 593] , and such powers shall be in addition to the powers provided for under this Act and not in derogation thereof.
113 PART IX ENFORCEMENT-113. Search and seizure with warrant.
(1) If it appears to a Magistrate, upon written information on oath from the authorized officer and after such inquiry as the Magistrate considers necessary, that there is reasonable cause to believe that:-
(a) any premises has been used for; or
(b) there is in any premises evidence necessary to the conduct of an investigation into,
the commission of an offence under this Act, the Magistrate may issue a warrant authorizing the authorized officer named in the warrant at any reasonable time by day or night and with or without assistance, to enter the premises and if need be by force.
(2) Without affecting the generality of subsection (1), the warrant issued by the Magistrate may authorize the search and seizure of:-
(a) any computer, book, account, computerized data or other document which contains or is reasonably suspected to contain information as to any offence suspected
114 PART IX ENFORCEMENT-114. Search and seizure without warrant.
If an authorized officer is satisfied upon information received that he has reasonable cause to believe that by reason of delay in obtaining a search warrant under section 113 the investigation would be adversely affected or evidence of the commission of an offence is likely to be tampered with, removed, damaged or destroyed, the authorized officer may enter the premises and exercise in, upon and in respect of the premises all the powers referred to in section 113 in as full and ample a manner as if he were authorized to do so by a warrant issued under that section.
115 PART IX ENFORCEMENT-115. Access to computerized data.
(1) An authorized officer conducting a search under sections 113 and 114 shall be given access to computerized data whether stored in a computer or otherwise.
(2) For the purposes of this section, "access":-
(a) includes being provided with the necessary password, encryption code, decryption code, software or hardware and any other means required to enable comprehension of computerized data; and
(b) has the meaning assigned to it by subsections 2(2) and
(5) of the Computer Crimes Act 1997 [Act 563] .
116 PART IX ENFORCEMENT-116. Warrant admissible notwithstanding defects.
A search warrant issued under this Act shall be valid and enforceable notwithstanding any defect, mistake or omission therein or in the application for such warrant, and any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized under such warrant shall be admissible in evidence in any proceedings under this Act.
117 PART IX ENFORCEMENT-117. List of computer, book, account, etc, seized.
(1) Except as provided in subsection (2), where any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article is seized pursuant to this Act, the authorized officer making the seizure:-
(a) shall prepare:-
(i) a list of the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized and shall sign the list; and
(ii) a written notice of the seizure containing the grounds for the seizure and shall sign the notice; and
(b) shall as soon as practicable serve a copy of the list of the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized and the written notice of the seizure to the occupier of the premises wh
118 PART IX ENFORCEMENT-118. Release of computer, book, account, etc, seized.
(1) If any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article has been seized under this Act, the authorized officer who effected the seizure may, after referring to the Public Prosecutor, release the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article to the person as he determines to be lawfully entitled to it, if the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article is not liable to forfeiture under this Act, and is not otherwise required for the purpose of any proceedings under this Act or for the purpose of any prosecution under any other written law, and in such event neither the authorized officer effecting the seizure, nor the Federal Government, Commissioner or
119 PART IX ENFORCEMENT-119. No cost or damages arising from seizure to be recoverable.
No person shall, in any proceedings before any court in respect of any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized in the exercise or the purported exercise of any power conferred under this Act, be entitled to the costs of such proceedings or to any damages or other relief unless such seizure was made without reasonable cause.
120 PART IX ENFORCEMENT-120. Obstruction to search.
Any person who:-
(a) refuses any authorized officer access to any premise which the authorized officer is entitled to have under this Act or in the execution of any duty imposed or power conferred by this Act;
(b) assaults, obstructs, hinders or delays any authorized officer in effecting any entry which the authorized officer is entitled to effect under this Act, or in the execution of any duty imposed or power conferred by this Act; or
(c) refuses any authorized officer any information relating to an offence or suspected offence under this Act or any other information which may reasonably be required of him and which he has in his knowledge or power to give,
commits an offence and shall, on conviction, be liable to imprisonment for a term not exceeding two years or to a fine not exceeding ten thousand ringgit or to both.
121 PART IX ENFORCEMENT-121. Power to require production of computer, book, account, etc.
An authorized officer shall, for the purposes of the execution of this Act, have the power to do all or any of the following:
(a) to require the production of any computer, book, account, computerized data or other document kept by the data user or any other person and to inspect, examine and to download from them, make copies of them or take extracts from them;
(b) to require the production of any identification document from any person in relation to any act or offence under this Act;
(c) to make such enquiries as may be necessary to ascertain whether the provisions of this Act have been complied with.
122 PART IX ENFORCEMENT-122. Power to require attendance of persons acquainted with case.
(1) An authorized officer making an investigation under this Act may by order in writing require the attendance before himself of any person who appears to the authorized officer to be acquainted with the facts and circumstances of the case, and such person shall attend as so required.
(2) If any person refuses or fails to attend as so required, the authorized officer may report such refusal or failure to a Magistrate who shall issue a summons to secure the attendance of such person as may be required by the order made under subsection (1).
123 PART IX ENFORCEMENT-123. Examination of persons acquainted with case.
(1) An authorized officer making an investigation under this Act may examine orally any person supposed to be acquainted with the facts and circumstances of the case and shall reduce into writing any statement made by the person so examined.
(2) Such person shall be bound to answer all questions relating to the case put to him by the authorized officer:
Provided that such person may refuse to answer any question the answer to which would have a tendency to expose him to a criminal charge or penalty or forfeiture.
(3) A person making a statement under this section shall be legally bound to state the truth, whether or not such statement is made wholly or partly in answer to questions.
(4) The authorized officer examining a person under subsection (1) shall first inform that person of the provisions of subsections (2) and (3).
(5) A statement made by any person under this section shall, wh
124 PART IX ENFORCEMENT-124. Admission of statements in evidence.
(1) Except as provided in this section, no statement made by any person to an authorized officer in the course of an investigation made under this Act shall be used in evidence.
(2) When any witness is called for the prosecution or for the defence, other than the accused, the court shall, on the request of the accused or the prosecutor, refer to any statement made by that witness to the authorized officer in the course of the investigation under this Act and may then, if the courts thinks fit in the interest of justice, direct the accused to be furnished with a copy of it and the statement may be used to impeach the credit of the witness in the manner provided by the Evidence Act 1950 [Act 56] .
(3) Where the accused had made a statement during the course of an investigation, such statement may be admitted in evidence in support of his defence during the course of the trial.
(4) Nothing in this section shall be deemed to
125 PART IX ENFORCEMENT-125. Forfeiture of computer, book, account, etc, seized.
(1) Any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized shall be liable to forfeiture.
(2) An order for the forfeiture of the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized and liable to forfeiture under this Act shall be made by the court before which the prosecution with regard thereto has been held if it is proved to the satisfaction of the court that an offence under this Act has been committed and that the computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article seized was the subject matter of or was used in the commission of the offence, notwithstanding that no person has been convicted of such offence.
(3) If there is no prosecutio
126 PART IX ENFORCEMENT-126. Joinder of offences.
Notwithstanding anything contained in section 164 of the Criminal Procedure Code, where a person is accused of more than one offence under this Act, he may be charged with and tried at one trial for any number of such offences committed within the space of any length of time.
127 PART IX ENFORCEMENT-127. Power of arrest.
(1) An authorized officer or police officer may arrest without warrant any person whom he reasonably believes has committed or is attempting to commit an offence under this Act.
(2) An authorized officer making an arrest under subsection (1) shall without unnecessary delay make over the person so arrested to the nearest police officer or, in the absence of a police officer, take such person to the nearest police station, and thereafter the person shall be dealt with as is provided for by the law relating to criminal procedure for the time being in force as if he had been arrested by a police officer.
128 PART X MISCELLANEOUS-128. Register.
(1) The Commissioner shall maintain in both physical and electronic forms a register as required under this Act.
(2) A person may on payment of the prescribed fee:-
(a) inspect the register; or
(b) make a copy of or take extracts from an entry in the register.
(3) Where a person requests that a copy of an entry in the register be provided in an electronic form, the Commissioner may provide the relevant information by way of electronic means.
129 PART X MISCELLANEOUS-129. Transfer of personal data to places outside Malaysia.
(1) A data user shall not transfer any personal data of a data subject to a place outside Malaysia unless to such place as specified by the Minister, upon the recommendation of the Commissioner, by notification published in the Gazette .
(2) For the purposes of subsection (1), the Minister may specify any place outside Malaysia if:-
(a) there is in that place in force any law which is substantially similar to this Act, or that serves the same purposes as this Act; or
(b) that place ensures an adequate level of protection in relation to the processing of personal data which is at least equivalent to the level of protection afforded by this Act.
(3) Notwithstanding subsection (1), a data user may transfer any personal data to a place outside Malaysia if:-
(a) the data subject has given his consent to the transfer;
(b) the transfer is necessary for the performa
130 PART X MISCELLANEOUS-130. Unlawful collecting, etc, of personal data.
(1) A person shall not knowingly or recklessly, without the consent of the data user:-
(a) collect or disclose personal data that is held by the data user; or
(b) procure the disclosure to another person of personal data that is held by the data user.
(2) Subsection (1) shall not apply to a person who shows:-
(a) that the collecting or disclosing of personal data or procuring the disclosure of personal data:-
(i) was necessary for the purpose of preventing or detecting a crime or for the purpose of investigations; or
(ii) was required or authorized by or under any law or by the order of a court;
(b) that he acted in the reasonable belief that he had in law the right to collect or disclose the personal data or to procure the disclosure of the personal data to the other person;
(c) that he acted in the reasonable belief that
131 PART X MISCELLANEOUS-131. Abetment and attempt punishable as offences.
(1) A person who abets the commission of or who attempts to commit any offence under this Act shall be guilty of that offence and shall, on conviction, be liable to the punishment provided for that offence.
(2) A person who does any act preparatory to or in furtherance of the commission of any offence under this Act shall be guilty of that offence and shall, on conviction, be liable to the punishment provided for the offence:-
Provided that any term of imprisonment imposed shall not exceed one-half of the maximum term provided for the offence.
132 PART X MISCELLANEOUS-132. Compounding of offences.
(1) The Commissioner may, with the consent in writing of the Public Prosecutor, compound any offence committed by any person under this Act and prescribed to be a compoundable offence by making a written offer to the person suspected to have committed the offence to compound the offence upon payment to the Commissioner of an amount of money not exceeding fifty per centum of the amount of maximum fine for that offence within such time as may be specified in his written offer.
(2) An offer under subsection (1) may be made at any time after the offence has been committed but before any prosecution for it has been instituted, and if the amount specified in the offer is not paid within the time specified in the offer or such extended time as the Commissioner may grant, prosecution for the offence may be instituted at any time after that against the person to whom the offer was made.
(3) Where an offence has been compounded under subsection (
133 PART X MISCELLANEOUS-133. Offences by body corporate.
(1) If a body corporate commits an offence under this Act, any person who at the time of the commission of the offence was a director, chief executive officer, chief operating officer, manager, secretary or other similar officer of the body corporate or was purporting to act in any such capacity or was in any manner or to any extent responsible for the management of any of the affairs of the body corporate or was assisting in such management:-
(a) may be charged severally or jointly in the same proceedings with the body corporate; and
(b) if the body corporate is found to have committed the offence, shall be deemed to have committed that offence unless, having regard to the nature of his functions in that capacity and to all circumstances, he proves:-
(i) that the offence was committed without his knowledge, consent or connivance; and
(ii) that he had taken all reasonable precautions and exercis
134 PART X MISCELLANEOUS-134. Prosecution.
No prosecution for an offence under this Act shall be instituted except by or with the written consent of the Public Prosecutor.
135 PART X MISCELLANEOUS-135. Jurisdiction to try offences.
Notwithstanding any other written law to the contrary, a Sessions Court shall have jurisdiction to try any offence under this Act and to impose full punishment for any such offence under this Act.
136 PART X MISCELLANEOUS-136. Service of notices or other documents.
(1) Service of a notice or any other document upon any person shall be effected:-
(a) by the delivering the notice or other document to the person;
(b) by leaving the notice or other document at the last-known address of residence or place of business of the person in a cover addressed to that person; or
(c) by forwarding the notice or other document by post in an A.R. registered letter addressed to the person at his last-known address of residence or place of business.
(2) Where the person to whom there has been addressed an A.R. registered letter containing any notice or other document which may be given under this Act is informed of the fact that there is an A.R. registered letter awaiting him at a post office, and such person refuses or neglects to take delivery of such A.R. registered letter, such notice or other document shall be deemed to have been served upon him on the date on which he
137 PART X MISCELLANEOUS-137. Public Authorities Protection Act 1948.
The Public Authorities Protection Act 1948 [Act 198] shall apply to any action, suit, prosecution or proceedings against the Commissioner, Deputy Commissioner, Assistant Commissioner, any officer or servant of the Commissioner, any member of the Advisory Committee, any member, officer or servant of the Appeal Tribunal, or any authorized officer in respect of any act, neglect or default done or omitted by him or it in such capacity.
138 PART X MISCELLANEOUS-138. Public servant.
The Commissioner, Deputy Commissioner, Assistant Commissioner, any officer or servant of the Commissioner, any member of the Advisory Committee, any member, officer or servant of the Appeal Tribunal, or any authorized officer while discharging his duty or performing his functions or exercising his powers under this Act in such capacity shall be deemed to be a public servant within the meaning of the Penal Code [Act 574] .
139 PART X MISCELLANEOUS-139. Protection against suit and legal proceedings.
No action, suit, prosecution or other proceedings shall lie or be brought, instituted or maintained in any court against:-
(a) the Commissioner, Deputy Commissioner, Assistant Commissioner or any officer or servant of the Commissioner;
(b) any member of the Advisory Committee;
(c) any member, officer or servant of the Appeal Tribunal; or
(d) any authorized officer,
in respect of any act or omission done or omitted by him or it in good faith in such capacity.
140 PART X MISCELLANEOUS-140. Protection of informers.
(1) Except as provided in subsections (2) and (3), no witness in any civil or criminal proceedings pursuant to this Act shall be obliged or permitted to disclose the name or address of any informer or the substance and nature of the information received from him or state any matter which might lead to his discovery.
(2) If any computer, book, account, computerized data or other document, signboard, card, letter, pamphlet, leaflet, notice, equipment, instrument or article which is in evidence or is liable to inspection in any civil or criminal proceedings whatsoever contains any entry in which any informer is named or described or which might lead to his discovery, the court shall cause all such entries to be concealed from view or to be obliterated in so far as may be necessary to protect the informer from discovery.
(3) If in a trial for any offence under this Act the court, after full inquiry into the case, is of the opinion that the
141 PART X MISCELLANEOUS-141. Obligation of secrecy.
(1) Except for any of the purposes of this Act or for the purposes of any civil or criminal proceedings under any written law or where otherwise authorized by the Minister:-
(a) the Commissioner, Deputy Commissioner, Assistant Commissioner, any officer or servant of the Commissioner, any member of the Advisory Committee, any member, officer or servant of the Appeal Tribunal, any authorized officer or any person attending any meeting or deliberation of the Advisory Committee, whether during or after his tenure of office or employment, shall not disclose any information obtained by him in the course of his duties; and
(b) no other person who has by any means access to any information or documents relating to the affairs of the Commissioner shall disclose such information or document.
(2) A person who contravenes subsection (1) commits an offence and shall, on conviction, be liable to a fine not exceeding
142 PART X MISCELLANEOUS-142. Things done in anticipation of the enactment of this Act.
All acts and things done by any person in preparation for or in anticipation of the enactment of this Act and any expenditure incurred in relation thereto shall be deemed to have been authorized under this Act, provided that the acts and things done are consistent with the general intention and purposes of this Act; and all rights and obligations acquired or incurred as a result of the doing of those acts or things including any expenditure incurred in relation thereto, shall on the coming into operation of this Act be deemed to be the rights and obligations of the Commissioner.
143 PART X MISCELLANEOUS-143. Power to make regulations.
(1) The Minister may make such regulations as may be necessary or expedient for the purpose of carrying into effect the provisions of this Act.
(2) Without prejudice to the generality of the powers conferred by subsection (1), the Minister may make regulations for all or any of the following purposes:
(a) to regulate all matters relating to the registration of data users under this Act, including to prescribe the registration fees and renewal fees;
(b) to regulate all matters necessary for the implementation of the Personal Data Protection Principles;
(c) to regulate procedures in respect of the inspection of personal data systems, investigation of complaints and issuance of enforcement notices, and all other matters related to it;
(d) to prescribe the offences which may be compounded and the forms to be used and the method and procedure for compounding the offences;
(e) to provide and prescr
144 PART X MISCELLANEOUS-144. Prevention of anomalies.
(1) The Minister may, by order published in the Gazette , make such modifications to the provisions of this Act as may appear to him to be necessary or expedient for the purpose of removing any difficulties or preventing anomalies in consequence of the coming into operation of this Act.
(2) The Minister shall not exercise the powers conferred by subsection (1) after the expiration of one year from the appointed date.
(3) In this section, "modifications" means amendments, additions, deletions and substitutions of any provisions of this Act.
145 PART XI SAVINGS AND TRANSITIONAL PROVISIONS-145. Personal data processed before the date of coming into operation of this Act.
Where a data user has collected personal data from the data subject or any third party before the date of coming into operation of this Act, he shall comply with the provisions of this Act within three months from the date of coming into operation of this Act.
146 PART XI SAVINGS AND TRANSITIONAL PROVISIONS-146. Registration of persons who process personal data before the date of coming into operation of this Act.
(1) Subject to subsection (2), any person who at the date of coming into operation of this Act either alone or jointly or in common with other persons processes any personal data or has control over or authorizes the processing of any personal data, shall within three months from the date of coming into operation of this Act be registered as a data user in accordance with the provisions of this Act.
(2) Subsection (1) shall not apply to a data user who does not belong to the class of data users who shall be required to be registered as data users in pursuance of the provisions of Division 2 of Part II.
Elevate your legal practice with advanced AI-driven research and drafting solutions. Experience unmatched efficiency, precision, and security, tailored exclusively for legal professionals.
An indispensable Tool for Legal Professionals, Endorsed by Various High Court and Judicial Officers
Please visit our Training & Support
Center or Contact Us for assistance
Scan Me!
India’s Legal research and Law Firm App, Download now!
For Daily Legal Updates, Join us on :
Back to top
AI Assistant
