By KYN AI Advisory Team — AI implementation specialists, Singapore
If an AI agent in your Malaysian business reads, writes or sends personal data for commercial purposes, the Personal Data Protection Act 2010 (PDPA) applies to it exactly as it applies to a person doing the same job. The agent is not a legal party. Your company is the data user, and the amended Act now carries a maximum fine of RM1,000,000 for breaching the Security Principle, mandatory breach reporting and a requirement to appoint a data protection officer. This checklist turns those duties into ten checks you can run against any agent before it goes live.
Does the PDPA apply to an AI agent?
Yes, when the agent handles personal data in connection with commercial transactions. That is the Act's test, as the Personal Data Protection Commissioner's office describes it.
Three facts follow.
- You are the data user. The vendor that supplies the model or the platform is a processor. You remain responsible for what the agent does with customer data.
- The agent's access is your access. If the agent can read the full customer table, you have given that access to a piece of software. Treat the permission as you would for a new hire.
- The framework is moving. The Commissioner opened public consultation paper 1/2026 on an AI and personal data protection framework on 29 October 2026. We have not found a published outcome. Read the paper before you finalise your design, and expect guidance specific to AI.
This article is an engineering checklist, not legal advice. Have a Malaysian lawyer confirm the points that depend on your sector.
The 10-point checklist
Check 1: Map what personal data the agent touches
List every field the agent can read or write: name, mobile number, email, address, identity number, payment details, notes. For each field, record the source, the purpose and where the agent stores it.
An agent that drafts a quotation needs the company name and a contact. It rarely needs an identity number. Remove fields it does not need. Fewer fields means a smaller breach and a smaller notice.
Check 2: Give notice before you collect
The Act requires a written notice, in Bahasa Malaysia and English, telling a person what you collect, why, who receives it and how to contact you. If an agent collects data through WhatsApp, a web form or email, the notice must appear before or at the point of collection.
Put the link to the notice in the first automated message. Do not rely on a footer that nobody opens.
Check 3: Record consent and purpose
Consent must be recorded, and the agent may use the data only for the purposes you notified. A lead who gave a number to receive a quotation has not agreed to a marketing campaign.
Store the purpose with the contact record. Make the agent check the purpose field before it sends anything. A rule such as "marketing messages only if purpose includes marketing" is enforceable. A policy document is not.
Check 4: Restrict access by role, not by convenience
Give each agent its own account with the minimum permissions for its job. A reply-sorting agent reads inbound messages and writes labels. It does not export the contact list.
In our builds, row-level security in the database enforces this, so the restriction holds even if the agent's instructions are wrong or manipulated. See prompt injection in business AI agents for why that matters.
Check 5: Secure the data in transit and at rest
The Security Principle is where the higher penalty applies. Check these items:
- encryption at rest in the database and file storage;
- encryption in transit on every connection;
- named accounts through the cloud provider's identity service, with no shared logins;
- keys and tokens held in a secrets manager, not in prompts or code;
- no personal data in application logs beyond what an investigation needs.
Check 6: Know where the data goes when you call a model
Every prompt that contains personal data leaves your system for the model provider. Check four things: where the provider processes the request, whether it retains prompts, whether it trains on them, and what the contract says.
Reduce exposure by sending only the fields the task needs. A model that classifies a reply as "interested" or "not now" does not need the sender's address.
Check 7: Set retention and deletion rules
The Retention Principle means you do not keep data longer than the purpose requires. Define a period for each data class: leads that never replied, closed customers, rejected job applicants.
Build deletion as a task the system runs, and have it wait for a named person to approve. Deletions are irreversible, so they are never an unattended action in our designs.
Check 8: Log every action with the actor
When a customer asks what you hold about them, or the Commissioner asks what happened, you need a record. Log which agent or person read, changed or sent what, and when. An audit trail also supports the access and correction rights, because you can show what the agent did with a record.
Check 9: Prepare a breach procedure that includes the agent
The amended Act introduces mandatory breach notification. The details, including the threshold and the time limit, are set in the Commissioner's data breach notification guidelines. Read the current guideline on the Commissioner's site and write the procedure from it.
The procedure must answer four questions for the agent:
- How do we stop it? A single switch that revokes the agent's account.
- How do we know what it touched? The action log.
- Who decides whether a notice is needed? A named person.
- Who writes to affected customers? A named person, not the agent.
Check 10: Appoint a data protection officer and own the register
The amendments require data users and processors to appoint a data protection officer, per Rajah & Tann's analysis. Give that person the data map from step 1, the agent register (what each agent does and which data it can read) and authority to pause an agent.
How should the checklist change by agent type?
| Agent | Main personal-data risk | Strongest control | |---|---|---| | Sales outreach | Messaging without a valid purpose | Purpose check before every send; named approval for first contact | | Reply sorting | Reading sensitive free text | Minimal fields to the model; labels only written back | | Finance and payroll | Identity numbers, salary, bank details | Separate restricted account; no export permission | | Customer service | Free-text disclosure of health or financial data | Redaction before the model; handover rules for sensitive topics | | Reporting | Aggregates that reveal individuals | Small-group suppression; named recipients only |
Where KYN fits
KYN builds agents inside your own cloud account, so personal data stays in a system you own and can inspect. Each agent has its own restricted account, the database uses row-level security, and every action is logged with the actor. Outbound messages, money, filings and deletions wait for a named person. See security and sales systems.
The first 14 days are a review of your stack and interviews with your team, which is when we build the data map from step 1. A full build ships in under 90 days. Rights in the custom code and configuration pass to you on full payment.
Frequently asked questions
Does the PDPA apply if the AI model runs outside Malaysia?
The Act applies to a data user that processes personal data in Malaysia or uses equipment there, and your obligations follow the data, not the server. Check the cross-border transfer rules in the current Act and the Commissioner's guidance before you send personal data to a model hosted abroad.
Do I need a data protection officer for a small business?
The amendments require data users and processors to appoint one, as summarised by Rajah & Tann. The thresholds and the registration process are set by the Commissioner, so confirm whether your business falls within them.
Can an agent send marketing messages to my customer list?
Only if the purpose recorded for each contact includes marketing and the person has not withdrawn consent. Make the agent check that field before every send, and keep first-contact messages behind named approval.
Checked 30 October 2026.
Curious whether Marketing agents fits your business? Talk to KYN on WhatsApp — no forms, just a conversation.
