What happened
On 5 October 2026, Malaysia's Personal Data Protection Department (JPDP, Jabatan Perlindungan Data Peribadi) released Public Consultation Paper No. 1/2026 containing the Version 1.0 draft of an AI and Personal Data Protection Framework under section 48(g) of the Personal Data Protection Act 2010 (Act 709). The 43-section, 10-part (Parts A-J) draft is a 'primary reference document' for data controllers covering the full AI lifecycle: legal basis/notice/consent, development and testing (data protection by design), deployment/use/monitoring/retraining/decommissioning, procurement of external AI systems and cross-border transfers, data-subject rights, fairness/security/breaches/accuracy, governance/risk/transparency, and documentation/audit. Scope explicitly includes in-house AI, procured/off-the-shelf/open-source AI, and AI embedded in SaaS/cloud/API platforms, plus general-purpose AI models processing personal data. JPDP benchmarked the draft against the EU AI legislation, OECD AI principles, and HK/PH/SG/UK DPA guidance. Written submissions are accepted until 23 October 2026 via the Unified Public Consultation Platform or official Google form; final text, issue date and transition period not yet set.
Why it matters
This is the first comprehensive national AI-data-protection framework from Malaysia's data regulator, adding to the growing ASEAN/APAC wave of AI security and privacy governance (alongside Singapore PDPC, HK PCPD, KISA v2.0). Because it covers procured/vendor AI systems and general-purpose models embedded in SaaS/API platforms, it reaches essentially every organisation processing personal data in Malaysia through AI — imposing lifecycle-wide obligations: DPbD, purpose-limitation for training data, AI-disclosure in privacy notices, testing/validation before deployment, monitoring of AI systems, procurement controls for external AI, and documentation/audit for demonstrating compliance. For multinationals operating in Malaysia it signals near-term compliance expectations to design in now.
Action needed
Data controllers/processors operating in Malaysia should review the draft's 10-part framework against their AI inventory, and submit comments to JPDP before the 23 October 2026 deadline (via the Unified Public Consultation Platform or official Google form). Organisations should begin mapping existing AI data flows, procurements and model documentation against Part D-I obligations so they are positioned for the final guideline regardless of how consultation feedback shapes it.