Malaysia opens public consultation on AI data protection rules

Malaysia is considering how its existing personal data protection rules should apply when organisations develop and use artificial intelligence systems.

The Personal Data Protection Department opened a public consultation on 5 October 2026 on a draft Artificial Intelligence and Personal Data Protection Framework. The consultation is open until 23 October.

The proposed framework follows personal data through the different stages of an AI system. This includes collecting and preparing data for training, testing systems, deploying them, monitoring their operation and eventually retiring them. It would apply both to systems developed by organisations themselves and to AI obtained from external providers.

The draft also addresses issues that arise beyond the development of an AI system. These include international transfers of personal data, individuals’ data protection rights, security measures, organisational oversight and audits.

Responsibility would remain with organisations processing personal data even when they use AI supplied by another company. In practice, outsourcing the development or provision of an AI system would not remove an organisation’s obligations under Malaysia’s Personal Data Protection Act 2010.

The consultation is also intended to test whether the proposed approach can be implemented in practice. The department is seeking views on the clarity and proportionality of the measures, implementation difficulties, whether additional guidance is needed and whether organisations would require transition periods.

Why does it matter?

The draft would provide a framework for applying Malaysia’s existing data protection requirements to AI rather than treating AI processing as separate from established personal data rules. Its consultation could therefore help determine how organisations are expected to manage personal data at different stages of AI development and use, including when systems are procured from external providers.