Website Guide
Website Privacy & PDPA Malaysia: What Should a Business Website Include?
Modern business websites can collect more personal data than the website owner may realise.
A contact form may ask for a name, email address and phone number.
A booking form may collect dates, addresses or additional personal information.
An online store may process customer information, delivery details and transaction-related data.
A website may also use:
- analytics;
- cookies;
- advertising pixels;
- live chat;
- WhatsApp;
- CRM systems;
- newsletter platforms;
- payment gateways;
- booking systems;
- cloud hosting;
- or other third-party integrations.
Once personal data is involved, the website is no longer only a design, functionality or SEO issue.
You also need to understand:
What data is being collected, why it is needed, who receives it, where it is stored, how long it is retained and how individuals can contact the organisation about their personal data.
In Malaysia, these questions are relevant to the Personal Data Protection Act 2010, or PDPA, including changes introduced through the Personal Data Protection (Amendment) Act 2024.
This Website Privacy & PDPA Malaysia guide explains these issues from a practical website perspective — privacy notices, forms, cookies, analytics, marketing consent, third-party services, data security, retention, data breaches and website development.
Important: This article is a practical website and technical implementation guide for business owners. It is not legal advice, a formal PDPA audit or a substitute for advice from a qualified legal, compliance or data-protection professional where your organisation requires a specific interpretation.
Quick Answer: What Should a Malaysian Business Website Review?
If your website collects personal data, review at least the following:
- What personal data the website collects.
- Why each type of data is required.
- Your Personal Data Protection Notice or Privacy Notice.
- Bahasa Malaysia and English versions where required under the Notice and Choice Principle.
- Contact and enquiry forms.
- Marketing consent.
- Cookies and tracking technologies.
- Analytics.
- Advertising pixels.
- Third-party integrations.
- Hosting and cloud services.
- Data processors.
- Cross-border transfers where applicable.
- Security and access control.
- Data retention.
- Access and correction requests.
- Data portability where applicable.
- DPO requirements if the organisation meets the relevant conditions.
- A data-breach response process.
A website should not simply use a generic Privacy Policy copied from another business.
The notice should reflect how your organisation actually processes personal data.
What Is the Malaysia PDPA?
PDPA stands for the Personal Data Protection Act 2010 [Act 709].
At a high level, the Act regulates the processing of personal data in commercial transactions.
For the official source, refer to the Personal Data Protection Act 2010 on the Personal Data Protection Commissioner's website.
This means the PDPA is not relevant only to:
- banks;
- large companies;
- e-commerce marketplaces;
- or technology organisations.
A small-business website may also process personal data when customers submit an enquiry, make a booking, buy something or interact with connected digital systems.
What Changed Under the Personal Data Protection (Amendment) Act 2024?
Malaysia updated the PDPA through the Personal Data Protection (Amendment) Act 2024.
Important changes relevant to business owners include:
- The term data user was generally replaced with data controller.
- Data processors have direct obligations relating to the Security Principle.
- Biometric data was included within sensitive personal data.
- A Data Protection Officer or DPO framework was introduced.
- Data-breach notification requirements were introduced.
- A right to data portability was added.
- The framework for cross-border personal-data transfers was also changed.
You can refer to the Personal Data Protection (Amendment) Act 2024 for the official source.
For website owners, the practical takeaway is:
Privacy should not be reviewed only after the website is finished.
It should be considered while planning forms, integrations, analytics, hosting, access and the customer journey.
The 7 Personal Data Protection Principles
The Personal Data Protection Commissioner explains seven main principles:
- General Principle.
- Notice and Choice Principle.
- Disclosure Principle.
- Security Principle.
- Retention Principle.
- Data Integrity Principle.
- Access Principle.
For a business website, these principles provide a more useful framework than simply asking:
“Do we have a Privacy Policy page?”
You also need to consider how the data is collected, used, disclosed, protected, retained and eventually disposed of.
What Is Personal Data?
Personal data is information that relates directly or indirectly to an identified or identifiable individual based on that data or other available information.
In a website context, personal data may include:
- Name.
- Email address.
- Phone number.
- Address.
- Identification information where genuinely required.
- Application information.
- Account information.
- Transaction-related information.
- IP addresses or technical information in certain circumstances.
- Other information that can be associated with an identifiable individual.
Do not think only about identity-card numbers or banking information.
A simple contact form can also process personal data.
What Is Sensitive Personal Data?
Sensitive personal data requires additional care.
Under the PDPA, the category includes certain information relating to:
- physical or mental health or condition;
- political opinions;
- religious beliefs or beliefs of a similar nature;
- the commission or alleged commission of an offence;
- and biometric data following the 2024 amendments.
If your website is for a:
- clinic;
- health platform;
- insurance-related service;
- employee portal;
- identity-verification system;
- or platform processing biometric information;
do not rely on a generic public contact form without first understanding the security, operational and compliance requirements.
Which Websites Commonly Collect Personal Data?
Many business websites collect personal data through several different channels.
Contact form
A contact form may collect:
- name;
- email;
- phone;
- company;
- message.
Quotation form
A quotation form may collect:
- company details;
- project requirements;
- budget information;
- contact details.
Booking or appointment form
This may include:
- name;
- phone;
- email;
- date;
- service selection;
- special requirements.
E-commerce checkout
This may process:
- customer name;
- delivery address;
- billing information;
- phone number;
- purchase history.
Newsletter
A newsletter normally uses:
- email address;
- name where requested;
- marketing preferences.
Job application
This may involve:
- CV;
- employment history;
- education information;
- phone;
- email;
- other applicant information.
This is why a privacy review should begin with a data inventory, not by copying a Privacy Policy template.
Privacy Policy or Privacy Notice?
The term Privacy Policy is commonly used on websites because users recognise it easily.
However, the important terminology under the PDPA is the Personal Data Protection Notice or privacy notice.
Section 7 of the PDPA relates to the Notice and Choice Principle.
Do not focus too heavily on what the page is called.
Focus on whether the notice actually provides the information that the data subject needs.
What Should a Privacy Notice Cover Under Section 7?
In practical terms, the privacy notice should address matters such as:
- That an individual's personal data is being or will be processed.
- A description of the personal data involved.
- The purposes for which the data is collected and processed.
- The source of the personal data where relevant.
- The right to request access to personal data.
- The right to request correction.
- How to contact the organisation with enquiries or complaints.
- The classes of third parties to whom data may be disclosed.
- Choices available to limit processing where applicable.
- Whether the requested information is compulsory or voluntary.
- The consequences of not providing compulsory information.
Do not treat this list as a substitute for legal review where your business has complex processing activities.
For official guidance, refer to the Guidance on the Preparation of Personal Data Protection Notices.
The Privacy Notice Should Be Available in Bahasa Malaysia and English
An important consideration for Malaysian websites is language.
Section 7 requires the notice to be provided in the national language and English.
This means an organisation using only an English Privacy Policy should review whether the notice meets the applicable requirement.
Likewise:
Using automatic translation alone may not be the best way to produce accurate privacy or legal wording.
The Bahasa Malaysia and English versions should communicate the same meaning clearly.
Where Should the Privacy Notice Be Placed?
The privacy notice should be easy to find.
Common website implementations include:
- A dedicated Privacy or Personal Data Protection page.
- A link in the footer.
- A link close to contact or registration forms.
- Contextual notices where sensitive or additional data is collected.
- A link within checkout, booking or application journeys where appropriate.
Do not hide the privacy notice inside a very long Terms & Conditions page without a clear heading or link.
Should a Privacy Notice Be Available Before the Form Is Submitted?
A practical approach is to give the user access to the privacy notice before they submit personal data.
For example, a contact form may include short wording explaining the purpose together with a link:
“The information you provide will be used to respond to your enquiry. Please see our Privacy Notice.”
The actual wording must reflect how the organisation really uses the information.
Do not use that sentence if enquiry information is also added to marketing automation, CRM campaigns or other processes that are not explained.
Does a Contact Form Need a Consent Checkbox?
There is no single generic answer that applies to every form.
The PDPA contains the General Principle and circumstances in which processing may be permitted under the Act.
You should not simply add one checkbox saying:
“I consent to everything.”
and assume that every data-processing issue has been solved.
The form should be designed around:
- what data is collected;
- the purpose;
- what information is compulsory;
- marketing and non-marketing uses;
- third parties;
- the type of transaction;
- and the applicable basis for processing.
If explicit consent is genuinely required, the mechanism should be clear and capable of being recorded appropriately.
Separate Service Enquiries from Marketing Consent
A person asking for a quotation does not necessarily mean they want to receive marketing newsletters indefinitely.
For example, the primary purpose of the contact form may be:
“Use this information to respond to my quotation request.”
If the business also wants to add that person to a marketing list, consider a separate and appropriate choice.
This also makes customer expectations clearer.
Avoid Pre-Ticked Marketing Choices Without Considering Genuine Choice
If the website provides an optional marketing choice, users should understand what they are selecting.
Good form design normally distinguishes between:
- information genuinely required to fulfil the request;
- optional information;
- optional marketing preferences.
A clear choice is better than hiding marketing permission inside a long paragraph.
What About a WhatsApp Button?
WhatsApp is a common enquiry channel for Malaysian businesses.
When a user leaves the website and communicates through WhatsApp, personal-data processing does not necessarily stop.
The business may still receive:
- name;
- phone number;
- conversation content;
- project details;
- images;
- documents;
- other information.
The organisation's privacy notice should reflect the customer communication channels that are actually part of its business workflow where relevant.
Do not assume the Privacy Notice applies only to website forms.
Live Chat and Chatbots Should Also Be Included in the Data Review
Chat tools may send information to a third-party provider.
Review:
- what information the chat tool collects;
- whether conversations are stored;
- how long they are retained;
- who can access them;
- where the provider processes the information;
- whether data may be used for training or other purposes under the provider's configuration;
- whether the organisation's privacy notice should explain this use.
Do not install a chatbot purely because it is convenient without understanding the underlying data flow.
Cookies: Does Every Malaysian Website Need a Cookie Banner?
This question needs a careful answer.
Do not assume every Malaysian website must copy an EU-style cookie banner with exactly the same wording or controls.
Cookie and tracking requirements can depend on:
- the type of technology;
- the data collected;
- the purpose;
- third parties;
- relevant consent requirements;
- jurisdictions applicable to the organisation or users.
However, website owners should still know which cookies or similar technologies are being used.
Audit:
- essential or session cookies;
- analytics cookies;
- advertising cookies;
- embedded-video cookies;
- chat widgets;
- booking widgets;
- social-media integrations.
The privacy notice should accurately reflect how the website actually behaves.
Google Analytics and Other Website Analytics Should Be Reviewed
Analytics helps website owners understand traffic and user behaviour.
However, the implementation should still be reviewed from a privacy perspective.
Check:
- which analytics platform is used;
- what information is transmitted;
- configuration settings;
- data-retention settings;
- user-identification features where used;
- third-party terms;
- cross-border implications where relevant.
Do not state in your Privacy Policy:
“We do not collect any visitor data.”
if the website actually uses analytics or tracking technologies that collect technical or usage information.
Advertising Pixels Should Be Part of the Tracking Inventory
Websites running digital advertising may use:
- conversion tracking;
- remarketing tags;
- advertising pixels;
- audience measurement;
- campaign analytics.
Before adding a tracking script, the business should understand:
- the vendor;
- the purpose;
- what data is transmitted;
- retention;
- consent requirements where applicable;
- whether the privacy notice needs to be updated.
Google Tag Manager Is Not a Privacy Policy
A tag-management tool helps manage scripts and tags.
It does not determine whether the underlying processing activity is appropriate or compliant.
You still need to understand what is actually being loaded through the container.
Review tags such as:
- analytics;
- advertising;
- heatmaps;
- chat;
- conversion tools;
- custom scripts.
Map Your Third-Party Services
Modern websites rarely operate completely independently.
Data may flow through:
- web hosting;
- cloud platforms;
- email services;
- SMTP providers;
- CRM systems;
- form services;
- analytics platforms;
- payment gateways;
- booking systems;
- newsletter services;
- customer-support platforms;
- CDNs;
- cloud storage.
For every relevant vendor, ask:
- What data is being sent?
- For what purpose?
- Who controls the processing?
- Where is the data processed?
- How long is it retained?
- Who can access it?
- What happens when the contract ends?
What Is a Data Controller and Data Processor?
In simplified terms:
A data controller generally determines the purposes and means of processing personal data.
A data processor processes personal data on behalf of the data controller.
Depending on the actual arrangement:
- The business owner may be the data controller.
- A cloud software provider may act as a processor for certain activities.
- An agency managing a database or system may have processor responsibilities depending on its actual role.
Do not determine the role only from a job title, vendor name or contract heading.
Look at who actually determines the purpose and how the processing occurs.
Why Are Data Processors More Important After the 2024 PDPA Amendments?
The Personal Data Protection (Amendment) Act 2024 introduced direct responsibilities for data processors in relation to the Security Principle.
This makes vendor review even more important.
If a vendor can access:
- customer databases;
- form submissions;
- website accounts;
- cloud storage;
- CRM records;
- other personal data;
do not evaluate that vendor only based on price and features.
Also consider security, access, contractual responsibilities and data-handling practices.
Cross-Border Data Transfers Need to Be Reviewed
A Malaysian website may use technology that stores or processes information outside Malaysia.
Examples include:
- international cloud hosting;
- global analytics platforms;
- email-marketing providers;
- CRM systems;
- software-as-a-service platforms;
- backup storage.
Do not assume that “the website is hosted in Malaysia” automatically means every copy of the data remains in Malaysia.
Map each relevant vendor and review the applicable cross-border requirements.
For current official guidance, refer to the Personal Data Protection Guidelines on Cross-Border Transfer of Personal Data.
Collect Only the Data You Actually Need
When creating a form, it is easy to add many fields because:
“We might need this later.”
However, every additional field increases the amount of personal data the organisation needs to manage and protect.
For a simple quotation request, do you genuinely need:
- NRIC?
- Date of birth?
- Home address?
- Passport information?
If those details are not necessary for the purpose of the enquiry, do not collect them simply because the form builder allows it.
Make It Clear Which Fields Are Mandatory and Which Are Optional
Form design should help users understand what is required.
For example:
- Name — required.
- Phone — required if the business genuinely needs to call or WhatsApp the user.
- Email — optional if it is not necessary.
- Project notes — optional.
The appropriate requirements depend on the business process.
Do not mark every field as compulsory without a reason.
Be Careful With File Uploads
File-upload forms can collect significantly more information than ordinary text fields.
Users may upload:
- CVs;
- identity documents;
- quotations;
- medical reports;
- invoices;
- business documents;
- photographs.
If file upload is genuinely required, consider:
- file-type restrictions;
- file-size limits;
- secure storage;
- malware scanning;
- access control;
- retention;
- deletion procedures.
Do not provide an unrestricted public upload function simply because it is easy to build.
Job Application Forms Need Separate Consideration
Recruitment information has a different context from customer enquiries.
A candidate may provide:
- full name;
- phone number;
- email;
- employment history;
- education;
- references;
- CV;
- other personal information.
The privacy notice should address relevant recruitment processing rather than discussing only customer marketing.
E-Commerce Websites Have More Complex Data Flows
An online store may involve:
- customer accounts;
- shopping carts;
- delivery information;
- payment gateways;
- order records;
- email notifications;
- marketing tools;
- customer support;
- fraud-prevention services.
Do not assume the web developer stores payment-card information simply because checkout happens through the website.
In many setups, payment details are handled by an external payment provider.
Document the actual data flow so the Privacy Notice does not contain an inaccurate statement.
Clinic and Health-Service Websites Need Additional Care
If a website form requests health information, it may involve sensitive personal data.
The website owner should assess:
- whether the information genuinely needs to be collected through a public form;
- security;
- access;
- storage;
- retention;
- processor and vendor arrangements;
- other relevant healthcare requirements.
Do not send sensitive health information to a generic inbox or spreadsheet without understanding the risks.
HTTPS Is Important — But It Is Not the Same as PDPA Compliance
HTTPS encrypts information in transit between the user's browser and the server.
It is a basic website-security requirement.
However, HTTPS does not determine:
- who has administrator access;
- how long the information is retained;
- whether the database is secure;
- whether the vendor arrangement is appropriate;
- whether the data is being used for the correct purpose;
- whether the Privacy Notice is accurate.
For a broader security review, see the Website Security Checklist Malaysia.
Use Appropriate Access Controls
Not every employee needs access to every piece of customer information.
Where the platform supports it, use role-based access.
For example:
- A content editor may not need access to the customer database.
- The marketing team may not need server-administrator access.
- An external designer may not need production customer records.
- Developer access can be granted only where required.
Reduce unnecessary access wherever practical.
Avoid Shared Administrator Accounts Where Possible
An account such as:
admin@company.com
shared by the owner, employees, developer and agency can make it harder to manage:
- access removal;
- activity tracing;
- password management;
- incident investigation.
Individual accounts are usually easier to manage where the platform supports them.
Do Not Copy Real Production Customer Data to Staging Without a Good Reason
A developer may create a staging environment to test website changes.
Check whether the staging environment contains:
- real customer names;
- email addresses;
- orders;
- form submissions;
- account information.
If real data is not required, use synthetic or appropriately sanitised test data.
Staging environments also need suitable access controls.
Retention: Do Not Keep Personal Data Forever
The Retention Principle means personal data should not be kept longer than necessary for the purpose for which it was processed.
Website owners should ask:
- How long are form submissions kept in the CMS?
- How long are enquiry emails kept?
- How long are CRM records retained?
- How long are abandoned applications stored?
- How long do backups contain older copies?
“Forever” should not be the default retention strategy.
Define retention according to relevant business and legal requirements.
Backups Can Also Contain Personal Data
Even after a record has been removed from the live database, a copy may still exist in a backup.
A backup strategy should consider:
- retention;
- access control;
- encryption where appropriate;
- restore procedures;
- disposal.
Website security and privacy should be planned together.
Data Integrity: Information Should Be Accurate and Up to Date
If an organisation uses personal information to make decisions or provide a service, there should be a process for correcting relevant information where required.
This may include:
- customer addresses;
- email addresses;
- phone numbers;
- account information.
Do not lock data inside a system that your own staff do not know how to update.
Data Subjects Need a Way to Ask About Their Information
The privacy notice should provide a clear contact route.
This may be:
- a dedicated email address;
- a privacy contact;
- DPO contact details where applicable;
- general company contact information.
The organisation should also have an internal process for identifying a request and sending it to the correct person.
Access and Correction Requests Are More Than a Footer Link
The privacy notice can tell users that they have certain rights.
However, the organisation also needs to know what to do when a real request is received.
For example:
- How will the requester's identity be verified?
- Who searches for the information?
- Which systems need to be checked?
- Who approves the response?
- How is a correction made?
A website page alone does not create the operational process.
Organisations Should Understand Data Portability
The Personal Data Protection (Amendment) Act 2024 introduced a right to data portability.
Subject to the applicable conditions, including technical feasibility and compatibility, a data subject may request that personal data be transmitted to another data controller.
For a simple brochure website, an automatic “Export My Data” feature may not necessarily be required.
However, organisations with:
- customer accounts;
- large databases;
- subscription services;
- platform users;
- complex digital products;
should understand how such a request would be handled.
Does Every Business Need to Appoint a DPO?
Do not assume every small-business website automatically needs a full-time DPO.
The current DPO framework specifies conditions that need to be assessed.
Official guidance requires a data controller or data processor to appoint one or more DPOs if its processing involves any of the relevant conditions, including:
- personal data exceeding 20,000 data subjects;
- sensitive personal data, including financial information, exceeding 10,000 data subjects;
- or activities requiring regular and systematic monitoring of personal data.
If your organisation is close to or meets any of these conditions, review the current official requirements and obtain suitable compliance advice.
Official reference: Data Protection Officer registration portal.
What Happens When a Personal Data Breach Occurs?
The Personal Data Protection (Amendment) Act 2024 introduced data-breach notification requirements.
The current official framework should be reviewed to determine whether a particular breach meets the notification criteria.
Where notification to the Commissioner is required, the current guideline sets out a notification timeframe of as soon as practicable and within the applicable period specified by the framework.
Where a breach causes or is likely to cause significant harm to data subjects, separate notification to affected individuals may also be required.
Refer to the Personal Data Protection Guidelines on Data Breach Notification.
For website owners, the important principle is:
Do not wait until an incident happens before deciding who needs to respond.
Prepare a Data-Breach Response Plan
A basic incident-response plan can answer questions such as:
- Who needs to be informed internally?
- Who can disable compromised access?
- Where are relevant logs stored?
- How will vendors be contacted?
- What personal data may be involved?
- How will the incident be documented?
- Who determines whether a notification obligation applies?
A website developer may help investigate the technical incident, while legal or compliance input may be needed for formal notification decisions.
Data Protection by Design: Plan Privacy From the Beginning
The Personal Data Protection Commissioner also publishes a Data Protection By Design Guideline.
For website projects, this concept is very practical.
Before development begins, ask:
- What personal data do we genuinely need?
- Can we reduce the number of form fields?
- Who needs access?
- Where will the information be stored?
- How long does it need to be retained?
- Which third-party services will be used?
- Does the website process sensitive personal data?
- Does the user need to be given a choice?
- Which security controls are appropriate?
It is easier to design a sensible process from the beginning than to repair the data flow after a database is already filled with customer information.
Privacy Requirements Should Be Included in the Website Brief
When asking a web designer to build a website, do not provide only:
- logo;
- company profile;
- services;
- brand colours;
- images.
Also provide information such as:
- which forms are needed;
- what data will be collected;
- who should receive submissions;
- whether a CRM is used;
- whether a newsletter platform is used;
- which analytics platform is required;
- which advertising pixels are needed;
- which booking systems are involved;
- which payment provider is used;
- specific privacy requirements.
Use the Website Brief Malaysia guide as a starting point when organising requirements before development.
Privacy Notice, Terms & Conditions and Cookie Notice Are Not the Same Thing
| Document / Notice | General Purpose |
|---|---|
| Privacy / Personal Data Protection Notice | Explains how personal data is collected and processed |
| Terms & Conditions | Sets terms relating to website use, transactions or service relationships |
| Cookie Notice / Controls | Explains cookies or tracking and provides controls where applicable |
| Disclaimer | Explains particular limitations or context depending on the business |
Do not copy one document and assume it replaces all the others.
What Is a Practical Structure for a Website Privacy Notice?
The exact wording needs to reflect the organisation, but the structure may consider:
- Introduction and identity of the organisation.
- Types of personal data collected.
- Sources of personal data.
- Purposes of processing.
- Disclosure and classes of third parties.
- Cookies and online technologies where relevant.
- Cross-border processing where relevant.
- Security.
- Retention.
- Data-subject rights.
- Compulsory and optional information.
- Contact details.
- Effective date or last-reviewed date.
Do not automatically treat this structure as approved legal wording.
It is website information architecture, not a substitute for legal review.
Do Not Copy a Privacy Policy From Another Website
This is one of the most common mistakes.
Another website's Privacy Policy may mention:
- software you do not use;
- countries that are not relevant to you;
- vendors you do not have;
- processing purposes you do not perform;
- the wrong legal framework;
- another company's contact details.
Worse, your website may perform activities that are not described anywhere in the copied policy.
The Privacy Notice should reflect your actual data-processing activities.
Do Not Say “We Never Share Data With Third Parties” If Third Parties Process It
Modern websites often depend on external systems.
If form submissions are sent to:
- an email provider;
- a CRM;
- a cloud database;
- a booking platform;
- a payment gateway;
- a newsletter system;
a statement claiming that data is “never shared with any third party” may not accurately describe what is happening.
Map the actual data flow before making that claim.
Do Not Claim the Website Is “100% Secure”
No website can reasonably be guaranteed to be immune from every possible security incident.
Use factual wording about controls that are actually in place.
Examples may include:
- HTTPS.
- Access controls.
- MFA where used.
- Encrypted storage where genuinely implemented.
- Backups.
- Monitoring.
Do not invent security controls in the Privacy Notice simply to make the document sound more professional.
Include an Effective Date and Last-Reviewed Date
A privacy notice should have clear version information.
For example:
- Effective date.
- Last updated or reviewed date.
This helps the organisation know when the notice was last checked.
When Should the Privacy Notice Be Updated?
Review it when there are changes such as:
- a new contact form;
- a new CRM;
- a new newsletter platform;
- a change to analytics;
- a new advertising pixel;
- a new payment provider;
- a new booking platform;
- a hosting migration;
- a new mobile application;
- a customer portal;
- different data-processing purposes.
Do not treat the Privacy Notice as a page created once during launch and never reviewed again.
Website Redesign Should Include a Privacy Review
A redesign is not only about changing colours and layouts.
The new website may:
- remove old forms;
- add new forms;
- change analytics platforms;
- change hosting;
- add a CRM;
- add a chatbot;
- change the booking platform;
- add new integrations.
During a redesign, review the data flow so the Privacy Notice does not continue describing the old website.
Website Migration Can Also Change Data Processing
When a website moves to a new hosting provider or platform, review:
- whether the database is being transferred;
- where backups are created;
- who receives temporary access;
- whether test copies are created;
- whether the new vendor processes data outside Malaysia;
- whether the old server still contains a copy of the data.
A migration plan should not unnecessarily give a vendor an unrestricted copy of the customer database without clear access and disposal planning.
Website Handover Should Include Data Access
When changing developer or agency, do not collect only:
- domain credentials;
- hosting credentials;
- source code.
Also review:
- who has database access;
- where form submissions are stored;
- old backups;
- CRM integrations;
- analytics;
- tag-management accounts;
- third-party accounts.
Use the Website Handover Checklist Malaysia for a broader review of ownership and access.
Privacy and Website Ownership Are Closely Connected
If the business owner does not know who controls:
- hosting;
- domain;
- database;
- website administrator access;
- CRM;
- email accounts;
they may also not know who can access customer personal data.
For a broader explanation of ownership and control, read Who Owns Your Website in Malaysia?
Website Privacy Checklist Before Launch
| Area | What to Check |
|---|---|
| Data inventory | List all personal data being collected |
| Purpose | Determine why each type of data is required |
| Forms | Remove unnecessary fields |
| Privacy Notice | Make sure the notice reflects actual processing |
| Languages | Review Bahasa Malaysia and English requirements |
| Forms | Provide privacy context or a notice link before submission |
| Marketing | Separate optional marketing choices where applicable |
| Cookies | Identify cookies and tracking technologies |
| Analytics | Review configuration and data flow |
| Third parties | List hosting, CRM, email, booking, payment and other vendors |
| Cross-border | Identify processing or storage outside Malaysia |
| Security | Review HTTPS, accounts, access, updates and backups |
| Retention | Determine how long personal data is retained |
| Rights | Provide a process for access and correction requests |
| Breach | Know who is responsible if an incident occurs |
| Review | Record the effective or last-reviewed date |
A Quick Website Privacy Audit for Business Owners
You can start with this practical exercise:
- Open the website in an incognito or private browser window.
- List every form on the website.
- Submit each form as a test.
- Check where each submission goes.
- Review browser developer tools or tag management if you know how to use them.
- List analytics and advertising tools.
- List chat and booking widgets.
- Open the Privacy Notice.
- Compare what the notice says with what the website actually does.
- Review who currently has administrator or database access.
If you find a tool you do not recognise, do not immediately remove it from the live website.
Identify its purpose first so you do not accidentally break important business tracking or functionality.
Questions to Ask Your Web Designer or Developer
- What information does the contact form store?
- Are submissions stored in a database as well as sent by email?
- Where is the database hosted?
- Who has access?
- Which analytics tools are installed?
- Which advertising tags are installed?
- Is a tag-management platform being used?
- Which third-party widgets are installed?
- Does the website use cookies?
- Is real customer data copied to staging?
- How long are form submissions retained?
- How can information be deleted?
- How are backups stored?
- Is there a Privacy Notice link close to relevant forms?
- Does the website require Bahasa Malaysia and English notices?
- Who is responsible for the legal wording?
Who Should Write the Privacy Notice?
A web designer can help:
- build the Privacy page;
- structure the layout;
- add the footer link;
- add privacy context near forms;
- implement approved consent controls;
- identify technical data flows;
- connect the relevant tools.
However, a web designer should not automatically be treated as a lawyer or DPO.
If the business involves:
- sensitive personal data;
- a regulated sector;
- a large-scale customer database;
- international transfers;
- complex profiling;
- formal tender requirements;
- high-risk processing;
obtain appropriate specialist privacy, compliance or legal input for the wording and obligations.
How Can Nibong Web Studio Help?
Nibong Web Studio provides Web Design and Website Development for Malaysian business websites.
From a website-implementation perspective, relevant areas can include:
- contact and enquiry forms;
- form fields;
- Privacy Notice page structure;
- footer and contextual privacy links;
- approved consent controls;
- responsive forms;
- external integrations;
- analytics and tracking implementation;
- technical security foundations.
Nibong Web Studio can also help the website owner understand the technical data flow — for example, where form submissions are sent and which third-party services are being used — so the organisation can prepare more accurate privacy wording.
However, Nibong Web Studio does not position its web-design services as formal legal PDPA advice, a DPO service or legal compliance certification.
If formal compliance interpretation is required, approved legal or compliance wording should be provided or reviewed by an appropriate professional before implementation.
Frequently Asked Questions About Website Privacy & PDPA Malaysia
Does a Malaysian business website need a Privacy Policy?
If an organisation processes personal data within the scope of the PDPA, the Notice and Choice Principle requires written notice about that processing. For a website, a dedicated Privacy or Personal Data Protection Notice page is a common practical implementation.
Does the Privacy Notice need to be available in Bahasa Malaysia?
Section 7 of the PDPA requires the notice to be provided in the national language and English. Organisations should therefore take this language requirement seriously rather than assuming an English-only notice is always sufficient.
Does information submitted through a contact form count as personal data?
If a form collects information that identifies or can identify an individual, such as a name, email address or phone number, that information may constitute personal data.
Does the PDPA apply to WhatsApp enquiries?
The PDPA is not limited to one technology platform. If an organisation receives and processes customer personal data through WhatsApp as part of a commercial activity, the broader data-handling obligations still need to be considered.
Does every website need a cookie banner?
It is not appropriate to make a blanket statement that every Malaysian website must use an EU-style cookie banner. The correct approach depends on the cookies, tracking technologies, purposes, processing activities and applicable legal requirements. At minimum, website owners should understand what cookies and tracking technologies their website actually uses.
Does Google Analytics raise privacy considerations?
Yes. Analytics implementation should be included in a privacy review because technical and usage information may be transmitted to the analytics provider depending on the configuration.
Should advertising pixels be mentioned?
Advertising tracking should be included in the website's data and tracking inventory, and the privacy notice should accurately describe the relevant processing. The exact consent requirements depend on the implementation and applicable obligations.
Can I use a free Privacy Policy template?
A template can help you understand common sections, but it should not be published without adapting it to the actual business. Generic templates may mention vendors, purposes, countries or practices that do not apply to your organisation.
Does SSL mean my website is PDPA compliant?
No. HTTPS helps protect information in transit, but PDPA obligations also concern matters such as notice, purpose, disclosure, security, retention, integrity and access.
Does every small business need a DPO?
Not necessarily. The current DPO framework sets specific conditions and thresholds. Organisations processing personal data at the relevant scale or carrying out regular and systematic monitoring should review the current official requirements.
What is a personal data breach?
The Personal Data Protection (Amendment) Act 2024 introduced a framework relating to personal data breaches, including circumstances involving loss, misuse or unauthorised access to personal data.
How quickly should a personal data breach be reported?
The current official Data Breach Notification framework sets notification requirements and timelines where the relevant criteria are met. Organisations facing a real incident should refer to the latest official guideline and obtain appropriate compliance advice immediately rather than relying only on a general website article.
Should the Privacy Notice be linked from the footer?
A footer link is a common and useful implementation because it makes the notice accessible throughout the website. For specific forms or data-collection points, a contextual link or short privacy notice may also be useful.
Can a web designer write my Privacy Policy?
A web designer can help with structure, implementation and technical data mapping. If formal legal wording or a compliance opinion is required, the document should be prepared or reviewed by an appropriately qualified professional.
Should an older website be reviewed after the PDPA amendments?
If the website or Privacy Notice has not been reviewed since before the 2024 and 2025 changes, a current review can help determine whether terminology, data-processing descriptions, vendors, security processes or notices remain accurate.
Official References for Malaysian Website Owners
For further review, refer to the following official sources:
- Personal Data Protection Act 2010 [Act 709].
- Personal Data Protection (Amendment) Act 2024.
- Guidance on the Preparation of Personal Data Protection Notices.
- Data Breach Notification Guidelines.
- Cross-Border Transfer Guidelines.
- Data Protection By Design Guideline.
Because data-protection requirements and official guidance can change, review the latest version published by the Personal Data Protection Commissioner when making compliance decisions.
Conclusion
Website privacy is more than adding a Privacy Policy link to the footer.
The more important task is understanding how personal data moves through the website and the business.
Start with these questions:
- What personal data do we collect?
- Why do we need it?
- Are all form fields genuinely necessary?
- Where is the data sent?
- Which vendors can access it?
- Is any information processed outside Malaysia?
- How long is it retained?
- Who can access it internally?
- How can an individual request access or correction?
- What happens if a data breach occurs?
Then make sure the Privacy Notice, forms, consent mechanisms, tracking technologies and website functionality accurately reflect that process.
Privacy should also be reviewed whenever the website changes.
New forms, CRM systems, analytics tools, advertising pixels, booking systems, payment providers, chatbots and hosting migrations can all change the website's data flow.
If you are planning a new website or updating an existing website and need help structuring forms, integrations, Privacy Notice placement and the technical website setup, contact Nibong Web Studio and explain the type of website and systems that will be used.
For formal interpretation of PDPA obligations or legal wording, obtain review from an appropriately qualified privacy, compliance or legal professional.
Ready to build your website?
Tell us about your business and we will recommend the right package.
