Malaysia Automated Decision-Making and Profiling Guideline

What it is

The Automated Decision-Making and Profiling Guideline is guidance from Malaysia’s Personal Data Protection Commissioner on how the Personal Data Protection Act 2010 (Act 709) applies to automated decisions and profiling. It was issued on 30 April 2026 under the Commissioner’s functions in section 48(g) of the Act, together with guidelines on data protection impact assessments and data protection by design. It followed Public Consultation Paper No. 3/2025, issued in March 2025.

The Guideline starts from a plain admission. Act 709 does not currently provide specific provisions on automated decision-making and profiling. Any processing in commercial transactions that involves them must still comply with the Act, particularly the Personal Data Protection Principles, and the Guideline explains how.

It defines automated decision-making as making decisions without any human involvement by wholly or partly automated means. Minimal human influence still counts, so a process where a person only enters the data and a system makes the decision is ADM. Profiling is automated processing that uses personal data to evaluate personal aspects of someone, such as work performance, economic situation, health, preferences, reliability, behaviour or location.

Who it applies to

Act 709 applies to data controllers that process personal data in commercial transactions. The 2024 amendments, in force in stages through 2025, renamed data users as data controllers, extended the security principle to data processors and introduced mandatory data protection officers and breach notification from 1 June 2025.

The Guideline speaks to data controllers, data processors and their DPOs. It does not apply to every automated process. DPOs are asked to judge whether a planned processing meets the ADMP Threshold, which is met where the outcome may have legal effects on the data subject or significantly affect them.

What it requires

Engage the DPO and run a DPIA. Where an organisation plans ADMP, its DPO should be engaged at the earliest stage, starting with a data protection impact assessment. ADMP is one of the qualitative factors that triggers a DPIA regardless of how it is used. The Guideline’s flowchart ends with continuous monitoring and a fresh DPIA after two years.

Apply the threshold. Legal effects include ending a contract or entitlement, or refusing a social benefit conferred by law. A significant effect is one that may substantially change a person’s circumstances or choices, have a prolonged or permanent impact, or at worst lead to exclusion or discrimination. The Guideline’s illustrations include automatic loan rejection below a score, fully automated health insurance pricing, algorithmic interview shortlisting and reliability ratings shared with a platform’s customers.

Handle sensitive data under section 40. ADMP involving sensitive personal data, which now includes biometric data, needs explicit consent or one of the conditions in section 40(1)(b). The Guideline suggests encryption and stricter access controls as safeguards.

Tell people. Under the Notice and Choice Principle, the written notice must say when processing involves ADM or profiling. It may describe the types of decisions, the reasons for them and their possible consequences, as fully as reasonably practicable without disclosing trade secrets. Notices should be easy to find and kept up to date as ADMP changes.

Honour withdrawal of consent. Under section 38, a data subject may withdraw consent in writing, and the controller must then stop the processing that includes ADM or profiling. Controllers should provide simple ways to do this and tell people they exist. The Guideline lists contract, compliance with laws and prior consent as the circumstances in which ADMP may be undertaken, and Part III exemptions of the Act still apply.

Use AI with care. Part E applies only where AI, including generative AI, is used in ADMP. Its best practices are to identify the commercial objective and assess risks before deploying, use AI for profiling with respect for dignity and accurate outputs, explain the use of AI in the notice without being overly technical, mitigate over-dependence on AI, train relevant staff, avoid relying on AI as the sole factor in decisions about a data subject, and designate trained reviewers of the AI used.

Key dates

• 15 November 2013. The Personal Data Protection Act 2010 came into force.
• 20 March 2025. Public Consultation Paper No. 3/2025 on ADMP issued, with comments due by 19 May 2025.
• 1 June 2025. The last phase of the Personal Data Protection (Amendment) Act 2024 came into force, bringing in DPO appointment, breach notification and data portability.
• 30 April 2026. The ADMP Guideline, the DPIA Guideline and the Data Protection by Design Guideline were issued.

How it relates to other frameworks

The definitions follow the shape of GDPR Article 22, but the mechanism is different. Malaysia has no standalone right not to be subject to automated decisions. The Guideline works through notice, consent and withdrawal, and through the DPIA.

For AI governance more broadly, the ADMP Guideline sits beside the voluntary National Guidelines on AI Governance and Ethics and the proposed AI Governance Bill. Organisations that want a full management system often pair them with ISO/IEC 42001 or the NIST AI RMF.

A note on this page

This is Aicura’s reading of the ADMP Guideline. It is not legal advice and it is not the Guideline itself. Read the primary source published by the Department of Personal Data Protection, and take advice on how Act 709 applies to your organisation.