How to run a DPIA for AI under Malaysia's PDPA

Malaysia now expects an impact assessment before most AI that touches personal data goes live. The Personal Data Protection Commissioner issued a Data Protection Impact Assessment (DPIA) Guideline and an Automated Decision-Making and Profiling (ADMP) Guideline together on 30 April 2026, both under section 48(g) of the Personal Data Protection Act 2010. Read together, they make the DPIA the main checkpoint for AI in Malaysian organisations. This guide sets out when one is required, who does what and how to run it for an AI system. The ADMP rules themselves are on the framework page.

Work out whether a DPIA is required

The DPIA Guideline sets a two-stage test. First, quantitative thresholds. Processing expected to involve more than 20,000 data subjects, or sensitive personal data including financial information of more than 10,000 data subjects, is deemed likely to be high risk and needs a DPIA.

Second, if neither threshold is met, the DPO exercises judgement on qualitative factors. The Guideline’s list is not exhaustive. It includes potential legal or significant effects on people, systematic monitoring, use of innovative technologies, denial or restriction of rights, tracking of location or behaviour, targeting of children or vulnerable people, and automated decision-making and profiling that pose a high risk.

For AI the ADMP Guideline removes most of the judgement. It says ADMP triggers a DPIA regardless of the nature or extent of its intended use, and the DPO shall ensure one is carried out for any planned processing that includes ADMP elements. A credit model that scores applicants, an algorithm that shortlists candidates or a pricing engine that profiles customers all fall in. The DPIA Guideline’s own examples include a bank adding AI-driven facial recognition to its app.

That means the first task is knowing which AI you have. An assessment process only works if new AI reaches it, including AI switched on inside software the organisation already runs. The shadow AI guide covers where to look, and the AI system register guide covers recording what you find.

Assign the roles

The duty sits with the data controller, and ultimate responsibility for the DPIA and any decision that follows rests with senior management. The DPO, now mandatory under the 2024 amendments, identifies whether a DPIA is needed, advises on it and the mitigations, and develops templates. A DPIA Lead plans and runs the assessment and may be the DPO, a project manager or someone else the controller chooses.

The Guideline expects stakeholders from across the organisation to take part, including the project manager, IT, legal, subject matter experts and the data processor. For AI bought from a vendor, that last point matters. The processor is expected to give reasonable assistance, and the controller should secure that through contract terms. If a vendor cannot explain what data its model uses or how it reaches a decision, the DPIA cannot be completed properly. The vendor AI risk guide covers the questions to ask.

Run the five DEICA steps

The Guideline asks controllers to follow five steps, abbreviated DEICA.

1. Describe the processing, including the personal data involved, the data flow and the purpose. For AI, describe what the system decides or recommends, what data it was trained on and uses, and who acts on its output.
2. Evaluate compliance, necessity and proportionality. Could the purpose be met with less data, or without automated decisions at all?
3. Identify and analyse the specific risks to the people affected, by likelihood and impact. For AI this is where bias, inaccurate outputs and over-reliance belong.
4. Consider the measures to address each risk. The ADMP Guideline’s AI practices are a ready list, including telling people AI is used, training staff, designating trained reviewers and not relying on AI as the sole factor in a decision about a person.
5. Assess the overall residual risk as high, medium or low.

The findings go to senior management, which decides whether to accept any high residual risk or apply further mitigation, and allocates the resources to do it. The Guideline includes a DPIA template in its annex.

Keep it current

A DPIA is valid for two years, then must be refreshed. The Guideline is clear that it is not a one-off. Throughout the processing, the DPIA Lead should watch for changes that affect the risks, such as a new purpose or a newly found vulnerability. AI changes more often than most systems, through model updates, retraining and new data, so tie a review to each material change rather than waiting for the two years to run out.

Records of the DPIA must be kept for at least two years after the processing ends and made available to the Commissioner on request. A controller may also publish its DPIA, or a redacted summary, to build trust.

Where Aicura fits

Aicura’s AI Register holds each system and agent with its owners, vendor, data and level of human oversight, and discovery surfaces AI in use that is not yet on it. Risk assessments start when a system is registered and run again on material change. At Pro, impact assessments set out who is affected and how, and sit on the same record alongside vendor records, monitoring and oversight checkpoints. Aicura does not assess against Malaysian law. Its assessments and records support the work the DPIA and ADMP Guidelines describe, and the judgement stays with your DPO and senior management. The AI impact assessment guide covers the assessment itself in more depth.

A note on this page

This is Aicura’s reading of the Commissioner’s DPIA and ADMP Guidelines. It is not legal advice. Read the guidelines published by the Department of Personal Data Protection, and take advice on how the Personal Data Protection Act applies to your organisation.