Personal Data Protection Department conducts public consultation on Artificial Intelligence and Personal Data Protection Framework

13 October 2026

On 5 October 2026, the Personal Data Protection Department (“PDP”) issued a public consultation paper on the proposed development of an Artificial Intelligence (“AI”) and Personal Data Protection Framework (“Proposed Framework”) under the Personal Data Protection Act 2010 (“PDPA”). The Proposed Framework aims to guide data controllers in complying with the PDPA when processing personal data through AI systems. The consultation closes on 23 October 2026.

This article discusses the key proposals set out in the Proposed Framework.  

Scope

The Proposed Framework applies to data controllers, data processors, or third parties who:

  • procure or acquire AI systems from third-party developers, vendors, or service providers that involve the processing of personal data;
  • develop, deploy, or customise AI systems that process personal data for a specific domain or use case; or
  • provide, support, or operate AI systems in the course of delivering services or supporting business operations, including where the providers of the AI systems have access to such data.

For the purposes of the Proposed Framework, references to data controllers and the obligations applicable to them should also apply, where relevant, to data processors and third parties.

The Proposed Framework applies to the processing of personal data through or in connection with AI systems, including AI systems that are:

  • developed in-house, including bespoke or proprietary AI solutions, such as an internally developed internal fraud-detection model;
  • procured from third-party developers or vendors, including off-the-shelf, customised or open-source AI systems, such as an AI-powered document review tool provided by a third-party vendor or an open-source AI model; or
  • embedded within broader digital platforms or services, including Software-as-a-Service (“SaaS”), cloud-based services, Application Programming Interfaces, or other AI-enabled technologies, such as AI features built into everyday work software, such as tools that summarise documents, draft emails, or summarise meetings.

The Proposed Framework also applies to general-purpose AI models incorporated into specific applications, services, or operational environments that process personal data.

Key requirements

Compliance with the PDPA

Any processing of personal data through AI systems should comply with the PDPA throughout the AI system lifecycle, including planning, design, development, testing, procurement, deployment, integration, operation, monitoring, maintenance, and decommissioning. The existing PDPA requirements will continue to apply to the processing of personal data through AI systems, including:

  • Transparency: Personal data protection or privacy notices should clearly explain the purposes for which personal data is processed, including whether AI systems are used or whether AI-generated outputs may affect data subjects.
  • Consent: Where consent is relied upon as the legal basis for processing, data subjects should be adequately informed of the use of AI systems and how their personal data will be processed. Fresh consent should be obtained where the intended purposes of processing materially differ from those originally communicated to the data subject.
  • Data subject rights: Data controllers should provide clear and accessible information on how data subjects may exercise their rights in relation to personal data processed through AI systems.

The Proposed Framework does not introduce a separate set of requirements under the PDPA for the use of AI, but rather the Proposed Framework clarifies how the existing PDPA requirements continue to apply to the processing of personal data through AI systems.

Security of AI systems

Where a data controller designs, develops, tests, or validates AI systems that process personal data, it should implement appropriate technical and organisational measures in accordance with the Personal Data Protection Standard 2015 and incorporate data protection by design principles into the development of the AI systems. Before deployment, where appropriate, testing and validation should be carried out to assess whether the AI systems:

  • perform consistently with its intended purpose;
  • produce sufficiently reliable outputs for its intended use;
  • operate as intended under reasonably foreseeable operating conditions; and
  • operate effectively.

Where a data controller engages AI service providers (e.g. developers, vendors, or cloud service providers) to design, develop, or support AI systems that process personal data, appropriate due diligence should be conducted. The due diligence should take into account, among other things, the intended purpose and functionality of the AI system, its limitations, the categories and sensitivity of personal data processed, the technical and organisational measures implemented by the service provider, and any known risks, biases, or limitations that may affect the processing of personal data or data subjects. 

Where an AI service provider is involved in the processing of personal data, the data controller should clearly define the respective roles and responsibilities of the relevant parties, and appropriate contractual arrangements should also be established to govern the processing of personal data, including for the purposes of data breach notification.

Risk minimisation

AI systems that process personal data should be designed, tested, used, and monitored to minimise foreseeable risks of unfair, biased, or discriminatory outcomes affecting data subjects, including risks arising from characteristics such as race, religion, and age. Data controllers should assess relevant training, testing, and operational data for quality, representativeness and potential bias, and review AI-generated outputs to identify material bias, unfairness, or discriminatory patterns.

Data controllers should establish appropriate internal policies and procedures governing the development, deployment, and use of AI systems that process personal data. Such policies should set out the applicable governance structure, approval processes, use restrictions, and controls relating to the processing of personal data through AI systems.

Data controllers should also establish appropriate processes for the periodic review and audit of AI systems and related processing activities. Documentation and records relating to AI systems should be reviewed and updated where necessary.

Monitoring of AI systems

Data controllers should monitor AI systems throughout their operational lifecycle to ensure that the personal data processed remains adequate, relevant, and not excessive in relation to the intended use. Appropriate oversight should also be maintained over external AI systems, particularly where there are significant changes to the terms of service, processing activities, involvement of data processors or third-party service providers, or data handling practices.

Practical implications for businesses

If the Proposed Framework is subsequently incorporated into guidelines, businesses using AI systems that process personal data may wish to consider taking the following practical steps:

  • Identify and map AI usage across the business, including AI systems developed in-house, provided by vendors, or embedded in SaaS tools.
  • Review privacy notices and consent flows to ensure that individuals are adequately informed of the use of AI and the processing of their personal data.
  • Review arrangements with AI service providers to address key data protection considerations, including the use of personal data for AI training, cross-border transfers, data retention, and deletion.
  • Consider appropriate risk assessments and ongoing monitoring to ensure that AI systems continue to operate as intended and that the personal data processed remains appropriate for the intended use.

The Proposed Framework can be found on the PDP website www.pdp.gov.my. Interested parties may submit their feedback by 23 October 2026 through either of the following channels:

  • Unified Public Consultation Platform (UPC) at this webpage; or
  • Official Feedback Form at this webpage.

Further information

This article has been prepared with the assistance of Senior Associate Siah An Gel and Associate Mohamad Syafiq bin Mohamad Tazri.