Malaysia Proposes AI and Personal Data Protection Framework, Baker McKenzie Provides Insights
Malaysia's Personal Data Protection Department (PDPD) has released a consultation paper outlining a proposed Artificial Intelligence and Personal Data Protection Framework. This Framework aims to guide organizations involved in developing, procuring, deploying, or supporting AI systems on how to comply with the Personal Data Protection Act 2010 (PDPA) when processing personal data. The proposal adopts a lifecycle-based approach, covering expectations for lawful processing, system development and monitoring, third-party oversight, data subject rights, security, governance, and demonstrable compliance. Submissions for feedback on the Framework are due by October 23, 2026. The Framework is relevant to data controllers and processors that utilize AI systems involving personal data. Baker McKenzie has provided insights into this development, noting that the Framework, alongside a proposed AI Governance Bill, signals Malaysia's move towards a more structured AI governance regime.