The short answer
Only breaches likely to cause significant harm, or affecting more than 1,000 people, must be reported to the Personal Data Protection Commissioner.
Notify within 72 hours of finding out, through pdp.gov.my or dbnpdp@pdp.gov.my, then tell affected customers within 7 days.
Keep a record of every breach for two years — and delete old form entries so there is less to leak.
Was customer data actually exposed?
Not every hack is a data breach. Start by finding out what personal data the website held, and whether the attacker could reach it.
What counts as personal data
Anything that identifies a person: names, phone numbers, email and home addresses, IC numbers, order history, enquiry form messages. Health details, like those a clinic collects, count as sensitive personal data and are treated more strictly.
Where websites keep it
WooCommerce orders and customer accounts, contact and booking form entries saved in the database, newsletter lists, and old backup or database files left in a public folder.
Signs it was taken
A database export you did not make, an unknown admin account that could open orders or form entries, or customers getting scam calls and WhatsApp messages that quote their real orders.
Ask your host for the logs
Access logs show which files and pages the attacker opened, and when. Ask for them in writing before they are rotated away.
Does it have to be reported?
The PDPA does not require you to report every breach — only the ones likely to cause significant harm. The Commissioner’s guideline describes when that is.
Money or credit at risk
The leaked data could lead to financial loss, damage to someone’s credit records, or physical harm or loss of property.
Misuse and identity fraud
The data could be used for an illegal purpose — or combined, like a name, IC number and address together, to open accounts in someone else’s name.
Sensitive personal data
Health records, religious beliefs, biometrics such as fingerprints for staff attendance, and similar categories. A clinic or wellness centre with leaked patient details is almost always in this group.
More than 1,000 people
A breach affecting over 1,000 people counts as significant scale and must be reported to the Commissioner even if each person’s risk seems small.
If nothing personal was reached
A defaced page on a site with no forms and no customer accounts usually has nothing to notify. Write down why you decided that — the Commissioner may ask.
The 72-hour clock
If the breach is notifiable, the Commissioner must hear from you within 72 hours. Count from the moment you first knew something was wrong, not from when you finished investigating.
Send what you know
The first notification does not need every answer. Report what happened, what data is involved, roughly how many people and what you have done so far. The rest can follow, up to 30 days after the first notice.
Where to send it
Use the notification form on pdp.gov.my, or email the completed form to dbnpdp@pdp.gov.my. Keep the confirmation notice you receive — a notification only counts once it is confirmed.
If you are late
Send it anyway, with a written explanation of the delay and evidence for it. Not notifying at all can mean a fine of up to RM 250,000, up to two years in prison, or both.
It is your duty, not your designer’s
The business that collects the data — the data controller — is the one that must notify. Your web designer and host should help with the facts, but they cannot report it for you.
Telling your customers
When a breach is likely to cause significant harm, every affected customer must be told directly — no later than 7 days after you notify the Commissioner.
Directly, and separately
By email, SMS or WhatsApp to each person — not inside a newsletter or promotion. If you cannot reach them individually, a clear public notice on your website and social pages is allowed.
What to say
What happened and when, which of their details were involved, what you have done about it, and what they should do now. Add a name and number they can contact.
Give them practical steps
Warn them about calls or messages that quote their order or booking. Remind them that you will never ask for a banking login, TAC or card number, and to report scams to the National Scam Response Centre at 997.
In the language they used
Most Melaka businesses serve customers in Malay, English and Chinese. Send the notice in the language each customer normally writes to you in.
Records, DPOs and your web designer
Three more duties from the 2024 amendments that small businesses often miss.
Keep a breach record
Record every breach — including the ones you decided not to report — with what happened, the decision and why. Keep these records for at least two years.
Do you need a Data Protection Officer?
Only above the thresholds: personal data of more than 20,000 people, sensitive or financial data of more than 10,000, or regular and systematic monitoring of people. An online store with years of orders can pass 20,000 without anyone noticing. A DPO must be registered with the Commissioner within 21 days of appointment.
Your designer and host have duties too
Since 2025, data processors — the people who host or manage your site — must keep personal data secure themselves. Ask them in writing what security they run and how fast they will tell you about a breach.
Collect less, so there is less to leak
The cheapest breach is the one with nothing in it. Most small business websites hold far more personal data than they need.
Delete old form entries
Many form plugins keep every enquiry in the database for ever. Once an enquiry has reached your email or WhatsApp, the copy on the website is only a risk. Set entries to delete automatically.
Don’t collect IC numbers on forms
Unless the law or your service really needs them. If you do collect IC or passport copies, keep them out of the website’s upload folder.
No backups in public folders
A backup zip or .sql file left in the website folder can be downloaded by anyone who guesses the name. Keep backups off the hosting account.
Fewer admins, kept up to date
One admin account per person, two-factor login, and weekly updates. Most breaches on Malaysian small business sites start with an outdated plugin.
Quick answers.
01Does the PDPA apply to a small business?
Yes. There is no size threshold — a home business with a booking form has the same duty to keep data secure and to notify a qualifying breach. Only the Data Protection Officer requirement depends on size.
02Only a few customers were affected. Do I still report it?
If the data could cause significant harm — IC numbers, health details, or details that enable fraud — yes, even for a handful of people. The 1,000-person rule is a separate trigger, not a minimum.
03Were customers’ card numbers stolen?
Usually not, if you take payment through a Malaysian gateway such as iPay88, eGHL or senangPay — the card is entered on the gateway’s page, not stored on your site. Ask your gateway to confirm, and check that no plugin saved card details.
04Who reports it — me, my designer or my host?
You. The business that collects the data is the data controller and must notify the Commissioner and customers. Your designer and host should give you the facts and logs quickly.
05Do I need a lawyer?
For a serious breach — sensitive data, many customers, or money stolen — legal advice on the notification is worth it. CST handles the technical side: what was exposed, how and when, and closing the hole. CST does not give legal advice.
06Where else should I report it?
CyberSecurity Malaysia’s Cyber999 takes reports of hacked systems. If money was stolen, call the National Scam Response Centre at 997 and make a police report — your bank will ask for it.
07What does CST charge?
Speed & security recovery is RM 1,200 fixed: malware removed, the hole closed and the site locked down. A written summary of what was exposed and when, for your notification, is a one-off fix — RM 150 for the first hour, then RM 75 per extra half hour.
Related guides
“He explains things in plain language. No jargon, no upselling. I always know what I am paying for.”