This Policy Document introduces new requirements for financial service providers to:

• notify Bank Negara Malaysia to include a customer information breach that cause or likely to cause significant harm to customers or if the customer information breach involves or likely to involve a large number of customers under paragraph 11.8 and paragraph 11.20.
• notify the affected customers of a customer information breach that causes or likely to cause significant harm to the customers under paragraph 11.25 to paragraph 11.31.

These new requirements are in line with the amendments to the Personal Data Protection Act 2010 (PDPA) on mandatory data breach notification to the Personal Data Protection Commissioner to ensure proper handling of customer information.

Issuance Date
31 October 2025

Effective Date
31 October 2025 

Issuing Department
Jabatan Konsumer dan Amalan Pasaran 

Documents

• Policy Document on Management of Customer Information and Permitted Disclosures
• Appendix I - Template for reporting customer information breach
• Appendix V - Template for application for disclosure of customer information