Lost Staff Phone? The 72-Hour Data Breach Rule
A missing staff phone full of customer chats is a data breach under the PDPA. Whether you must report it comes down to two tests you can run in an hour.
A staff phone with customer chats went missing. Do you have to report it? Only if the loss is likely to cause significant harm, or if the phone held the details of more than 1,000 people. That is how data breach notification in Malaysia works under the PDPA: the 72-hour deadline everyone quotes applies to serious breaches, not to every lost handset. What applies every time is quieter. You record the incident in a breach register and keep that record for at least two years.
Almost everything written about this rule comes from law firms, for compliance teams. This is the owner's version, built around the three incidents a small business is most likely to meet: a lost phone, a salesperson who left with the customer chats, and a customer list sent to the wrong WhatsApp group.
Since 1 June 2025, a Malaysian business must notify the Personal Data Protection Commissioner within 72 hours of a personal data breach that is likely to cause significant harm or that affects more than 1,000 people, and must tell the affected people within 7 days when harm is likely. A lost staff phone with customer chats is a breach by definition, but many such incidents fall under both tests and need only an entry in your breach register. The deadline is rarely the hard part. The hard part is knowing what was on the phone.
What does Malaysia's data breach notification rule require?
It requires three things: a report to the Commissioner for serious breaches, a message to the affected people when harm is likely, and a written record of every breach whether you reported it or not. The duty sits in Section 12B of the Personal Data Protection Act and took effect on 1 June 2025, with the detail set out in the Commissioner's Guideline on Data Breach Notification issued on 25 February 2025 (Baker McKenzie, 2025).
| Duty | When it applies | Deadline |
|---|---|---|
| Notify the Commissioner | Significant harm is likely, or more than 1,000 people are affected | As soon as practicable, no later than 72 hours |
| Notify the affected people | Significant harm is likely | No later than 7 days after you notified the Commissioner |
| Record it in a breach register | Every breach, reported or not | Keep the record for at least 2 years |
The timings come from the guideline as summarised by CMS Law and DLA Piper. Three practical details are worth knowing before you ever need them.
First, you report through a form on the Commissioner's website at pdp.gov.my, by emailing the completed form to dbnpdp@pdp.gov.my, or in hard copy. The notification only counts as submitted once the Commissioner issues a confirmation notice, so keep that reply.
Second, you do not need every fact on day one. The guideline lets you send what you know and supply the rest in phases, no later than 30 days after the first notification.
Third, if you miss the 72 hours, you owe a written explanation with evidence of why. Late with reasons is far better than silent.
Does a lost phone with customer chats count as a data breach?
Yes. The guideline defines a personal data breach as any event or incident that leads to, or is likely to lead to, the breach, loss, misuse or unauthorised access of personal data, whether accidental or deliberate (Hogan Lovells, 2025). A phone left in a Grab is a loss. A list pasted into the wrong group is unauthorised access. Nobody has to hack anything.
Being a breach and being reportable are different questions. A breach must be reported when it is likely to cause significant harm, which the guideline describes as a risk that the data:
The last line is the one small businesses miss, and it is the contrarian point of this article. Owners assume the rule is about hackers and big databases, so a single phone feels too small to matter. But the scale test counts people, not systems. A salesperson with three years of customers in one WhatsApp account can hold more than 1,000 contacts alone. One handset can cross a line the owner thought only applied to banks.
There is one mercy in the scale test. Where a breach is large but harm is unlikely, you notify the Commissioner only. You do not have to message every customer (CMS Law, 2025).
Which of these three incidents has to be reported?
Each lands in a different place. These are illustrative composites built from situations we see often, and the outcomes are our plain reading of the guideline, not legal advice.
| Incident | What was exposed | People | Likely outcome |
|---|---|---|---|
| Lost phone, air-cond servicing firm in Shah Alam | Names, numbers, addresses, service history | About 400 | Register entry only |
| Agent left a Petaling Jaya property agency | Chats plus IC photos, payslips, bank statements | About 2,300 | Commissioner and affected buyers |
| List sent to the wrong group, Penang retailer | Names and phone numbers | About 1,400 | Commissioner only |
The lost phone. A coordinator at a six-person air-cond servicing firm leaves her phone in a Grab on Friday night. It holds the WhatsApp chats of about 400 customers. The phone has a screen lock, and by Saturday morning the number is registered on a new SIM, which deactivates WhatsApp on the old device. Nothing in those chats is health or financial data, and the count is well under 1,000. Our reading: record it in the register with the reasoning, and no report is needed. One caution. The summaries we checked give no automatic pass for a locked phone. A lock makes harm less likely, and that is exactly what you write down, but it is a judgment you can explain, not an exemption.
The agent who left. A senior agent resigns from a twelve-agent property agency. Every buyer conversation sits in the agent's personal WhatsApp, including IC photos, payslips and bank statements sent for loan applications. While the agent was employed, that access was authorised. The guideline has no line about former employees, but its definition covers misuse and unauthorised access, and an ex-agent contacting those buyers from a new agency with their documents still in hand fits both words. Identity documents plus financial records is the combination the identity-fraud test describes, and 2,300 people is over the scale line. This is the one incident of the three where we would call a PDPA practitioner the same day, and expect to notify both the Commissioner and the buyers. We wrote separately about the commercial side of this in what happens when a salesperson quits and takes the customers.
The wrong group. A retail assistant in Penang means to send the customer export to the owner and drops it into a supplier group with 30 members instead. It is deleted for everyone twenty minutes later, but a file can be downloaded in twenty minutes. Names and phone numbers alone are unlikely to cause significant harm. The list has 1,400 people on it, though, so the scale test applies. Our reading: notify the Commissioner within 72 hours, and no individual messages to customers are required on scale alone.
What should you do in the first 72 hours?
Contain it, count it, then decide. Most of the work is finding out what was actually exposed.
How to Handle a Lost Work Phone With Customer Data in 72 Hours
On the first step, WhatsApp's own guidance is to lock the SIM and re-register the number on a new device, because the app keeps working over Wi-Fi even after the SIM is blocked (WhatsApp Help Center). On the fifth, the summaries describe the clock as running from when you detect or are told about the incident, with room for a quick first check that a breach really happened (Hogan Lovells, 2025). Do not stretch that check into a week.
What goes in a breach register, and why keep one?
A breach register is a running record of every incident, including the ones you decided not to report. It must be kept for at least two years, and it is the part of this rule that applies to a business of any size.
According to Baker McKenzie's summary, each entry covers what happened and when you became aware, the cause, the types of data and the estimated number of people, the system or device involved, the likely consequences, what you did to contain it, and either the notification record or your justification for not notifying. For an SME this can be one shared sheet with those columns. It takes fifteen minutes per incident.
A word on tone, because most PDPA content is written to frighten. What we have seen across MSME sales operations is that enforcement has not reached small businesses, and most owners have never been asked about PDPA by anyone official. So treat the register as the cheapest thing you can do before anyone does ask. The penalty for failing to notify the Commissioner when you should have is real: a fine of up to RM250,000, up to two years in prison, or both under Section 12B(3) (Conventus Law, 2025). A dated entry showing how you assessed an incident is your best answer if that question ever comes.
Frequently Asked Questions
Why is the form harder than the deadline?
Because the form asks two questions most owners cannot answer: how many people were affected, and what kind of data was it. Seventy-two hours is plenty of time when you know both. It is no time at all when the only copy of the answer was inside the phone that is now missing.
What we have seen is that in most SMEs, customer conversations live on phones the owner has never looked inside. Everyone records in their own way, in their own chats, and the first time anyone asks "what did that phone hold?" is the day it is gone. The owner then has to guess whether it was 300 customers or 3,000, and whether anyone ever sent an IC photo. A guess is a poor basis for a legal decision in either direction.
That is the practical case for moving customer chats off personal phones and onto a company number, which we walked through in our guide to WhatsApp with multiple users on one number. In Raion HUB, every conversation sits in a company workspace against a lead record with a named owner. Filter by that owner and you have the count. Files a customer sends stay attached to the conversation thread, role-based access means each team member sees their own records while managers see all, and the activity log shows who changed what. None of that is a compliance certificate, and we would not sell it as one. It simply turns "what was on the phone?" from a guess into a filter. The wider setup is in our CRM automation guide for Malaysian SMEs, and the consent side of the PDPA is covered in PDPA rules for WhatsApp marketing.
A note on scope: this is a plain-language guide for business owners, not legal advice. If documents like ICs, payslips or medical records were exposed, or you are close to either test, a short call with a PDPA practitioner inside the 72 hours is money well spent.
The bottom line
A lost staff phone with customer chats is a personal data breach in Malaysia, but it is reportable only when significant harm is likely or more than 1,000 people are affected. Serious cases go to the Commissioner within 72 hours and to the affected people within 7 days, and every incident goes into a register kept for at least two years. The businesses that handle this calmly are the ones that can say, within the hour, how many customers were on the phone and what the chats contained.
