Does Your SME Need a Data Protection Officer?
A data protection officer is mandatory in Malaysia only above 20,000 people's data. Most SMEs sit under the line. Here is how to count yours.
Probably not. In Malaysia, a data protection officer (DPO) is mandatory only if your business holds the personal data of more than 20,000 people, sensitive data on more than 10,000 people, or systematically monitors people. Most SMEs sit well under those lines. The rule has been in force since 1 June 2025, and almost everything written about it is by law firms, for compliance teams. If you typed "do I need a data protection officer Malaysia" into a search bar as a business owner, this is the owner's version: how to count your contacts in about ten minutes, and what to do with the answer.
A data protection officer is mandatory in Malaysia only when a business processes personal data of more than 20,000 people, sensitive or financial data of more than 10,000 people, or runs regular and systematic monitoring. Your WhatsApp contacts, leads, staff and suppliers all count, but each person counts once. Most small businesses land under the line, which means no appointment and nothing to register. The useful work is the count itself, because most owners cannot produce the number.
Who must appoint a data protection officer in Malaysia?
A business must appoint a DPO if its processing crosses any one of three lines. The Personal Data Protection Commissioner set them out in the Guidelines on the Appointment of Data Protection Officer, issued on 25 February 2025 under the new Section 12A of the PDPA:
The rule covers both data controllers (the business that decides why data is collected) and data processors (a vendor handling data on someone else's behalf). If you cross a line, you appoint. If you cross none, the requirement does not apply to you.
Two details matter for small businesses. First, "sensitive personal data" under the PDPA means health, political opinions, religious beliefs, criminal records and biometric data, and the guideline adds financial information to that bucket for counting purposes (Baker McKenzie, 2025). So a clinic, a physiotherapy centre or a business that collects payslips is measured against 10,000, not 20,000.
Second, the monitoring trigger is the fuzzy one. The examples given are behaviour tracking, CCTV, connected devices and profiling people for behavioural advertising. It was written for businesses whose model depends on watching people at scale. If tracking individuals is how you make money, that is the one question in this article worth a short paid consultation.
Does my WhatsApp customer list count?
Yes. A "data subject" is simply a person whose details you hold. The guideline does not carve out any channel, so a name and phone number saved from a WhatsApp chat counts the same as a row in a CRM.
What it counts is people, not rows. That one distinction changes the number for almost every business we talk to:
Here is the honest gap in the rule. The guideline gives the thresholds but no counting method. It does not state a time period, and the law-firm summaries do not supply one either (CMS Law, 2025). The safe reading is the plain one: count every living record you hold today, across the whole business.
That is where it gets hard, and not for legal reasons. What we have seen is that the first customer list a business hands us is rarely a list. It is a phone-contacts export converted to a spreadsheet, or a messy sheet where the phone column is written three different ways, or contacts sitting inside individual staff phones. The owner cannot say whether the business holds 4,000 people or 14,000. The contrarian point of this whole article is that the DPO rule is not the problem for most SMEs. Not knowing your own number is.
What does the count look like for a real business?
It usually lands lower than the owner feared, with one exception. These three are illustrative composites, built from the shapes we see most often, not surveys.
| Business | People counted | Line that applies | DPO required? |
|---|---|---|---|
| Dental clinic in Ipoh, 9 years old | About 6,400 patients, all health data | 10,000 (sensitive) | No, but closing in |
| Property agency in Puchong, 12 agents | 18,000 rows, about 11,500 unique people | 20,000 (general) | No |
| Retailer in Penang, shop plus online | 31,000 unique customer numbers | 20,000 (general) | Yes |
The clinic is the case people get wrong. The owner hears "20,000" and relaxes. But patient records are health data, so the line is 10,000. At 6,400 records and roughly 1,300 new patients a year, this clinic crosses in under three years. It does not need a DPO today. It does need a date in the calendar to recount.
The agency shows why people beat rows. Twelve agents each hold around 1,500 contacts, which is 18,000 rows and uncomfortably close to the line. But leads in an agency get passed around, and the same buyer sits in several agents' lists. Merged by phone number, the real figure is nearer 11,500. The agency also holds payslips and bank statements for about 900 buyers at loan stage. That is financial information, counted against the 10,000 line, and still far under it.
The retailer is over. Six years of orders and a broadcast list add up to 31,000 unique numbers, so a DPO is required. Notice, though, that 14,000 of those people have not bought in three years. The PDPA's Retention Principle already says personal data should not be kept longer than it is needed. The guideline is silent on what happens when a business drops back under the line, so do not treat deletion as a loophole. Still, a list cleaned honestly is a smaller list, and this retailer should clean it before deciding how much DPO it needs to pay for.
How to Count Your Data Subjects for Malaysia's DPO Threshold
What do you do if you are over the line?
You appoint someone, and it does not have to be a new hire. This is the part the scary headlines skip. Under the guideline, the DPO can be an existing employee, the role can be part-time, it can be outsourced under a service contract, and one person can serve as DPO for several organisations (Hogan Lovells, 2025).
The practical requirements are short. The DPO must be proficient in Bahasa Melayu and English. They must be resident in Malaysia, meaning physically present at least 180 days a year, or easily contactable. The business sets up a dedicated email address for the role, separate from the person's own inbox, and registers the appointment within 21 days.
Cost is where SMEs were alarmed, and fairly. When the rule took effect, the SME association Samenta estimated a DPO at RM45,000 to RM60,000 a year, and said most SMEs were "struggling to interpret what is expected of them" (New Straits Times, 1 June 2025). That figure assumes a dedicated hire. A business that is just over the line has cheaper routes.
| Route | Fits when | Watch for |
|---|---|---|
| Existing staff, part-time | You are just over the line and someone already handles customer records | No conflict of interest, and give them real hours for it |
| Outsourced DPO | Nobody in-house has the knowledge | The contract must name the individual responsible |
| Full-time hire | Large volumes of health or financial data | The Samenta estimate of RM45,000 to RM60,000 a year |
On penalties, be careful with anything you read. The summaries of the guideline we checked do not cite a specific fine for a missing DPO. The amended Act's wider penalties are a separate matter and they are serious, so "no named fine" is not the same as "optional".
What if you are under the line?
Then you do not appoint a DPO and there is nothing to register. That is the answer for most small businesses, and you can stop worrying about this particular rule.
The rest of the PDPA still applies to you at any size: tell people what you collect, get consent for marketing, keep the data secure, and report serious breaches under the notification duty that started on the same day (DLA Piper, 2025). Our guide to PDPA rules for WhatsApp marketing covers the consent side, and the piece on customer data stored overseas covers where your list physically sits.
A word on tone, because most PDPA content is written to frighten. What we have seen across MSME sales operations is that enforcement has not reached small businesses. Most owners have never been asked about PDPA by anyone official. So this is not a "comply or else" article. It is a "ten minutes now saves a scramble later" article. Even under the line, name one person who owns customer data questions. It costs nothing, and it is the person a customer or a corporate client will ask for.
Frequently Asked Questions
Why is the count worth doing even if the answer is no?
Because the number tells you more than whether to appoint someone. A business that can state "we hold 11,500 people, in one place, and here is who can see them" has already solved the harder problems: nothing walks out the door in a departing salesperson's phone, old leads can be found and followed up, and a client's vendor questionnaire gets answered in a sentence.
That is the real reason to pull contacts out of individual phones and into one system. In Raion HUB, an imported spreadsheet goes through a phone formatter that cleans the phone column, and new leads from WhatsApp, ads and web forms arrive with their name, number and source already filled in. Role-based access means each team member sees their own records while managers see all of them. None of that is a compliance certificate, and we would not sell it as one. It is simply what makes the count a ten-minute job instead of a week of chasing exports. Our CRM automation guide for Malaysian SMEs walks through the wider setup.
A note on scope: this is a plain-language guide for business owners, not legal advice. If you hold health or financial data in volume, or you are close to a line, a short session with a PDPA practitioner is money well spent.
The bottom line
Most Malaysian SMEs do not need a data protection officer, because the rule only bites above 20,000 people's data, 10,000 for sensitive or financial data, or where monitoring people is the business. Count people, not rows, and check the 10,000 line first if you hold health records or payslips. If you are over, an existing employee or an outsourced DPO registered within 21 days meets the rule. If you are under, write the number down, date it, and recount next year.
