Which Businesses Must Register Under the PDPA?

Registration under the PDPA is not general. It reaches only data controllers who fall inside a class specified by order under s.14 of Act 709 — and that list has not moved since 16 December 2016.

The 13 classes

#	Class	Who it covers
1	Communications	Licensees under the Communications and Multimedia Act 1998 or the Postal Services Act 2012
2	Banking and financial institution	Licensed banks, investment banks, Islamic and international Islamic banks, DFIs
3	Insurance	Licensed insurers, takaful and international takaful operators
4	Health	Private healthcare licensees, registered private medical and dental clinics, bodies corporate registered under the Registration of Pharmacists Act 1951
5	Tourism and hospitalities	Licensed tourism training institutions, tour operators, travel agents, tourist guides and registered tourist accommodation
6	Transportation	Eight named airlines, including Malaysia Airlines Berhad added in 2016
7	Education	Registered private higher educational institutions and private schools
8	Direct selling	Licensees under the Direct Sales and Anti-Pyramid Scheme Act 1993
9	Services	Legal, audit, accountancy, engineering and architecture practices; retail and wholesale dealing; private employment agencies
10	Real estate	Licensed housing developers in Peninsular Malaysia, Sabah and Sarawak
11	Utilities	Seventeen named electricity and water entities
12	Pawnbroker	Licensees under the Pawnbrokers Act 1972
13	Moneylender	Licensees under the Moneylenders Act 1951

Classes 12 and 13 arrived with P.U.(A) 326/2016. No third class order has ever been gazetted — a full enumeration of the AGC subsidiary legislation index for the Personal Data Protection Act returns seven instruments, the most recent being the Appeal Tribunal Regulations of 2021.

Fees and mechanics

Registration fees under P.U.(A) 337/2013 are RM100 for a sole proprietor registered under ROBA 1956, RM200 for a partnership, RM300 for a private company and RM400 for a public company. Renewal matches the registration fee; a replacement certificate is RM30 and a certified copy RM10 per sheet.

A controller belonging to two or more classes must apply separately for each, with a fee each time. Regulation 4 makes the certificate valid for not less than twelve months. Section 17(1) requires a renewal application not later than 90 days before expiry, and bars renewal entirely once the certificate has expired.

Processing without a certificate when you belong to a class is RM500,000 or three years or both under s.16(4). Continuing to process after expiry is RM250,000 or two years under regulation 5(2).

Class 9(b) is an open question, not a settled exclusion

The only class that could reach a general online seller is 9(b): a company registered under the Companies Act 1965, or a person who entered into partnership under the Partnership Act 1961, who conducts retail dealing and wholesale dealing as defined under the Control of Supplies Act 1961.

Three points pull in different directions, and no published JPDP interpretation resolves them.

Against a narrow reading: the Control of Supplies Act definitions of retail dealing and wholesale dealing are not limited to controlled articles. On their face they describe ordinary selling by quantity, so the cross-reference does not automatically confine 9(b) to price-controlled goods.

For a narrow reading: 9(b) says retail dealing and wholesale dealing. Read conjunctively, it captures only a business doing both — which excludes a pure online retailer.

A hard limit either way: 9(b) reaches only companies and Partnership Act partnerships. A sole proprietorship registered under ROBA 1956 sits outside class 9(b) entirely, whatever the answer on the conjunction — even though the fee schedule prices sole proprietors at RM100 for the classes they can fall into.

A further loose end: classes 9(a) to 9(c) still cite the Companies Act 1965, repealed in 2017 and never updated in the order.

Anyone telling you flatly that online retailers do not register is stating a conclusion the gazette does not support. Anyone telling you they must is doing the same. Treat it as unresolved, take advice on your facts, and note that registration status changes nothing about your s.12A and s.12B duties, which bind every data controller.

Common mistakes

Assuming no registration means no obligations. The DPO duty and the 72-hour breach clock apply to every data controller.

Registering once for multiple classes. Regulation 3(2) requires a separate application and fee for each.

Missing the 90-day renewal window. Section 17(1) closes it absolutely at expiry; there is no late renewal, only a fresh application.

What’s next

Check your licences first — most classes key off a licence under another statute, so if you hold none of those you are probably outside the other twelve classes. Then form a documented view on the class 9(b) question if you sell goods, and register through SPDP at daftar.pdp.gov.my if you conclude you are in.