---

Important Reminder: Protecting Your Customers’ Personal Data

Dear Valued ADAPTIS Merchants,

Protecting customer information and maintaining trust are extremely important to us. As part of our ongoing commitment to data protection and regulatory compliance, we would like to remind all merchants of their responsibilities under Malaysia’s Personal Data Protection Act 2010 (“PDPA”).

What is considered personal data?

Personal data refers to any information that can identify an individual within a commercial context, either directly or indirectly. Examples include:

• Name
• NRIC / identification number
• Phone number
• Email address
• Residential or mailing address

Key PDPA Responsibilities for Merchants

When collecting, storing, or using customers’ personal data, merchants are expected to follow the PDPA’s core principles, including:

• Obtaining customers’ consent before collecting or using their personal data;
• Informing customers how their data will be used or processed;
• Not sharing personal data with third parties without consent, unless permitted by law;
• Putting appropriate security measures in place to prevent unauthorised access, misuse, or loss of data;
• Keeping personal data accurate and up to date;
• Retaining personal data only for as long as necessary and securely disposing of it when no longer needed; and
• Allowing customers to request access to or correction of their personal data.

Customers’ Right to Withdraw Consent

Customers also have the right to withdraw their consent for the processing of their personal data at any time in writing. Upon receiving such a request, merchants are required to cease processing the customers’ personal data unless otherwise permitted under the law.

Data Breach Notification Requirements

In the event of a personal data breach, merchants are required to:

• Notify the Personal Data Protection Commissioner (PDPC) within 72 hours of becoming aware of the breach; and
• Notify affected customers within 7 days after notifying the PDPC.

Why This Matters

Non-compliance with the PDPA may result in significant penalties, including a substantial fine of up to RM1,000,000 (one million ringgit), imprisonment or both. More importantly, strong data protection practices help safeguard your customers’ trust and confidence in your business.


We appreciate your continued cooperation and commitment to maintaining responsible data protection practices.


Thank you.