Personal data and community pages — a PDPA primer

This is general information, not legal advice. Whether the Personal Data Protection Act applies to you depends on what you do and in what capacity. The regulator's guidance is published by the Personal Data Protection Department at pdp.gov.my.

Short answer. An anonymous page still holds personal data — mostly about the people its submissions describe, plus removal requests, direct messages and whatever technical data the form tool records. Malaysia's Personal Data Protection Act 2010 applies to processing in respect of commercial transactions, so a purely voluntary page may fall outside it and a page that earns money probably does not. Either way the routine is the same: collect less, keep less, protect what remains, and tell people what the form records.

"We're anonymous, so we don't hold personal data" is something almost every confession-page admin believes, and it is almost never true. An anonymous page holds a good deal of information about identifiable people. It just isn't, for the most part, about the people who submitted.

This guide looks at what you really hold, when the law applies, and what a sensible routine for handling it looks like.

What you hold

Take an inventory. A typical page has most of the following.

Submissions — published, pending and declined. The author may be anonymous. The content is frequently about third parties: names, descriptions, relationships, accusations, health details. A declined submission that says "[name] in my class has an eating disorder" is sensitive information about an identifiable person, sitting in your queue.

Technical data about submitters. Depending on the tool, this may include timestamps, network addresses or device information. You may never look at it. It may exist nonetheless, in your form tool or in the platform behind it.

Contact details that submitters volunteered. An email address given in order to receive a copy of the submission, or a phone number included "in case the admin needs to verify".

Removal requests. These are, by their nature, messages from an identified person saying "that post is about me". They are among the most sensitive items you hold, because they confirm an identification that the post itself only implied.

Messages to the page. Every direct message arrives with a profile attached.

Commenters and followers. Mostly held by the platform and not by you — but screenshots, exports and ban lists are yours.

Your own team. Names, contact details, and the record of who decided what.

Does the PDPA apply to you?

The Personal Data Protection Act 2010 applies to the processing of personal data in respect of commercial transactions, by persons established in Malaysia or using equipment in Malaysia to process it. It does not apply to the federal or state governments, and it contains an exemption for personal data processed solely for an individual's personal, family or household affairs.

This gives three broad situations.

A purely voluntary page, with no income. There is a reasonable argument that nothing "commercial" is taking place and that the Act does not apply. The argument is not certain, and it is a narrow place to stand.

A page that earns money — sponsored posts, paid promotions, merchandise, paid priority for submissions. Once money changes hands, the "commercial transactions" requirement is far more likely to be satisfied, at least for the data connected with those activities.

A business providing the submission tool. A platform operator is plainly within the Act, as a data controller for some data and as a data processor for data handled on behalf of page admins.

The practical conclusion is the same in all three. Following the Act's principles costs little, protects the people whose information you hold, and means you have nothing to change on the day your page starts to earn.

The principles in one paragraph each

The Act is built on seven Personal Data Protection Principles.

General. Personal data should be processed with the person's consent, for a lawful purpose directly related to what you do, and should not be excessive for that purpose.

Notice and choice. People should be told what is collected, why, who it may be disclosed to, and how they can obtain access to it or limit its use. This is the function of a privacy notice.

Disclosure. Data should not be disclosed for purposes other than those for which it was collected, or to parties other than those people were told about, without consent or another lawful basis.

Security. Take practical steps to protect data against loss, misuse, and unauthorised access or disclosure.

Retention. Do not keep personal data longer than is necessary for the purpose, and destroy it properly when it is no longer needed.

Data integrity. Take reasonable steps to keep data accurate, complete and up to date.

Access. People are entitled to access their personal data and to correct it, subject to exceptions.

Sensitive personal data

The Act gives heightened protection to sensitive personal data, which includes information about a person's physical or mental health, political opinions, religious beliefs, and the commission or alleged commission of any offence. The 2024 amendments added biometric data.

Look at that list again with a confession queue in mind. Health, religion, alleged offences — these are precisely the subjects on which anonymous submissions about other people tend to be written. A page that keeps every declined submission indefinitely is building an archive of sensitive allegations about named members of its own community.

What changed with the 2024 amendments

The Personal Data Protection (Amendment) Act 2024 was brought into force in stages during 2025. The main changes are as follows.

• Terminology. The "data user" became the "data controller".
• Data processors became directly subject to the security principle.
• Mandatory breach notification. Since 1 June 2025, a data controller must notify the Commissioner of a personal data breach, and must notify affected individuals where the breach is likely to cause them significant harm. The Commissioner's guideline sets out the time limits and thresholds — at the time of writing, notification to the Commissioner within 72 hours in qualifying cases, and to affected individuals within seven days after that.
• Data protection officers. Since 1 June 2025, controllers and processors whose processing exceeds thresholds set by the Commissioner must appoint a data protection officer. At the time of writing the published thresholds relate to the number of individuals whose data is processed, with a lower threshold for sensitive data, and to regular and systematic monitoring.
• Data portability. A new right for individuals to request that their data be transmitted to another controller, subject to technical feasibility.
• Cross-border transfers. The earlier approach, based on a list of approved destinations, was replaced with conditions the controller must satisfy.
• Higher penalties for breach of the principles.

Thresholds and time limits are fixed by guidelines, which can be revised. Check the current versions on the regulator's site and do not rely on the figures given here.

A practical routine for a volunteer team

None of this calls for a compliance department. It calls for a few decisions, taken once and then kept to.

Collect less

• Do not ask for a name, an email address or a phone number on the submission form. If the tool offers an optional emailed copy, make sure it is clearly optional.
• Do not ask people who request removal to prove their identity with documents. If a post could plausibly be about them, take it down. You do not need a copy of anyone's identity card and should not want one.
• Turn off any "collect respondent details" setting in your form tool, and check afterwards that it is off.

Keep less

Set retention periods and follow them:

"Delete" means deleting it in the tool, in exports, in screenshots in the team chat and in anyone's downloads folder.

Protect what remains

• Limit access to those who need it. A former admin should have none.
• Use two-factor authentication on every account that reaches the queue.
• Do not copy submissions into personal chats, notes or documents.
• Do not discuss identifiable submissions outside the admin group.
• Use a shared, team-controlled inbox for removal requests, not someone's personal email account.

Know who else is involved

List every service that touches your data — the form or submission platform, the scheduling tool, the shared drive, the chat application. For each, find out what it stores, for how long, and where. If a tool sends submissions to third-party services for automated screening or translation, that is something your submitters should be told about.

Tell people

A short notice on the form and in the page's About section, in plain language, covering:

• what the form does and does not record;
• who can see pending submissions;
• how long declined submissions are kept;
• which outside services process submissions;
• how to ask for a post to be removed and how to contact the admins.

Four or five sentences are enough. See Writing rules for an anonymous page for where to put it.

Have a plan for the day something leaks

A breach, for a page like yours, is unlikely to involve hackers. It is more likely to be a screenshot of the queue circulating, a former admin still having access, a shared password, or a lost phone that was logged in.

Decide now:

1. Who needs to be told within the team, and who takes the lead.
2. How you cut off the access — change passwords, remove the person, revoke sessions.
3. How you will work out what was exposed and whom it concerns.
4. Whether and how you tell the people affected. If someone's sensitive information has been exposed, they deserve to hear it from you before they hear it from a classmate.
5. If the Act applies to you, whether the breach must be notified to the Commissioner, and by when.

Requests from individuals

If someone asks what you hold about them, answer honestly. For most people the answer is "nothing other than your message to us". If someone asks you to delete something about them — a submission in the queue, a message, a published post — do it. You do not need to decide first whether the law obliges you to. A page whose entire purpose depends on trust has every reason to be generous here.

The principle behind the paperwork

Everything in data protection law comes down to a question an admin can ask without reading a statute: if the person this information is about could see what we are holding and how we are handling it, would they think it reasonable? For most of what sits in a confession queue, the honest answer is "only if you delete it soon". So delete it soon.

Common questions

Does a confession page hold personal data if submissions are anonymous?

Yes. The author may be anonymous, but the content is frequently about third parties: names, descriptions, relationships, accusations, health details. A page also holds removal requests from identified people, direct messages with profiles attached, any contact details submitters volunteered, and whatever technical data its form tool records.

Does the PDPA apply to a student confession page?

The Personal Data Protection Act 2010 applies to personal data processed in respect of commercial transactions. For a purely voluntary page with no income there is a reasonable, though not certain, argument that it does not apply. A page that earns money is far more likely to be covered, and a business providing the submission tool plainly is.

What counts as sensitive personal data under the PDPA?

Information about a person's physical or mental health, political opinions, religious beliefs, and the commission or alleged commission of any offence. The 2024 amendments added biometric data. These are precisely the subjects on which anonymous submissions about other people tend to be written.

What did the 2024 amendments to the PDPA change?

The "data user" became the "data controller"; data processors became directly subject to the security principle; breach notification and, above set thresholds, the appointment of a data protection officer have been mandatory since 1 June 2025; a right to data portability was added; cross-border transfers now depend on conditions the controller must satisfy; and penalties were raised.

How long should a page keep declined submissions?

About 30 days: long enough to deal with a query, with no reason to keep them longer. Removal requests can be kept for 12 months after they are resolved and then deleted, and direct messages cleared out every term. Deleting means deleting in the tool, in exports, in screenshots and in anyone's downloads folder.

When does a personal data breach have to be reported in Malaysia?

Since 1 June 2025 a data controller must notify the Commissioner of a personal data breach, and must notify affected individuals where the breach is likely to cause them significant harm. At the time of writing the Commissioner's guideline gives 72 hours for notifying the Commissioner in qualifying cases and a further seven days for the individuals; check the current guideline, because these figures can be revised.