Data peribadi dan halaman komuniti — pengenalan PDPA
What personal data an anonymous submission page actually holds, when Malaysia's Personal Data Protection Act applies, what changed in the 2024 amendments, and a practical data-handling routine for a volunteer team.
Also in: Bahasa Melayu · 简体中文 · 繁體中文
This is general information, not legal advice. Whether the Personal Data Protection Act applies to you depends on what you do and in what capacity. The regulator's guidance is published by the Personal Data Protection Department at pdp.gov.my.
Jawapan ringkas. Halaman tanpa nama masih menyimpan data peribadi — kebanyakannya mengenai individu yang dihuraikan dalam penyerahan, serta permintaan pemadaman, mesej langsung dan apa jua data teknikal yang direkodkan oleh alat borang. Akta Perlindungan Data Peribadi 2010 Malaysia terpakai untuk pemprosesan berkaitan transaksi komersial, jadi halaman yang bersifat sukarela mungkin tidak termasuk di bawahnya, manakala halaman yang menjana pendapatan mungkin tidak. Walau apa pun, rutinnya sama: kumpul kurang, simpan kurang, lindungi apa yang tinggal, dan beritahu orang ramai apa yang direkodkan oleh borang tersebut.
"We're anonymous, so we don't hold personal data" is something almost every confession-page admin believes, and it is almost never true. An anonymous page holds a good deal of information about identifiable people. It just isn't, for the most part, about the people who submitted.
This guide looks at what you really hold, when the law applies, and what a sensible routine for handling it looks like.
What you hold
Take an inventory. A typical page has most of the following.
Submissions — published, pending and declined. The author may be anonymous. The content is frequently about third parties: names, descriptions, relationships, accusations, health details. A declined submission that says "[name] in my class has an eating disorder" is sensitive information about an identifiable person, sitting in your queue.
Technical data about submitters. Depending on the tool, this may include timestamps, network addresses or device information. You may never look at it. It may exist nonetheless, in your form tool or in the platform behind it.
Contact details that submitters volunteered. An email address given in order to receive a copy of the submission, or a phone number included "in case the admin needs to verify".
Removal requests. These are, by their nature, messages from an identified person saying "that post is about me". They are among the most sensitive items you hold, because they confirm an identification that the post itself only implied.
Messages to the page. Every direct message arrives with a profile attached.
Commenters and followers. Mostly held by the platform and not by you — but screenshots, exports and ban lists are yours.
Your own team. Names, contact details, and the record of who decided what.
Does the PDPA apply to you?
The Personal Data Protection Act 2010 applies to the processing of personal data in respect of commercial transactions, by persons established in Malaysia or using equipment in Malaysia to process it. It does not apply to the federal or state governments, and it contains an exemption for personal data processed solely for an individual's personal, family or household affairs.
This gives three broad situations.
A purely voluntary page, with no income. There is a reasonable argument that nothing "commercial" is taking place and that the Act does not apply. The argument is not certain, and it is a narrow place to stand.
A page that earns money — sponsored posts, paid promotions, merchandise, paid priority for submissions. Once money changes hands, the "commercial transactions" requirement is far more likely to be satisfied, at least for the data connected with those activities.
A business providing the submission tool. A platform operator is plainly within the Act, as a data controller for some data and as a data processor for data handled on behalf of page admins.
The practical conclusion is the same in all three. Following the Act's principles costs little, protects the people whose information you hold, and means you have nothing to change on the day your page starts to earn.
The principles in one paragraph each
The Act is built on seven Personal Data Protection Principles.
General. Personal data should be processed with the person's consent, for a lawful purpose directly related to what you do, and should not be excessive for that purpose.
Notice and choice. People should be told what is collected, why, who it may be disclosed to, and how they can obtain access to it or limit its use. This is the function of a privacy notice.
Disclosure. Data should not be disclosed for purposes other than those for which it was collected, or to parties other than those people were told about, without consent or another lawful basis.
Security. Take practical steps to protect data against loss, misuse, and unauthorised access or disclosure.
Retention. Do not keep personal data longer than is necessary for the purpose, and destroy it properly when it is no longer needed.
Data integrity. Take reasonable steps to keep data accurate, complete and up to date.
Access. People are entitled to access their personal data and to correct it, subject to exceptions.
Sensitive personal data
The Act gives heightened protection to sensitive personal data, which includes information about a person's physical or mental health, political opinions, religious beliefs, and the commission or alleged commission of any offence. The 2024 amendments added biometric data.
Look at that list again with a confession queue in mind. Health, religion, alleged offences — these are precisely the subjects on which anonymous submissions about other people tend to be written. A page that keeps every declined submission indefinitely is building an archive of sensitive allegations about named members of its own community.
What changed with the 2024 amendments
The Personal Data Protection (Amendment) Act 2024 was brought into force in stages during 2025. The main changes are as follows.
- Terminology. The "data user" became the "data controller".
- Data processors became directly subject to the security principle.
- Mandatory breach notification. Since 1 June 2025, a data controller must notify the Commissioner of a personal data breach, and must notify affected individuals where the breach is likely to cause them significant harm. The Commissioner's guideline sets out the time limits and thresholds — at the time of writing, notification to the Commissioner within 72 hours in qualifying cases, and to affected individuals within seven days after that.
- Data protection officers. Since 1 June 2025, controllers and processors whose processing exceeds thresholds set by the Commissioner must appoint a data protection officer. At the time of writing the published thresholds relate to the number of individuals whose data is processed, with a lower threshold for sensitive data, and to regular and systematic monitoring.
- Data portability. A new right for individuals to request that their data be transmitted to another controller, subject to technical feasibility.
- Cross-border transfers. The earlier approach, based on a list of approved destinations, was replaced with conditions the controller must satisfy.
- Higher penalties for breach of the principles.
Thresholds and time limits are fixed by guidelines, which can be revised. Check the current versions on the regulator's site and do not rely on the figures given here.
A practical routine for a volunteer team
None of this calls for a compliance department. It calls for a few decisions, taken once and then kept to.
Collect less
- Do not ask for a name, an email address or a phone number on the submission form. If the tool offers an optional emailed copy, make sure it is clearly optional.
- Do not ask people who request removal to prove their identity with documents. If a post could plausibly be about them, take it down. You do not need a copy of anyone's identity card and should not want one.
- Turn off any "collect respondent details" setting in your form tool, and check afterwards that it is off.
Keep less
Set retention periods and follow them:
| What | Suggested period | Mengapa |
|---|---|---|
| Declined submissions | 30 days | Long enough to deal with a query; no reason to keep longer |
| Published submissions (queue copy) | Until the post is removed, then 30 days | The live post is the record |
| Removal requests | 12 months after resolution | Shows what was asked and what was done; then delete |
| Direct messages | Clear out every term | The inbox is not an archive |
| Log keputusan | Kekalkan, tetapi tanpa nama di dalamnya | Ia harus menerangkan keputusan, bukan orang |
| Butiran hubungan bekas pentadbir | Padam apabila mereka berhenti, melainkan mereka telah bersetuju untuk kekal sebagai kenalan |
"Padam" bermaksud memadamkannya dalam alat, dalam eksport, dalam tangkapan skrin dalam sembang pasukan dan dalam folder muat turun sesiapa sahaja.
Lindungi apa yang tinggal
- Hadkan akses kepada mereka yang memerlukannya. Bekas pentadbir tidak sepatutnya mempunyai akses.
- Gunakan pengesahan dua faktor pada setiap akaun yang mencapai giliran.
- Jangan salin penyerahan ke dalam sembang peribadi, nota atau dokumen.
- Jangan bincangkan penyerahan yang boleh dikenal pasti di luar kumpulan pentadbir.
- Gunakan peti masuk kongsi yang dikawal pasukan untuk permintaan pemadaman, bukan akaun e-mel peribadi seseorang.
Ketahui siapa lagi yang terlibat
Senaraikan setiap perkhidmatan yang menyentuh data anda — platform borang atau penyerahan, alat penjadualan, pemacu kongsi, aplikasi sembang. Untuk setiap satu, ketahui apa yang disimpannya, berapa lama, dan di mana. Jika alat menghantar penyerahan kepada perkhidmatan pihak ketiga untuk saringan atau terjemahan automatik, itu adalah sesuatu yang perlu diberitahu kepada penghantar anda.
Beritahu orang ramai
Notis ringkas pada borang dan di bahagian Mengenai halaman, dalam bahasa yang mudah difahami, meliputi:
- apa yang borang rekodkan dan tidak rekodkan;
- siapa yang boleh melihat penyerahan yang belum selesai;
- berapa lama penyerahan yang ditolak disimpan;
- perkhidmatan luar mana yang memproses penyerahan;
- cara meminta siaran dipadamkan dan cara menghubungi pentadbir.
Empat atau lima ayat sudah cukup. Lihat Peraturan penulisan untuk halaman tanpa nama untuk tempat meletakkannya.
Mempunyai rancangan untuk hari sesuatu bocor
Pelanggaran, untuk halaman seperti anda, tidak mungkin melibatkan penggodam. Ia lebih cenderung kepada tangkapan skrin giliran yang beredar, bekas pentadbir masih mempunyai akses, kata laluan kongsi, atau telefon yang hilang yang telah log masuk.
Putuskan sekarang:
- Siapa yang perlu diberitahu dalam pasukan, dan siapa yang mengambil alih.
- Bagaimana anda memutuskan akses — tukar kata laluan, keluarkan orang itu, batalkan sesi.
- Bagaimana anda akan mengetahui apa yang terdedah dan siapa yang terlibat.
- Sama ada dan bagaimana anda memberitahu orang yang terjejas. Jika maklumat sensitif seseorang telah terdedah, mereka berhak mendengarnya daripada anda sebelum mereka mendengarnya daripada rakan sekelas.
- Jika Akta terpakai kepada anda, sama ada pelanggaran mesti diberitahu kepada Pesuruhjaya, dan bila.
Requests from individuals
Jika seseorang bertanya apa yang anda pegang tentang mereka, jawab dengan jujur. Bagi kebanyakan orang jawapannya ialah "tiada apa-apa selain mesej anda kepada kami". Jika seseorang meminta anda memadamkan sesuatu tentang mereka — penyerahan dalam giliran, mesej, siaran yang diterbitkan — lakukannya. Anda tidak perlu memutuskan terlebih dahulu sama ada undang-undang mewajibkan anda. Halaman yang tujuan keseluruhannya bergantung pada kepercayaan mempunyai setiap sebab untuk bermurah hati di sini.
The principle behind the paperwork
Segala-galanya dalam undang-undang perlindungan data bermuara kepada soalan yang boleh ditanya oleh pentadbir tanpa membaca statut: jika orang yang maklumat ini tentangnya dapat melihat apa yang kami pegang dan bagaimana kami mengendalikannya, adakah mereka akan menganggapnya munasabah? Untuk kebanyakan apa yang terdapat dalam giliran pengakuan, jawapan jujur ialah "hanya jika anda memadamkannya tidak lama lagi". Jadi padamkannya tidak lama lagi.
Soalan lazim
Adakah halaman pengakuan menyimpan data peribadi jika penyerahan adalah tanpa nama?
Ya. Penulis mungkin tanpa nama, tetapi kandungannya sering kali mengenai pihak ketiga: nama, penerangan, hubungan, tuduhan, butiran kesihatan. Halaman juga menyimpan permintaan pemadaman daripada individu yang dikenal pasti, mesej langsung dengan profil yang dilampirkan, sebarang butiran hubungan yang diberikan secara sukarela oleh penghantar, dan apa jua data teknikal yang direkodkan oleh alat borangnya.
Adakah PDPA terpakai untuk halaman pengakuan pelajar?
Akta Perlindungan Data Peribadi 2010 terpakai untuk data peribadi yang diproses berkaitan transaksi komersial. Untuk halaman yang bersifat sukarela sepenuhnya tanpa pendapatan, terdapat hujah yang munasabah, walaupun tidak pasti, bahawa ia tidak terpakai. Halaman yang menjana wang lebih cenderung untuk dilindungi, dan perniagaan yang menyediakan alat penyerahan jelas termasuk.
Apakah yang dikira sebagai data peribadi sensitif di bawah PDPA?
Maklumat mengenai kesihatan fizikal atau mental seseorang, pandangan politik, kepercayaan agama, dan perlakuan atau dakwaan perlakuan sebarang kesalahan. Pindaan 2024 menambah data biometrik. Ini adalah subjek-subjek yang tepat di mana penyerahan tanpa nama mengenai orang lain cenderung untuk ditulis.
Apakah yang diubah oleh pindaan 2024 kepada PDPA?
"Pengguna data" menjadi "pengawal data"; pemproses data secara langsung tertakluk kepada prinsip keselamatan; pemberitahuan pelanggaran dan, melebihi ambang yang ditetapkan, pelantikan pegawai perlindungan data telah diwajibkan sejak 1 Jun 2025; hak untuk mudah alih data telah ditambah; pemindahan rentas sempadan kini bergantung kepada syarat-syarat yang mesti dipenuhi oleh pengawal; dan penalti telah dinaikkan.
Berapa lama halaman harus menyimpan penyerahan yang ditolak?
Kira-kira 30 hari: cukup lama untuk menangani pertanyaan, tanpa sebab untuk menyimpannya lebih lama. Permintaan pemadaman boleh disimpan selama 12 bulan selepas diselesaikan dan kemudian dipadamkan, dan mesej langsung dibersihkan setiap penggal. Memadam bermaksud memadam dalam alat, dalam eksport, dalam tangkapan skrin dan dalam folder muat turun sesiapa sahaja.
Bilakah pelanggaran data peribadi perlu dilaporkan di Malaysia?
Sejak 1 Jun 2025, pengawal data mesti memberitahu Pesuruhjaya tentang pelanggaran data peribadi, dan mesti memberitahu individu yang terjejas di mana pelanggaran itu berkemungkinan menyebabkan kemudaratan yang ketara kepada mereka. Pada masa penulisan, garis panduan Pesuruhjaya memberikan 72 jam untuk memberitahu Pesuruhjaya dalam kes yang layak dan tujuh hari lagi untuk individu; semak garis panduan semasa, kerana angka-angka ini boleh disemak semula.