个人数据与社区页面 — PDPA 初步指南
匿名投稿专页实际持有何种个人数据，马来西亚《个人数据保护法》何时适用，2024年修订案有何变化，以及志愿者团队实用的数据处理流程。
Also in: Bahasa Melayu · 简体中文 · 繁體中文
这是通用信息，并非法律建议。 Whether the Personal Data Protection Act applies to you depends on what you do and in what capacity. The regulator's guidance is published by the Personal Data Protection Department at pdp.gov.my.
简短回答。 匿名页面仍然会保留个人数据——主要是关于其提交内容所描述的人，以及删除请求、私信和表单工具记录的任何技术数据。马来西亚的《2010年个人数据保护法》适用于商业交易中的数据处理，因此纯粹的自愿页面可能不在此范围内，而盈利页面则很可能在此范围内。无论如何，处理流程都是一样的：少收集、少保留、保护剩余数据，并告知人们表单记录了什么。
"We're anonymous, so we don't hold personal data" is something almost every confession-page admin believes, and it is almost never true. An anonymous page holds a good deal of information about identifiable people. It just isn't, for the most part, about the people who submitted.
This guide looks at what you really hold, when the law applies, and what a sensible routine for handling it looks like.
What you hold
Take an inventory. A typical page has most of the following.
Submissions — published, pending and declined. The author may be anonymous. The content is frequently about third parties: names, descriptions, relationships, accusations, health details. A declined submission that says "[name] in my class has an eating disorder" is sensitive information about an identifiable person, sitting in your queue.
Technical data about submitters. Depending on the tool, this may include timestamps, network addresses or device information. You may never look at it. It may exist nonetheless, in your form tool or in the platform behind it.
Contact details that submitters volunteered. An email address given in order to receive a copy of the submission, or a phone number included "in case the admin needs to verify".
Removal requests. These are, by their nature, messages from an identified person saying "that post is about me". They are among the most sensitive items you hold, because they confirm an identification that the post itself only implied.
Messages to the page. Every direct message arrives with a profile attached.
Commenters and followers. Mostly held by the platform and not by you — but screenshots, exports and ban lists are yours.
Your own team. Names, contact details, and the record of who decided what.
Does the PDPA apply to you?
The Personal Data Protection Act 2010 applies to the processing of personal data in respect of commercial transactions, by persons established in Malaysia or using equipment in Malaysia to process it. It does not apply to the federal or state governments, and it contains an exemption for personal data processed solely for an individual's personal, family or household affairs.
This gives three broad situations.
A purely voluntary page, with no income. There is a reasonable argument that nothing "commercial" is taking place and that the Act does not apply. The argument is not certain, and it is a narrow place to stand.
A page that earns money — sponsored posts, paid promotions, merchandise, paid priority for submissions. Once money changes hands, the "commercial transactions" requirement is far more likely to be satisfied, at least for the data connected with those activities.
A business providing the submission tool. A platform operator is plainly within the Act, as a data controller for some data and as a data processor for data handled on behalf of page admins.
The practical conclusion is the same in all three. Following the Act's principles costs little, protects the people whose information you hold, and means you have nothing to change on the day your page starts to earn.
The principles in one paragraph each
The Act is built on seven Personal Data Protection Principles.
General. Personal data should be processed with the person's consent, for a lawful purpose directly related to what you do, and should not be excessive for that purpose.
Notice and choice. People should be told what is collected, why, who it may be disclosed to, and how they can obtain access to it or limit its use. This is the function of a privacy notice.
Disclosure. Data should not be disclosed for purposes other than those for which it was collected, or to parties other than those people were told about, without consent or another lawful basis.
Security. Take practical steps to protect data against loss, misuse, and unauthorised access or disclosure.
Retention. Do not keep personal data longer than is necessary for the purpose, and destroy it properly when it is no longer needed.
Data integrity. Take reasonable steps to keep data accurate, complete and up to date.
Access. People are entitled to access their personal data and to correct it, subject to exceptions.
Sensitive personal data
The Act gives heightened protection to sensitive personal data, which includes information about a person's physical or mental health, political opinions, religious beliefs, and the commission or alleged commission of any offence. The 2024 amendments added biometric data.
Look at that list again with a confession queue in mind. Health, religion, alleged offences — these are precisely the subjects on which anonymous submissions about other people tend to be written. A page that keeps every declined submission indefinitely is building an archive of sensitive allegations about named members of its own community.
What changed with the 2024 amendments
The Personal Data Protection (Amendment) Act 2024 was brought into force in stages during 2025. The main changes are as follows.
- Terminology. The "data user" became the "data controller".
- Data processors became directly subject to the security principle.
- Mandatory breach notification. Since 1 June 2025, a data controller must notify the Commissioner of a personal data breach, and must notify affected individuals where the breach is likely to cause them significant harm. The Commissioner's guideline sets out the time limits and thresholds — at the time of writing, notification to the Commissioner within 72 hours in qualifying cases, and to affected individuals within seven days after that.
- Data protection officers. Since 1 June 2025, controllers and processors whose processing exceeds thresholds set by the Commissioner must appoint a data protection officer. At the time of writing the published thresholds relate to the number of individuals whose data is processed, with a lower threshold for sensitive data, and to regular and systematic monitoring.
- Data portability. A new right for individuals to request that their data be transmitted to another controller, subject to technical feasibility.
- Cross-border transfers. The earlier approach, based on a list of approved destinations, was replaced with conditions the controller must satisfy.
- Higher penalties for breach of the principles.
Thresholds and time limits are fixed by guidelines, which can be revised. Check the current versions on the regulator's site and do not rely on the figures given here.
A practical routine for a volunteer team
None of this calls for a compliance department. It calls for a few decisions, taken once and then kept to.
Collect less
- Do not ask for a name, an email address or a phone number on the submission form. If the tool offers an optional emailed copy, make sure it is clearly optional.
- Do not ask people who request removal to prove their identity with documents. If a post could plausibly be about them, take it down. You do not need a copy of anyone's identity card and should not want one.
- Turn off any "collect respondent details" setting in your form tool, and check afterwards that it is off.
Keep less
Set retention periods and follow them:
| What | Suggested period | Why |
|---|---|---|
| Declined submissions | 30 days | Long enough to deal with a query; no reason to keep longer |
| Published submissions (queue copy) | Until the post is removed, then 30 days | The live post is the record |
| Removal requests | 12 months after resolution | Shows what was asked and what was done; then delete |
| Direct messages | Clear out every term | The inbox is not an archive |
| Decision log | Keep, but with no names in it | 它应该描述决策，而不是人 |
| 前管理员的联系方式 | 除非他们同意继续担任联系人，否则在他们离职时删除 |
“删除”意味着在工具中、导出中、团队聊天中的截图以及任何人的下载文件夹中删除它。
保护剩余内容
- 限制只有需要的人才能访问。前管理员不应拥有任何访问权限。
- 对所有进入队列的账户使用双重认证。
- 不要将提交内容复制到个人聊天、笔记或文档中。
- 不要在管理员群组之外讨论可识别的提交内容。
- 使用共享的、团队控制的收件箱处理删除请求，而不是某个人的个人电子邮件账户。
了解还有谁参与其中
列出所有涉及您数据的服务——表格或提交平台、日程安排工具、共享驱动器、聊天应用程序。对于每个服务，找出它存储了什么、存储多久以及存储在哪里。如果某个工具将提交内容发送给第三方服务进行自动筛选或翻译，您的提交者应该被告知这一点。
告知人们
在表格和页面“关于”部分中，用简单明了的语言提供简短通知，内容包括：
- 表格记录了什么，没有记录什么；
- 谁可以看到待处理的提交内容；
- 被拒绝的提交内容保留多久；
- 哪些外部服务处理提交内容；
- 如何请求删除帖子以及如何联系管理员。
四到五句话就足够了。请参阅 Writing rules for an anonymous page 以了解放置位置。
为数据泄露的那一天做好计划
对于像您这样的页面，数据泄露不太可能涉及黑客。更可能是队列截图流传、前管理员仍有访问权限、共享密码或登录过的手机丢失。
现在决定：
- 团队内谁需要被告知，以及谁负责牵头。
- 如何切断访问——更改密码、移除人员、撤销会话。
- 如何查明泄露了什么以及涉及谁。
- 是否以及如何告知受影响的人。如果某人的敏感信息被泄露，他们应该在同学告诉他们之前从您这里得知。
- 如果该法案适用于您，是否以及何时必须通知专员。
Requests from individuals
如果有人询问您持有关于他们的什么信息，请诚实回答。对于大多数人来说，答案是“除了您发给我们的消息之外，什么都没有”。如果有人要求您删除关于他们的某些内容——队列中的提交、消息、已发布的帖子——请照做。您无需首先决定法律是否强制您这样做。一个其全部目的都依赖于信任的页面，有充分的理由在这里表现得慷慨。
The principle behind the paperwork
数据保护法中的一切都归结为一个管理员无需阅读法规即可提出的问题： 如果这些信息所涉及的人可以看到我们持有和处理这些信息的方式，他们会认为这合理吗？ 对于忏悔队列中的大多数内容，诚实的答案是“只有您尽快删除它”。所以请尽快删除它。
常见问题
如果提交内容是匿名的，告白页面是否会保留个人数据？
是的。作者可能是匿名的，但内容通常涉及第三方：姓名、描述、关系、指控、健康详情。页面还会保留已识别人员的删除请求、附带个人资料的私信、提交者自愿提供的任何联系方式，以及其表单工具记录的任何技术数据。
《个人数据保护法》是否适用于学生告白页面？
《2010年个人数据保护法》适用于商业交易中处理的个人数据。对于没有收入的纯自愿页面，有一个合理但并非确定的论点是它不适用。盈利页面更有可能受其涵盖，而提供提交工具的企业则明确受其涵盖。
根据《个人数据保护法》，什么算作敏感个人数据？
关于一个人的身心健康、政治观点、宗教信仰，以及任何罪行的实施或被指控实施的信息。2024年修正案增加了生物识别数据。这些正是关于他人匿名提交内容倾向于撰写的主题。
2024年《个人数据保护法》修正案改变了什么？
“数据使用者”变为“数据控制者”；数据处理者直接受安全原则约束；自2025年6月1日起，数据泄露通知以及在超过设定阈值时任命数据保护官已成为强制性要求；增加了数据可携权；跨境传输现在取决于控制者必须满足的条件；并且提高了罚款。
页面应将已拒绝的提交内容保留多久？
大约30天：足够处理查询，没有理由保留更长时间。删除请求在解决后可保留12个月，然后删除；私信每学期清理一次。删除意味着在工具中、导出文件、截图和任何人的下载文件夹中都进行删除。
马来西亚何时必须报告个人数据泄露？
自2025年6月1日起，数据控制者必须向专员报告个人数据泄露，并且在泄露可能对受影响个人造成重大损害时，必须通知受影响的个人。截至撰写本文时，专员的指南规定，在符合条件的案件中，需在72小时内通知专员，并在接下来的七天内通知个人；请查阅当前指南，因为这些数字可能会修订。