PDPA compliance for psychologists in Malaysia

The notes and records a psychologist or counsellor keeps are among the most sensitive personal data anyone handles. Malaysia's Personal Data Protection Act 2010, as amended, is what governs how you're expected to handle it — and the amendments have been changing the practical detail in phases since the start of 2025.

What changed, and when

The amended Personal Data Protection Act 2010 (PDPA) has been coming into force in phases starting 1 January 2025. Rather than a single cut-over date, different obligations have taken effect at different points, which makes it worth checking the current state of the rollout rather than assuming everything changed at once.

The cross-border transfer rules changed on 1 April 2025

One of the most practically significant changes: from 1 April 2025, the regime for transferring personal data outside Malaysia moved away from the old model of a fixed "whitelist" of approved countries. In its place is an adequacy and transfer-impact-assessment (TIA) approach — you assess whether the destination offers comparable protection, with standard contractual clauses or binding corporate rules available as alternative safeguards where a straightforward adequacy finding isn't available. If your practice uses any software or service that stores or processes client data outside Malaysia — including cloud-based practice management software — this is the framework that now applies to that transfer.

No general data-localisation requirement — but check your sector

There is no general requirement under the PDPA to keep personal data physically inside Malaysia. That said, sectoral regulators, including in healthcare, can impose stricter conditions on top of the general PDPA framework. If part of your practice sits within a regulated healthcare context, it's worth checking whether any sector-specific rules add requirements beyond the general PDPA position, rather than assuming the general rule is the whole picture.

A practical PDPA checklist for a psychology or counselling practice

1. 1
   Lawful basis and clear client consent. Be clear, and make it clear to the client, what data you collect, why, for how long, and what rights they have — set out in writing at the start of the work.
2. 2
   Encryption in transit and at rest. Notes and files should be encrypted both while moving between systems and while stored.
3. 3
   Know exactly where your data is hosted, and confirm any software you use can tell you plainly, rather than vaguely, where client data sits.
4. 4
   If data leaves Malaysia, document the transfer basis — adequacy, a transfer impact assessment, or contractual safeguards such as SCCs or BCRs.
5. 5
   Access control. Only people who need to see a record should be able to — enforced by the system, not just by agreement.
6. 6
   A written retention policy. Decide, and document, how long you keep records and why, rather than keeping everything indefinitely "just in case."
7. 7
   A process for client data-access requests. A clear internal process so you can respond within a reasonable time when asked.
8. 8
   A breach response plan. Know in advance who does what if there's a breach, and check the current PDPA notification requirements that apply to your practice.
9. 9
   Check for sector-specific healthcare rules that may sit on top of the general PDPA position for your particular registration.

What good software takes off your plate

Software built with data protection in mind resolves much of this checklist by default — encryption, clearly documented hosting, access control and a defensible cross-border transfer position, rather than something you bolt on yourself later. Nerela hosts client data encrypted in the European Union, which is a genuine cross-border transfer under the PDPA's post-April-2025 framework — one it's built to be transparent about, so you can document the basis for it rather than guess.

Bringing it together

Since 1 January 2025 the amended PDPA has been rolling out in phases, and since 1 April 2025 cross-border data transfers run on an adequacy/TIA model rather than a fixed country whitelist, with SCCs or BCRs as an alternative safeguard. There's no general data-localisation rule, but healthcare-sector regulators can add their own conditions. None of this changes the fundamentals of good practice: know where your data lives, document your basis for any cross-border transfer, and keep access tightly controlled.