Date: 13. 11.2026

A major IT outage, such as a Outlook, Microsoft Teams, Microsoft 365, and Copilot disruption, can trigger obligations under the Personal Data Protection Act 2010 (“PDPA”). The 72-hour breach notification clock may start even if nothing was hacked. This alert sets out what data controllers should assess and do, based on the PDPA as amended in 2024 and the Commissioner’s Guideline on Data Breach Notification issued on 25 February 2025 (“DBN Guideline”).

Is an outage a personal data breach?

It can be. The PDPA defines a “personal data breach” as breach of personal data, loss of personal data, misuse of personal data or unauthorized access of personal data. The DBN Guideline extends this to any event or incident that leads or is likely to lead to such a breach and it is not limited to modification, duplication, alteration or destruction.

An outage that corrupts, deletes or leaves personal data unrecoverable is likely to be a “loss”. A short outage where the data stays intact is less clear. Treat it as a breach to be assessed, not something to dismiss.

When is a personal data breach notifiable?

A personal data breach is notifiable to Personal Data Protection Commissioner (“PDP Commissioner”) in two situations:

  • Significant harm. Where the breach causes, or is likely to cause, physical harm, financial loss, negative effect on credit records or damage to or loss of property, misuse for illegal purposes, involves sensitive personal data or involves personal data and other personal information which, when combined, could potentially enable identity fraud. The data controller must notify both PDP Commissioner and the affected data subjects.
  • Significant scale. Where the breach affects more than 1,000 data subjects, the data controller must notify the PDP Commissioner only. Notification to affected data subjects is not required.

Cyber incident or personal data breach?

Not every cyber incident constitutes a personal data breach, and not every personal data breach constitutes a cyber incident. They are governed by different laws, with different regulators and deadlines, so an incident should therefore be assessed under both regimes where relevant.

Personal data breachCyber security incident
LawPDPA and the DBN GuidelineCyber Security Act 2024 and the Cyber Security (Notification of Cyber Security Incident) Regulations 2024
What it coversAny incident that causes or is likely to cause a breach, loss, misuse or unauthorised access of personal dataAn act or activity carried out on or through a computer or computer system, without lawful authority, that jeopardizes or adversely affects the cyber security of that computer or computer system or another computer or computer system
Who must notifyEvery data controllerOnly designated National Critical Information Infrastructure (“NCII”) entities
Who must be notifiedThe PDP Commissioner, and where the breach causes or is likely to cause significant harm, the affected data subjectsThe Chief Executive of the National Cyber Security Agency (“NACSA”) and the NCII sector lead
Notification DeadlinePDP Commissioner: As soon as practicable and no later than 72 hours after the occurrence of the personal data breach. Affected data subjects: Without unnecessary delay and no later than 7 days after the initial notification to the Commissioner.Initial notification: Immediately upon the NCII Entity becoming aware of the incident. Incident particulars: Within 6 hours from the time the incident comes to the knowledge of the NCII Entity. Supplementary information: Within 14 days after the initial notification.

First, assess whether the outage is a cyber security incident

For a designated NCII Entity:

  • Assess whether the outage involves an act or activity carried out without lawful authority that jeopardises or adversely affects the cyber security of the NCII it owns or operates.
  • If a cyber security incident has or might have occurred in respect of its NCII, notify the Chief Executive of NACSA and the relevant NCII sector lead immediately. Do not delay notification pending completion of the investigation.

Next, check whether personal data is involved

Ask IT and your Data Protection Officer (“DPO”):

  • Did the affected systems hold personal data?
  • Was any of it accessed, copied, altered, deleted or corrupted?
  • Can the affected data be fully restored from backup, and when?
  • Are there signs of unauthorised access, such as unusual log-ins, data exfiltration or malware?

If personal data is involved

  • Follow the PDPA steps below. The 72-hour clock runs from the occurrence of the personal data breach.
  • If you are an NCII entity, notify NACSA and the relevant NCII sector lead in parallel. The NACSA notice does not replace notifying the PDP Commissioner, and the PDP Commissioner’s notice does not replace NACSA’s.
  • Make sure the facts and information provided to the two regulators, affected data subjects and customers are consistent.

If no personal data is involved

  • No PDPA notification is needed to the Commissioner or to data subjects.
  • However, record your assessment, the evidence behind it, and who made the decision. If you later find that data was affected, the 72-hour clock starts from the occurrence of the personal data breach.
  • If you are an NCII entity, you must still notify NACSA of a cyber security incident.
  • Check your sector-specific rules, such as Bank Negara Malaysia (BNM)’s Risk Management in Technology (RMiT) Policy, Securities Commission (SC)’s guidelines, and Bursa Malaysia’s disclosure of material information, where applicable.
  • Deal with the business side: contractual notices, insurer notification, and messages to customers.
  • Contain the incident, remedy the root cause, and review the effectiveness of existing security controls.

What to do if personal data is involved

  1. Detect and escalate
    1. Escalate any suspected or actual breach at once through your set channels, whether or not it is confirmed. An outage alert or a vendor notice counts.
    2. Log the first details: time, type of data, systems and people involved.
    3. The DPO starts the formal incident response process.
  2. Investigate and assess the risk
    1. IT, the affected business units and legal establish the facts, scope and root cause.
    2. Identify what personal data is involved and how sensitive it is.
    3. Assess how likely and how severe the harm to data subjects could be. The DPO makes sure findings and decisions are documented.
  3. Contain and mitigate
    1. Stop or limit further unauthorised access, use or disclosure. Isolate affected systems and suspend compromised log-ins.
    2. Recover data where you can and put temporary safeguards in place.
    3. Reduce the harm to affected individuals, and check that the measures worked.
  4. Notify and communicate
    1. The PDP Commissioner: notify if there is significant harm or the breach is of significant scale. Do it as soon as practicable and no later than 72 hours after the breach. If you are late, send a written notice with your reasons and supporting evidence together with the notification. You can file online at pdp.gov.my, email the Annex B form to dbnpdp@pdp.gov.my, or submit a hard copy.
    2. Data subjects: notify only if there is significant harm (scale alone is not enough). Do it without unnecessary delay and within 7 days of notifying the PDP Commissioner. Notify each person directly and in plain language, so they can take steps to protect themselves. If that is not practicable or would take disproportionate effort, you can use other means. Say what happened, the likely consequences, what you have done, what they can do to protect themselves, and how to contact your DPO.
    3. Other authorities: the police (PDRM) if a crime is involved; sector regulators such as BNM, the SC or Malaysian Communications and Multimedia Commission (MCMC); NACSA and your sector lead if you are an NCII entity.
    4. Processors: you as data controller should notify, not the data processor. Check and if relevant, rely on your contract to get prompt notice and help from the data processor.
  5. Document and review
    1. Finalise the investigation and incident reports, and record why you decided as you did.
    2. Update your breach register. Keep it for at least 2 years from the date of notification, including breaches that did not meet the notification thresholds.
    3. Identify the lessons learned and the steps to prevent a repeat.

Failing to notify as required is an offence, punishable by a fine of up to RM250,000, up to 2 years’ imprisonment, or both.

Before the next outage

  • Update your data processing agreements. The DBN Guideline expects controllers to bind processors by contract to notify them promptly of a breach and give all reasonable help.
  • Cover outages in your breach response plan. Name who decides whether there is a breach and who files with the Commissioner, and prepare template notices. Test the plan.
  • Involve your DPO. Make the DPO part of IT incident escalation from the start.

How we can help

We can help you assess whether an incident is notifiable, prepare filings for the Commissioner and notices to data subjects, and review your processor contracts and breach response plan. If there is any question, please reach out to us at general@wenlaw.co

This alert is for general information only and is not legal advice. Please seek specific advice on your circumstances.