What are a landlord's and homestay host's PDPA obligations?

Does the PDPA apply to private landlords?

The Act applies to anyone who processes personal data in respect of commercial transactions, meaning any dealing of a commercial nature, including the supply of services ^[1]. Data processed purely for personal, family or household affairs is exempt ^[1].

JPDP states that all individuals and organisations that process personal data must comply with the Act, and reading or accessing information already counts as processing ^[3]. No JPDP document names landlords specifically, but letting a house or room for payment is a supply of services, so we treat the Act as applying.

Identity card numbers, passport numbers, addresses and CCTV images are all personal data ^[3].

What must be done with tenant and guest data?

The Act sets out seven data protection principles ^[1].

• General: collect data that is adequate but not excessive for its purpose ^[1].
• Notice and Choice: give written notice of the purpose, third parties and the right of access, in Bahasa Malaysia and English ^[1].
• Disclosure: do not disclose data for another purpose without consent ^[1].
• Security: take practical steps to protect data from loss or misuse ^[1].
• Retention: do not keep data longer than needed, then destroy or delete it ^[1].
• Data Integrity: make sure data is accurate and up to date ^[1].
• Access: a tenant can ask for access to their data, and the request must be met within 21 days ^[1].

Can I take a copy of an IC or passport?

JPDP does not issue specific guidance on identity card copies. The test that applies is the general principle: data must be adequate but not excessive for its purpose ^[1].

A leaked IC copy is high risk, because the data breach guideline lists data that could enable identity fraud as significant harm ^[6]. Keep copies somewhere controlled, not in a WhatsApp group.

Can I install CCTV in a rental home?

The JPDP FAQ states that a brief CCTV notice, such as surveillance for security, is sufficient ^[3].

The data protection officer guideline lists CCTV as an activity that may count as regular and systematic monitoring ^[7]. The guideline gives no exemption for small operators, so we cannot confirm whether one or two cameras make appointing an officer mandatory.

How long can a former tenant's data be kept?

The Personal Data Protection Standard 2015 asks that data is not kept longer than necessary, unless another law requires it ^[8]. Data collection forms must be disposed of within 14 days unless they have legal value, and inactive data must have a 24-month disposal schedule ^[8].

Tax records have their own retention period set by LHDN, so receipts and agreements needed for tax can be kept longer.

Do landlords need to register with JPDP?

Only the classes of data users listed in the Minister's order must register ^{[1] [4]}. The property class only covers licensed housing developers, and landlords or property agents are not listed ^[4].

Operators of tourist accommodation premises registered under the Tourism Industry Act 1992 fall within the tourism class ^[4]. Since 1 June 2026, Commissioner's Circular 1/2026 makes registration mandatory only for listed classes operating as sole proprietorships, partnerships or companies, with annual fees starting at RM100 ^[5].

Landlords who do not need to register are still bound by all other provisions of the Act ^[3].

What changed with the 2024 PDPA amendments?

The 2024 amendments came into force in stages between 1 January and 1 June 2025 ^[9].

• The term data user was changed to data controller ^[2].
• The maximum fine for breaching the data protection principles rose to RM1,000,000 or three years' imprisonment, effective 1 April 2025 ^{[2] [9]}.
• Since 1 June 2025, a data breach that may cause significant harm must be reported to the Commissioner within 72 hours, and to affected individuals within seven days after that ^{[6] [9]}.
• A data protection officer is mandatory for those processing data of more than 20,000 individuals, more than 10,000 with sensitive data, or carrying out regular and systematic monitoring ^[7].

Frequently asked questions

I only let one room. Does the PDPA apply?

Very likely yes, because it is a paid supply of services ^{[1] [3]}. The exemption is only for personal, family or household affairs ^[1].

Do I need to register and pay JPDP fees as an Airbnb host?

No, unless your premises are registered under the Tourism Industry Act 1992 and you operate as a registered business ^{[4] [5]}.

Does the privacy notice need to be in two languages?

Yes. Written notice under the notice and choice principle must be in Bahasa Malaysia and English ^[1].

I lost my phone with photos of guests' ICs. Do I need to report it?

If it may cause significant harm, such as enabling identity fraud, report it to the Commissioner within 72 hours ^[6].

What is the fine for breaching the PDPA?

Up to RM1,000,000 or imprisonment of up to three years, or both, for breaching the data protection principles ^[2].