Neither Malaysia nor Indonesia has a dedicated AI law in force yet, so AI governance in both countries rests mainly on data protection law: Malaysia’s amended PDPA 2010, with mandatory breach notification and data protection officers since June 2025, and Indonesia’s Personal Data Protection Law, whose obligations have applied since October 2024. Each country also has voluntary AI ethics guidance and draft AI rules on the way. Malaysia’s AI Governance Bill is expected in Parliament in early 2027, and Indonesia has drafted presidential regulations on AI ethics and a national AI roadmap. Organisations operating in either market should build AI governance on their data protection programme now and train employees to use AI within it.
This guide is for CISOs, DPOs, compliance heads and L&D leaders at enterprises, banks and multinationals operating in Malaysia, Indonesia or both.
Malaysia: PDPA 2010 after the 2024 amendments
The Personal Data Protection (Amendment) Act 2024 came into force in three phases during 2025:
| Date | What changed | Why it matters for AI |
|---|---|---|
| 1 January 2025 | Administrative changes, such as electronic service of notices | Little direct impact |
| 1 April 2025 | “Data user” becomes “data controller”; biometric data becomes sensitive personal data; data processors are directly bound by the security principle; maximum penalties rise to RM1 million and/or three years’ imprisonment; the cross-border transfer whitelist is replaced | AI vendors processing your data now carry their own security duty; biometric AI uses need sensitive data handling |
| 1 June 2025 | Mandatory data protection officer (DPO) appointment, mandatory data breach notification and a new right to data portability | A prompt or upload that exposes personal data can be a notifiable breach |
The Personal Data Protection Commissioner’s guidelines add the operational detail. A data breach must be notified to the Commissioner as soon as practicable and within 72 hours, and to affected individuals within seven days of notifying the Commissioner where the breach is likely to cause significant harm. A DPO is required where an organisation processes personal data of more than 20,000 individuals, sensitive personal data (including financial information) of more than 10,000 individuals, or carries out regular and systematic monitoring of personal data.
For AI, the practical message is clear. An employee pasting a customer file into a public chatbot is not just a policy breach; it may be a personal data breach with a 72-hour clock. Your DPO and incident team need to recognise AI-related exposure as an incident type.
The National Guidelines on AI Governance and Ethics (AIGE)
The Ministry of Science, Technology and Innovation (MOSTI) launched the voluntary National Guidelines on AI Governance and Ethics in September 2024. They set out seven principles: fairness; reliability, safety and control; privacy and security; inclusiveness; transparency; accountability; and the pursuit of human benefit and happiness. The guidelines address three groups: AI end users, policymakers in government and organisations, and designers, developers and technology providers. They are not binding, but they are the clearest statement of what Malaysian regulators mean by responsible AI.
The AI Governance Bill
Malaysia’s National AI Office ran a public consultation on a draft AI Governance Bill in July 2026. The draft is risk-based and proposes duties for AI developers and deployers and a central AI authority. In September 2026 the Digital Minister said the draft was complete and being submitted to Cabinet, and in October 2026 he indicated it would be tabled in the Dewan Rakyat early in 2027. Until it is passed, its obligations are proposals, but the direction is plain: documented risk management and accountability for AI systems.
Bank Negara Malaysia
In August 2025, Bank Negara Malaysia (BNM) issued a Discussion Paper on Artificial Intelligence in the Malaysian Financial Sector, with feedback closing in October 2025. The paper is exploratory rather than binding. Commentators read it as signalling that BNM’s existing technology-neutral framework, including its Risk Management in Technology (RMiT) policy, continues to apply to AI, while BNM considers how to embed responsible AI principles across the AI lifecycle. Financial institutions should treat AI as already within scope of their technology risk management.
Indonesia: the PDP Law and AI ethics guidance
Law No. 27 of 2022 on Personal Data Protection
Indonesia’s PDP Law was enacted in October 2022 with a two-year transition, so its obligations have applied since October 2024. Several provisions bear directly on AI:
- Data subjects have the right to object to decisions based solely on automated processing, including profiling, that have legal or similarly significant effects.
- Controllers must carry out a data protection impact assessment for high-risk processing.
- Controllers must notify data subjects and the authority of a failure to protect personal data within 3 x 24 hours.
- DPOs are required in specified circumstances, such as large-scale or systematic processing.
The implementing regulation, GR 33 of 2026
Indonesian law firms report that Government Regulation No. 33 of 2026 on the implementation of the PDP Law was promulgated on 16 July 2026, with a six-month transition before administrative sanctions apply from 16 January 2027. Reported clarifications include that a DPO is needed when any one of the statutory conditions is met, that the 72-hour breach clock starts once a failure is established on reasonable grounds, and that new technology such as AI and machine learning is listed as a DPIA trigger. At the time of writing, the regulation had circulated among practitioners but had not been formally published by the State Secretariat, and the independent PDP supervisory agency, to be set up by presidential regulation, had not been formally established. Check the authenticated text before relying on specific articles.
Indonesia’s AI ethics circular and draft AI regulations
On 19 December 2023, the Minister of Communication and Informatics issued Circular Letter No. 9 of 2023 on Artificial Intelligence Ethics, addressed to public and private electronic system operators. It sets out values of inclusivity, accessibility, security, humanity, and credibility and accountability. The ministry, now the Ministry of Communication and Digital Affairs (Komdigi), announced in July 2026 that it had finished drafting presidential regulations on AI ethics and a national AI roadmap. Check whether they have been signed before treating them as binding.
OJK’s expectations for banks
On 29 April 2025, Indonesia’s Financial Services Authority (OJK) launched the Indonesian Banking Artificial Intelligence Governance guideline. OJK describes it as a minimum reference for banks developing and using AI across the AI lifecycle, built on principles of trustworthy AI such as accountability, transparency, explainability, data privacy, security and human oversight. It complements OJK’s existing rules on banks’ use of information technology. AccuroAI’s AI governance for financial services helps banks in both markets show these controls working in practice.
A practical framework for organisations in both markets
Because the rules converge on the same core (lawful processing, security, transparency, accountability and human oversight), one programme can cover both countries.
- Inventory AI use. List approved and unapproved AI tools, AI features inside existing software and any automated decisions about individuals.
- Classify by risk. Flag AI uses that involve sensitive personal data, biometrics, profiling or decisions with legal or significant effects. These need a DPIA under Indonesian law and are the likely focus of Malaysia’s future bill.
- Set clear data rules. Publish an AI acceptable use policy that names approved tools and bans personal and confidential data in public AI tools.
- Enforce at the prompt. Policy alone does not stop a rushed employee. Our partner AccuroAI’s prompt DLP detects personal data before it reaches an AI model and warns, redacts or blocks it.
- Update incident response. Add AI data exposure as an incident type, and align it with Malaysia’s 72-hour and seven-day notification windows and Indonesia’s 3 x 24 hour rule.
- Map to the ethics principles. Use AIGE and the Indonesian circular as your responsible AI baseline, and document how each principle is met.
- Train by role. Give every employee practical rules through Safe AI at Work, give DPOs, legal and compliance teams deeper AI Governance & Compliance training, and use the AI-Ready Organisation programme for a company-wide roll-out.
To see where your gaps are before you start, AccuroAI’s AI governance readiness assessment gives compliance and security teams a structured baseline.
Frequently asked questions
Does Malaysia have an AI law?
Not yet. Malaysia’s AI Governance Bill was consulted on in July 2026 and is expected to be tabled in Parliament in early 2027. Until then, the PDPA, sector rules and the voluntary AIGE guidelines apply.
Is an AI data leak a notifiable breach under Malaysia’s PDPA?
It can be. If personal data is exposed through an AI tool in a way that amounts to a personal data breach, the controller must notify the Commissioner within 72 hours, and affected individuals within seven days of that notice where significant harm is likely.
Do Indonesian companies need a DPIA for AI?
The PDP Law requires a DPIA for high-risk processing, including automated decisions with legal or significant effects. GR 33 of 2026 is reported to list new technology such as AI and machine learning as a DPIA trigger, so most material AI deployments should be assessed.
Are Indonesia’s AI ethics rules binding?
Circular Letter No. 9 of 2023 is guidance on ethical values rather than a binding regulation with sanctions. Presidential regulations on AI ethics and a national AI roadmap have been drafted; check their status before relying on them.
Can one AI governance programme cover both countries?
Yes. Build on a shared core of AI inventory, risk classification, data rules, prompt-level controls, incident response and training, then add country-specific notices, notification timelines and sector requirements from BNM or OJK.
Build responsible AI capability across both markets
Product Innovation Academy delivers corporate AI governance, AI security and AI literacy training for organisations in Malaysia and Indonesia, with AI Security & Governance programmes run in partnership with AccuroAI. We tailor each programme to the PDPA, the PDP Law, sector rules and the tools your teams use. Request a proposal to get started.
Sources
- DFDL, “Malaysia: Implementation of the Personal Data Protection (Amendment) Act 2024”. dfdl.com
- Baker McKenzie InsightPlus, “Malaysia: Personal Data Protection (Amendment) Act 2024 to come into force”. bakermckenzie.com
- DLA Piper Privacy Matters, “Malaysia: Guidelines issued on data breach notification and data protection officer appointment”, March 2025. privacymatters.dlapiper.com
- Rahmat Lim & Partners, “National Guidelines on Artificial Intelligence Governance and Ethics: Key Principles”, 28 November 2024. rahmatlim.com
- Baker McKenzie, “Malaysia: Public Consultation on the AI Governance Bill”, July 2026. bakermckenzie.com
- The Star, “AI Governance Bill expected to be tabled in Parliament by Q1 2027 at the latest, says Gobind”, 10 September 2026. thestar.com.my
- Free Malaysia Today, “AI Governance Bill delayed to early next year”, 5 October 2026. freemalaysiatoday.com
- Bank Negara Malaysia, “Discussion Paper on Artificial Intelligence in the Malaysian Financial Sector”, 5 August 2025. bnm.gov.my
- Halim Hong & Quek, “Bank Negara Malaysia’s Discussion Paper: Artificial Intelligence in the Malaysian Financial Sector”. hhq.com.my
- Assegaf Hamzah & Partners, “PDP Law Updates: The PDP Implementing Regulation Is Out, and It Clarifies Some Key Questions Under Indonesia’s PDP Law”, 2026. ahp.id
- PPC Land, “Indonesia’s data law faces court test with DPA rules still two months away”, 10 August 2026. ppc.land
- Gizmologi, “Isi Surat Edaran Menkominfo Tentang Etika Kecerdasan Buatan” (summary of Circular Letter No. 9 of 2023). gizmologi.id
- Digital Policy Alert, “Indonesia: Ministry of Communication and Digital Affairs announced completion of drafting of Presidential Regulation to govern Artificial Intelligence utilisation”, July 2026. digitalpolicyalert.org
- Otoritas Jasa Keuangan, “Indonesia Artificial Intelligence Governance for Banking”, April 2025. ojk.go.id