1.

My understanding of the Personal Data Protection Act (PDPA) is that it is a law that
regulates the processing of personal data in Malaysia, and aims to protect the rights and
interests of data subjects. The PDPA covers both public and private sectors, and applies to
any person who collects, records, holds, or uses personal data in Malaysia.

2. Some of the new things that I have learned from video and presentation on PDPA are:

a. The PDPA has seven principles that data users must comply with, namely the general,
notice and choice, disclosure, security, retention, data integrity, and access principles.
b. The PDPA establishes a Personal Data Protection Commissioner, who is responsible
for enforcing the PDPA, registering data users, issuing codes of practice, and handling
complaints.
c. The PDPA provides exemptions for certain categories of personal data, such as
personal data processed for personal or domestic purposes, personal data processed for
journalistic, artistic, or literary purposes, and personal data relating to the physical or
mental health of a data subject.

3. Complying with the (PDPA) can be challenging for various reasons such as:

a. The PDPA has seven principles that data users must comply with, which may require
significant investments in information technology and personnel training.
b. The PDPA requires data users to obtain consent from data subjects before processing
their personal data, which can be difficult to obtain, record, and maintain, especially
for online transactions.
c. The PDPA imposes obligations on data users to protect personal data from
unauthorized access, misuse, and loss, which can be compromised by human error,
weak IT security measures, or data breaches.
d. The PDPA applies to both public and private sectors, and covers any person who
collects, records, holds, or uses personal data in Malaysia, which means that data users
have to be aware of the cross-border data transfer restrictions and the exemptions for
certain categories of personal data.