PDPA for loan agents: the basics

Does the PDPA apply to a small loan agency?

Yes. The Act applies to any person who processes personal data, or who controls or authorises the processing of it, in respect of commercial transactions. The Act's own definition of a commercial transaction includes financing, banking, insurance and agency. Loan advisory sits inside that. The text of the Act has no size limit, so a one-person agent has the same duties as a large firm.

Since the 2024 amendment, the Act calls the firm that decides how data is used the data controller. It used to say data user. A supplier that handles data only on your behalf, such as a CRM or cloud provider, is a data processor. The PDPC's security standard expects you to bind a processor by contract, and since 1 April 2025 the processor has its own duty to keep the data secure.

If you work with freelance agents, who counts as controller and who as processor depends on the facts. An agent who uses your leads only on your instructions looks like your processor. An agent who also uses the data for their own business may be a controller in their own right. Put the arrangement in writing and ask a lawyer, because the answer decides who is responsible when something goes wrong.

Some kinds of business must also register with the PDPC. The classes are listed in an Order and include licensed banks, licensed insurers and moneylenders licensed under the Moneylenders Act 1951. If your firm is not in a listed class, the Act says you do not have to register, but every other part of it still applies. Check the current list on the PDPC site. The PDPC's circular in force from 1 June 2026 explains the process for those who must register.

What counts as personal data in a loan office

Personal data is information about a person who can be identified from it, held on a computer or in a paper file that is organised so that one person's details are easy to find. In your work that covers more than the obvious:

• Names and phone numbers on a lead list, including old and bought lists.
• IC numbers and IC copies.
• Payslips, EPF statements, bank statements and loan application forms.
• WhatsApp chats and call recordings in which a customer can be identified.
• Credit reports you hold for a customer.

Credit reports need one note. The Act does not cover information that a credit reporting agency such as CTOS or Experian processes for its own credit reporting business, because the Credit Reporting Agencies Act 2010 governs that. A copy of the report sitting in your office is different. You are holding it in a financing transaction, so the PDPA applies to how you handle it. If your situation is unusual, ask a lawyer where the line falls.

A smaller group is sensitive personal data: information about a person's health, political opinions, religious beliefs, or actual or alleged offences, and, since 1 April 2025, biometric data. A medical bill handed over as proof of expenses is health information. Sensitive data needs the person's explicit consent unless a listed exception applies.

The seven principles in loan office terms

The exceptions to consent are narrow. They do not obviously cover sending marketing messages or passing a lead to someone else. If you rely on an exception, write down which one and why, and ask a lawyer.

Keep proof of consent. The Regulations say consent must be taken in a form that can be recorded and kept, and that the burden of proving it lies on you. If the consent sits inside a form about something else, it must stand out from the rest of the text.

What customers can ask you to do

What it costs to get it wrong

Breaking any of the seven principles is an offence. Until 1 April 2025 the maximum was RM 300,000 or two years in prison, or both. It is now RM 1,000,000 or three years, or both. Other offences carry their own limits, for example up to RM 100,000 or one year for ignoring a written withdrawal of consent.

Responsibility does not stop at the company. If a company commits an offence, its directors, managers and others involved in running it can be charged too. They are treated as guilty unless they prove the offence happened without their knowledge, consent or connivance, and that they took all reasonable precautions and exercised due diligence. A firm is also answerable for what its employees and agents do in the course of their work.

A sensible first month for a small firm

1. Write one short privacy notice in Malay and English, and put it wherever you collect details: the lead form, the WhatsApp opt-in, the application form.
2. Record consent where you can find it again, in your system or on a signed form.
3. List who you share customer data with, such as banks, valuers and referral partners. The Regulations require you to keep this list.
4. Write a short security policy that follows the PDPC's standard. The Regulations require one.
5. Set a retention schedule, so old leads and closed files are reviewed and deleted on purpose.
6. Name the person who takes customer requests and who handles a breach, and check whether you must appoint a data protection officer. See the 2024 PDPA amendment.