Article
IoT Data and PDPA: What Malaysian Businesses Should Know Before Collecting Sensor Data
IoT projects often start with good intentions: protect stock, improve safety, save energy or understand how spaces are used. But many devices also collect information about people. Cameras capture faces. Access systems log who entered and when. Vehicle trackers show where drivers go. Wearables record location and sometimes health-related data. When this information can identify a person, it is personal data.
In Malaysia, the Personal Data Protection Act 2010 sets out how businesses must handle personal data in commercial transactions. This article is a practical overview for SMEs and not legal advice. For your specific situation, consult a qualified adviser and check guidance from the Personal Data Protection Department.
Which IoT data is personal data?
A temperature reading in a freezer is not personal data. A record showing that a specific staff member opened the freezer at 2am is. Common IoT systems that can involve personal data include:
- CCTV and video doorbells
- Access cards, PIN logs and face recognition
- Vehicle and fleet tracking
- Staff wearables and lone worker devices
- Wi-Fi or Bluetooth tracking of visitors' phones
- Smart lockers and visitor management systems
Even sensors that seem anonymous can become personal when combined with other information, such as a desk sensor in a single-person office.
Core principles to keep in mind
The PDPA is built around a set of data protection principles. In plain terms, they ask businesses to:
- Have a lawful purpose and, where required, consent for processing personal data.
- Give people notice about what is collected, why and who it may be shared with.
- Not disclose data for unrelated purposes without proper basis.
- Keep data secure from loss, misuse and unauthorised access.
- Not keep data longer than necessary for the purpose.
- Keep data accurate and complete.
- Allow people to access and correct their data where applicable.
The Act was amended in 2024, with changes that include requirements such as notifying data breaches and appointing a data protection officer for certain organisations. Check current requirements and guidelines, as details and implementation dates matter.
Practical steps before rolling out a project
Before switching on new IoT devices, work through a short checklist:
- Define the purpose: write one sentence explaining why you need the data.
- Collect the minimum: if a motion sensor solves the problem, do not install a camera.
- Tell people: use notices, staff briefings and updated policies.
- Limit access: decide who can view data and footage, and keep the list short.
- Set retention: delete data on a schedule once it is no longer needed.
- Secure the system: change default passwords, update firmware and use strong authentication.
Key takeaway: the cheapest way to manage personal data risk is not to collect personal data you do not need. Design IoT projects to measure spaces and equipment, not individuals, wherever possible.
Staff monitoring needs extra care
Systems that monitor employees can affect trust. Be transparent about what is tracked, when and why. For example, vehicle tracking during working hours for dispatch and safety is easier to justify than tracking personal use after hours. Our guides on asset tracking without spy culture and privacy-respecting safety wearables offer practical approaches.
Biometric data, such as fingerprints or face templates, is especially sensitive. If you use biometric attendance or access, think carefully about necessity, security and alternatives for those who object. Our article on office access control options compares less sensitive choices.
Vendors and cloud platforms
Many IoT systems store data on the vendor's cloud, sometimes outside Malaysia. Ask vendors where data is stored, who can access it, how it is secured and how you can export or delete it. Make sure your contract covers data protection responsibilities. If the vendor processes data on your behalf, you are still responsible for how it is handled.
Handling incidents
If a device is hacked, footage is leaked or a laptop with access logs is lost, act quickly. Contain the problem, assess what data was affected and follow current requirements on breach notification. Having a simple incident plan before anything happens makes this much easier. Our IoT security checklist helps reduce the chance of incidents in the first place.
Building privacy into everyday operations
Privacy is not a one-time task. Review IoT systems annually, remove devices and accounts that are no longer needed, refresh staff training and update notices when you change systems. Small, regular reviews prevent big problems later.
FAQ
Does PDPA apply to small businesses?
The PDPA applies to processing personal data in commercial transactions, which covers many businesses regardless of size. Seek advice for your specific case.
Do I need consent to install CCTV?
Requirements depend on context. At minimum, clear notices and a legitimate purpose are good practice. Consult an adviser for your situation.
How long can we keep footage or logs?
Keep data only as long as needed for its purpose. Set a defined retention period and delete data on schedule.
IoT and privacy can coexist. Collect less, explain more, secure what you keep and delete what you no longer need. That approach protects your customers, your staff and your business.