AI and PDPA in Malaysia: What Your AI-Powered Website Must Tell Customers
Key takeaways
- If your website uses AI to process customer data — a quoting bot, an AI-assisted booking form, automated replies — Malaysia’s PDPA already expects you to tell customers plainly that AI is involved, not bury it in generic wording.
- Malaysia’s PDPA, amended in 2024 with obligations effective 1 June 2025, requires disclosing what data is collected and why, including when AI is doing the processing — vague statements no longer cut it.
- Singapore’s regulator made a version of this an explicit, named requirement on 20 July 2026. It isn’t Malaysian law, but it’s a useful reference for how specific a good AI notice should be.
- Breaching the PDPA can mean fines up to RM500,000 and up to three years’ imprisonment.
If you run a Malaysian business on an AI-powered website — a quoting bot for logistics enquiries, an AI-assisted booking form, automated customer replies — the practical starting point isn’t a regulatory announcement, it’s your own customers: they should be able to tell, plainly, when an AI system is collecting or using their data. Malaysia’s own Personal Data Protection Act (PDPA), amended in 2024 with new obligations that took effect on 1 June 2025, already requires this kind of disclosure. Singapore’s Personal Data Protection Commission (PDPC) separately finalised a more specific, named version of this requirement on 20 July 2026 — it isn’t Malaysia’s law, but it’s a useful benchmark for how clearly that disclosure should be worded.
What Malaysia’s PDPA already requires today
Malaysia doesn’t yet have a codified “AI-specific notification” clause the way Singapore now does. But the PDPA’s general notice obligations already bite here. Businesses processing Malaysian citizens’ personal data — including through AI tools — are expected to tell visitors what’s collected and why, and to flag when AI is involved in that processing, particularly for chatbots gathering personal data before or during a conversation. A generic “we use your data to improve our services” line is treated as inadequate; the disclosure needs to actually describe the AI use.
The 2024 amendment also brought in obligations that matter directly to any business running a customer-facing AI feature:
| Obligation | What it means for your site |
|---|---|
| Mandatory Data Protection Officer (for many organisations) | Someone accountable for how your AI features and forms handle personal data |
| Mandatory breach notification | You must notify the Commissioner, and affected individuals if harm is likely, following a data breach |
| Data portability right | Customers can request their data be moved to another provider |
| Clear disclosure of AI involvement | Chatbots and AI features need to say so, not hide behind vague wording |
Where this is heading — and why it’s worth acting now, not waiting
Discussion of amendments addressing algorithmic decision-making and automated profiling more explicitly has been ongoing, alongside Bank Negara Malaysia’s updated technology risk guidance, which now references AI-related risk directly for financial services. None of this is finalised the way Singapore’s rule now is. But you don’t need to wait for a Malaysian regulator to make it official before you start telling customers plainly that AI is collecting or processing their data — that’s already what the PDPA’s existing disclosure duty asks of you, and Singapore’s clearer, named version of the same idea (specific AI notice, no mandatory opt-out, no service refusal for declining, exemption for anonymised data) is a handy reference for how to word it well.
What this looks like for a logistics or SME site
For the kind of sites we build and manage — freight quoting tools, booking forms, WhatsApp-integrated enquiries, AI chat widgets answering shipment questions — the practical checklist is short:
- State plainly, near your quote form or chat widget, that AI is used to process the enquiry and what data it uses (e.g. shipment details, contact info, payment method selection via FPX or DuitNow).
- Update your privacy policy to name the AI feature specifically, rather than folding it into general “service improvement” language.
- Confirm whether your business needs a designated Data Protection Officer under the 2024 amendment.
- Have a breach-notification process ready, even a simple one, given this is now a mandatory obligation.
Why this matters more for an AI-managed website
An AI website subscription like 8WEB.AI’s is built around handling exactly this kind of ongoing upkeep — security patches, hosting, backups, and content — for one predictable monthly fee, rather than a one-off build you’re left to maintain alone. Data-use disclosure belongs in that same bucket: something that gets kept current as part of the subscription, not a page that gets written once at launch and forgotten while the regulatory ground shifts underneath it.
Frequently asked questions
Does Malaysia legally require AI training disclosure notices like Singapore now does?
Not in the same codified form yet. Malaysia’s PDPA already requires disclosing AI involvement in data processing generally, and further AI-specific amendments are reportedly under discussion.
What must my privacy policy say if my website uses an AI chatbot?
It should specifically state that AI is involved, what data it uses, and why — generic “we use data to improve services” wording isn’t considered sufficient.
What are the penalties for non-compliance under the PDPA?
Up to RM500,000 in fines and up to three years’ imprisonment for serious breaches, on top of newer duties like mandatory breach notification.
Do logistics or SME websites need a Data Protection Officer?
Many organisations now do, under the PDPA Amendment 2024 which took effect 1 June 2025 — whether it applies to you depends on the scale and sensitivity of data you process.
Will 8WEB.AI handle this for my subscription website?
Yes — a clear AI/data-use notice is built into onboarding, and kept current as part of your managed subscription.
Let your website subscription handle this too
8WEB.AI’s managed AI website subscription includes design, hosting, security and a compliant AI-data notice built in from day one — one monthly fee, launched in 3–5 working days, with no separate agency to chase for updates.