Malaysia draft says buying AI leaves the data duty with the buyer

Malaysia draft says buying AI leaves the data duty with the buyer

29 October 2026: Malaysia's Personal Data Protection Department has published a draft framework on AI and personal data under Act 709, and its procurement section puts the burden on the organisation buying the tool. Hiring a vendor, it says, does not transfer the controller's responsibility.

Not yet independently verified. This is a consultation draft and binds no one yet. The paper gives no effective or enforcement date, and the department has not said when a final framework will follow. We will update this when it can be confirmed, and remove this note.

What the paper covers

Public Consultation Paper No. 1/2026 went up on the department's site on 29 October. The paper gives a consultation window of 5 to 23 October, so the posting we read came six days after that window closed.

The framework runs to ten parts, A to J, following the AI lifecycle: scope, definitions, legal basis, development and testing, deployment and operation, procurement and external AI, data subject rights, safeguards and fairness, governance and risk management, then documentation and audit. It benchmarks the EU AI Act, the OECD and guidance from regulators in Hong Kong, the Philippines, Singapore and the UK.

Part F is the section for buyers

Before procuring or using an external AI system, the draft says a controller "shall" carry out proportionate due diligence. The checks it lists are:

• The system's purpose and the categories of data involved
• Where its datasets come from
• Whether data is retained, or used for training or fine-tuning
• Sub-processors, cross-border transfers and security measures

The buyer must also define whether the vendor is a processor or a third party, and set arrangements on instructions, breaches and return or deletion at termination. It may ask vendors for model or system cards. Transfers outside Malaysia have to meet section 129 of Act 709, with a Transfer Impact Assessment "where appropriate".

What a software vendor can prepare now

Nothing here binds anyone yet, and no effective or enforcement date is given. Still, the list reads like a questionnaire, and a vendor selling AI features to Malaysian customers could draft its answers before anyone asks. Whether customer data trains the model and which sub-processors touch it are the two answers buyers will want in writing.

Buyers can treat Part F as a checklist for contracts they are signing now, since renewal terms are easier to set than changes made after a final rule arrives. Our vendor management software listings cover tools for tracking those answers, and we recently covered another Malaysian draft, on tax for software payments to non-residents.

Among its questions to stakeholders, the paper asks what transition periods are needed.

Sources

• Personal Data Protection Department, Malaysia: Public Consultation Paper No. 1/2026, page posted 29 October 2026, 29 October 2026
• Personal Data Protection Department, Malaysia: Public Consultation Paper No. 1/2026, full text (PDF), 29 October 2026