Data Controller Agreement Template for Malaysia

This Data Controller Agreement is essential for organizations operating in Malaysia that process personal data in commercial transactions. The document is required when entities need to establish clear guidelines and responsibilities for personal data processing under the Personal Data Protection Act 2010 (PDPA). It becomes particularly relevant when multiple entities within a corporate group act as data controllers, or when organizations need to formalize their data protection obligations. The agreement ensures compliance with Malaysian data protection laws, outlines security measures, establishes breach notification procedures, and defines the framework for protecting data subject rights. It's particularly crucial for businesses engaged in significant data processing activities or those operating across multiple jurisdictions while maintaining Malaysian law compliance.

1. Parties: Identification of the contracting parties including their full legal names, registration numbers, and registered addresses

2. Background: Context of the agreement, relationship between parties, and purpose of data processing activities

3. Definitions and Interpretation: Definitions of key terms used in the agreement, including those from PDPA 2010, and rules of interpretation

4. Scope and Purpose: Detailed description of the data processing activities covered by the agreement and their intended purposes

5. Data Controller Obligations: Core obligations of the data controller under PDPA 2010, including compliance with data protection principles

6. Data Security: Security measures required to protect personal data, including technical and organizational measures

7. Data Subject Rights: Procedures for handling data subject requests and ensuring compliance with data subject rights under PDPA

8. Data Breach Notification: Procedures for identifying, reporting, and managing personal data breaches

9. Confidentiality: Obligations regarding confidentiality of personal data and other confidential information

10. Term and Termination: Duration of the agreement and circumstances under which it can be terminated

11. Consequences of Termination: Actions required upon termination, including data return or deletion

12. General Provisions: Standard contractual provisions including governing law, dispute resolution, and entire agreement