AI and Personal Data Protection: Malaysia's Emerging Direction

In October 2026 Malaysia's Personal Data Protection Department, JPDP, released Public Consultation Paper No. 1/2026, seeking feedback on a proposed AI and Personal Data Protection Framework to be issued as a guideline under the PDPA. The consultation period has closed, but no final text, issue date or transition period has been set at the time this course was written. This one-day programme is built around that emerging direction: it does not claim to know provisions that are not yet public, and treats the subject honestly as readiness for where regulation is heading rather than training on a finalised law.

The day works from AI and personal data principles that are already well established internationally and consistent with PDPA's existing structure, purpose limitation, data minimisation, and accountability for automated processing, and applies them to how organisations in Malaysia are likely to need to demonstrate AI governance once a framework is finalised. It explicitly builds on, and does not repeat, Automated Decision-Making and Profiling (ADMP) under the PDPA, which covers JPDP's existing, already-finalised guideline on a narrower topic; this course looks at the broader AI and personal data direction the 2026 consultation represents.

HRD Corp Training Provider Malaysia HRD Corp SBL-Khas Claimable

Programme Agenda

01

9:00 AM - 9:15 AM

Welcome and Programme Overview

Introduction to the session, objectives, and housekeeping.

02

9:15 AM - 10:15 AM

The 2026 Consultation: What Is Confirmed and What Is Not

What is publicly confirmed about JPDP's Public Consultation Paper No. 1/2026: that it proposes an AI and Personal Data Protection Framework to be issued as a guideline under the PDPA, that the consultation period has closed, and that no final text, issue date or transition period has yet been set. A deliberately honest account of what remains unknown, so participants leave able to separate what is settled from what is still in motion.

03

10:15 AM - 10:30 AM

Break

04

10:30 AM - 11:30 AM

Core AI and Personal Data Principles That Will Not Go Away

The principles that any Malaysian AI and personal data framework is likely to build on, because they already sit inside PDPA and are consistent across comparable frameworks internationally: purpose limitation applied to AI training and inference, data minimisation in model development, and the accountability an organisation retains when it processes personal data through an AI system, including one it did not build itself.

05

11:30 AM - 12:30 PM

Automated Decision-Making Safeguards

Safeguards relevant to AI systems that make or materially inform decisions about individuals, read alongside, not instead of, the existing ADMP guideline, and where an organisation's current ADMP compliance work already gives it a head start on the broader AI framework direction.

06

12:30 PM - 1:30 PM

Lunch

07

1:30 PM - 2:20 PM

AI Vendors as Data Processors

Why an AI vendor processing personal data on an organisation's behalf is typically a data processor under PDPA regardless of how the vendor markets the product, and what that means for the contractual and due diligence work an organisation should already be doing before this framework is finalised.

08

2:20 PM - 3:15 PM

Building an AI and Personal Data Inventory Now

A practical starting point organisations can act on before any framework is finalised: inventorying where AI systems touch personal data, who owns each system, and what governance documentation already exists versus what a future framework is likely to expect.

09

3:15 PM - 3:30 PM

Break

10

3:30 PM - 4:45 PM

Workshop: Readiness Self-Assessment

Participants assess their own organisation's AI and personal data governance against the principles covered during the day, and produce a prioritised readiness list to revisit once JPDP's framework is finalised.

11

4:45 PM - 5:00 PM

Wrap-Up and Q&A

Key takeaways, next steps, and close.

Key Outcomes

  • Explain what is confirmed and what remains undecided about JPDP's 2026 AI and Personal Data Protection Framework consultation
  • Apply purpose limitation, data minimisation and accountability principles to AI training and inference
  • Connect existing ADMP compliance work to the broader emerging AI framework direction
  • Assess when an AI vendor is acting as a data processor and what that requires contractually
  • Build an AI and personal data inventory as a practical readiness step
  • Produce a prioritised AI governance readiness list for their own organisation

Training Mode   Physical / Online / Hybrid / e-learning

HRD Corp   SBL-Khas Claimable

Level   Foundation to intermediate. For data protection officers, compliance and AI governance teams wanting to understand where Malaysian AI and data protection regulation is heading.

Duration   1 Day (8 Hours)  |  9:00 AM to 5:00 PM

Venue   In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)

Assessment   A readiness self-assessment workshop plus a short knowledge check

Certificate   Certificate of Completion issued to all participants upon full attendance

Enquiries   Contact us to register or discuss scheduling

Frequently Asked Questions

AI and Personal Data Protection: Malaysia's Emerging Direction runs for 1 day (8 hours) | 9:00 AM to 5:00 PM. It is delivered as an in-house closed group session, so the schedule can be adjusted to fit your team's working hours.

Yes. Delivery options are physical, online, hybrid, e-learning. In-house sessions run at your premises anywhere in Malaysia, online sessions run live over video conference, and hybrid combines both for teams split across sites.

Certificate of Completion issued to all participants upon full attendance. Each certificate carries a certificate number that can be checked at orbixtech.my/certificate-verify.

Level: Foundation to intermediate. For data protection officers, compliance and AI governance teams wanting to understand where Malaysian AI and data protection regulation is heading. The session is built around worked examples and group exercises rather than theory, so participants apply the material to their own organisation during the session.

Yes. AI and Personal Data Protection: Malaysia's Emerging Direction is also available through the Orbix <a href="lms-malaysia">LMS and e-learning platform</a>, where participants work through the material on their own schedule and device rather than attending one fixed session. A knowledge assessment and certificate on completion work the same way as the instructor-led session.

Minimum 2 participants for an in-house or live online session. With only 1 participant, we deliver it as a one-to-one online session instead.

Yes. Many clients pair AI and Personal Data Protection: Malaysia's Emerging Direction with our one-day <a href="training-team-building-malaysia">team building and high-performing teams programme</a> on the same engagement, so the budget and the day cover both.

Yes. Participants can follow up by email with questions that come up while applying what they learned, and we will point you to the right template, checklist or framework reference even after the session is over.