Data Subject Rights and Data Portability Request Handling
Every organisation that holds personal data will receive requests: a customer asking what you hold on them, an employee asking for a correction, someone withdrawing consent or asking you to stop marketing. Since 1 June 2025 there is a new one. Section 43A of the amended PDPA lets an individual ask, in writing by electronic means, for their personal data to be transmitted directly to another data controller of their choice, subject to technical feasibility and compatibility of the data format, within a period to be prescribed. JPDP has consulted on the portability right but has not yet issued a final guideline, so organisations have to build a sensible process without detailed rules. The existing rights, such as access and correction, come with firm response timelines under the Act, and a mishandled request is one of the easiest ways to generate a complaint to JPDP.
This one-day course is for the people who actually receive these requests: customer service, HR, operations, front desk and marketing teams, as well as DPOs and compliance. It covers each right, the timelines and permitted refusals, identity verification, and how to track a request from the day it arrives to the day it is closed. It is practical, with request scenarios drawn from Malaysian retail, banking, healthcare and employment. Organisations handling volumes of requests can pair it with the tools on our privacy tools page.
HRD Corp SBL-Khas Claimable
Programme Agenda
9:00 AM - 9:15 AM
Welcome and Programme Overview
Introduction to the session, objectives, and housekeeping.
9:15 AM - 10:15 AM
The Rights Under the Amended PDPA
Access, correction, withdrawal of consent, preventing processing likely to cause damage or distress, preventing direct marketing, and the new right to data portability. Which rights attach to which situations, and which requests are really complaints in disguise.
10:15 AM - 10:30 AM
Break
10:30 AM - 11:30 AM
Access and Correction Requests
Recognising a request however it arrives, the response timelines in the Act, extensions, fees, what must be supplied and in what form, correcting data and informing others who received it, and the grounds on which a request may be refused, with reasons recorded.
11:30 AM - 12:30 PM
Data Portability Since 1 June 2025
What section 43A says and what it leaves open: electronic written requests, transmission to another controller, technical feasibility and format compatibility, and the prescribed period still to come. Building a proportionate process now, with JPDP's consultation as a guide to direction of travel rather than a rulebook.
12:30 PM - 1:30 PM
Lunch
1:30 PM - 2:20 PM
Identity, Third Parties and Difficult Requests
Proportionate identity verification, requests from lawyers, family members and employers, requests that involve other people's data, repeated or very broad requests, and requests used as leverage in disputes.
2:20 PM - 3:15 PM
Consent Withdrawal and Marketing Opt-Outs
Honouring withdrawal and opt-outs across systems and vendors, suppression lists, and the difference between a service message and marketing.
3:15 PM - 3:30 PM
Break
3:30 PM - 4:45 PM
Workflow, Records and Workshop
Designing a request log, handling requests arriving in shared inboxes and branches, escalation to the DPO, and records that prove each decision. Workshop: teams handle six requests end to end, including one portability request.
4:45 PM - 5:00 PM
Wrap-Up and Q&A
Key takeaways, next steps, and close.
Key Outcomes
- Recognise each data subject right under the amended PDPA, however a request arrives
- Respond to access and correction requests within the statutory timelines
- Handle data portability requests sensibly while detailed rules are still pending
- Verify identity proportionately and deal with third-party and difficult requests
- Honour consent withdrawal and marketing opt-outs across systems
- Run a request log that evidences every decision
Training Mode Physical / Online / Hybrid / e-learning
HRD Corp SBL-Khas Claimable
Level Foundation. For customer service, HR, operations, front desk and marketing teams who receive requests, and the DPOs and compliance staff who support them.
Duration 1 Day (8 Hours) | 9:00 AM to 5:00 PM
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment Six request-handling scenarios worked end to end, plus a written knowledge check
Certificate Certificate of Completion issued to all participants upon full attendance