Jira & Confluence 
Bitrix24 Malaysia · Personal Data Protection Act 2010 · ss.30–31, 12B
Your data was in a breach? — letter and data access request ready, 21 days counted
Short answer. Your letter to the company is open below: it asks what happened to your data and requests a copy of everything they hold on you. Data access request: In writing; the company may charge the prescribed fee (Personal Data Protection Act 2010, s.30(2)).
- Last day for the company to comply, or to tell you in writing why it refuses (21 days): type the date
- If the company told you in time that it needs longer: last day to comply in full (21 + 14 days): type the date
Check your own case.
Section 31(1): the company must comply not later than 21 days from the date it receives the request. If it cannot, it must say so in writing before the 21 days end and comply in full within 14 days after that (s.31(2)–(3)). A refusal must be notified in writing, with reasons, within the same 21 days (s.33). We add calendar days to the date of receipt; keep proof of that date.
Start typing right in the document — no sign-up. It stays in this browser; save it to your free Layers account to keep it, open it on your phone and share it.
Lida, Layers template assistant
Enter the date the company received your letter, and I will show you the last day for their reply.
Send only the last four digits of your NRIC. The company can ask for more if it really needs it.
An illustrated character, not a lawyer.
Deadlines
The rules, with the source
| What | Deadline | Source |
|---|---|---|
| Data access request | In writing; the company may charge the prescribed fee | Personal Data Protection Act 2010, s.30(2) |
| Reply to the request | Not later than 21 days from receipt | PDPA 2010, s.31(1) |
| If the company needs more time | Written notice before day 21, then full compliance within 14 more days | PDPA 2010, s.31(2)–(3) |
| Refusal | Written notice with reasons within 21 days of receipt | PDPA 2010, ss.32–33 |
| Breach notification by the company | To the Commissioner as soon as practicable; to you without unnecessary delay if the breach is likely to cause significant harm | PDPA 2010, s.12B (in force 1 June 2025) |
| Complaint | In writing to the Personal Data Protection Commissioner | PDPA 2010, s.104 |
The Act covers personal data in commercial transactions. It does not apply to the Federal and State Governments (s.3), and information processed for a credit reporting business by a credit reporting agency is outside its definition of personal data (s.4).
Step by step
What to do, in order
1
Keep the notice
Save the company's e-mail or SMS, or a screenshot of its announcement, with the date.
2
Protect yourself first
Change passwords, turn on two-factor login, and tell your bank if card or account details may be involved.
3
Fill in the letter
Add your account number and only the identity details the company needs to find your records.
4
Send it with proof
E-mail the company's data protection contact or use registered post. The 21 days start when they receive it.
5
Check the reply
Did they say whether your data was affected, and send a copy of your data?
6
Complain if needed
No reply or an incomplete one after the deadline: write to the Personal Data Protection Commissioner.
Questions
Must the company tell me about the breach?
Since 1 June 2025 a company must notify the Commissioner of a personal data breach, and must notify you if the breach causes or is likely to cause you significant harm (s.12B).
Does this work for a credit reporting agency?
Partly. Information processed for a credit reporting business by a credit reporting agency is not personal data under this Act; those agencies have their own law. You can still ask what happened.
Will the letter get me compensation?
No. The letter gets you facts and a copy of your data, with a deadline. That is the basis for any later complaint.
Official sources
Other documents
Keep the papers in one place
Letters, receipts and notices in one folder you can share with family or a lawyer. The templates and the editor are free; Layers is free for up to 20 people.
This is a ready document and a deadline calculation, not legal advice.