PDPA isn't one law. It's three, and the one most regional programs forget is Malaysia's.
Singapore's PDPA passed in 2012. Thailand's passed in 2019 and only became fully enforceable on June 1, 2022. Malaysia's is the oldest, from 2010, and it's the one that changed most in the last two years. Same four letters, three regulators, three penalty schedules.
I keep seeing regional privacy plans that treat Singapore and Thailand as the two real laws and Malaysia as a footnote. That was a defensible shortcut in 2023. It isn't now.
So here's the question worth working through. If you operate in all three, which one do you build the program to?
Which one covers you at all?
The first thing I check is scope, because it splits before any duty does. Thailand reaches controllers abroad that sell to or monitor people in Thailand. That's GDPR Article 3 almost word for word. Singapore covers private-sector organizations and leaves public agencies to a separate act.
Malaysia's act applies to personal data processed in commercial transactions. Federal and state governments sit outside it entirely.
That last one matters for anyone selling into Malaysian public-sector accounts, because your customer isn't bound by the same statute you are.
Whose breach clock is shortest?
Closer than they used to be.
Thailand gives you 72 hours from awareness to notify its PDPC, unless the breach is unlikely to put anyone at risk. Singapore's mandatory notification has been live since February 1, 2021. You get up to 30 days to decide whether a breach is notifiable (significant harm, or 500 or more people). Then it's 3 calendar days to tell the PDPC.
Malaysia had no mandatory notification at all until June 1, 2025, when the third phase of its 2024 amendments took effect. Now it's 72 hours to the Commissioner, and notice to affected people within 7 days where there's significant harm.
I'd run all three off one 72-hour clock that starts at awareness. Singapore's assessment window is legal, and I still don't want an incident process that reads like it has a month of slack in it. Put the lookup in your incident runbook at the severity call, not in an appendix.
Can one DPO cover all three?
No. This is the part I'll argue about.
Singapore wants every organization to designate at least one DPO, with no size threshold, and doesn't care where that person sits. Thailand requires one only when your core activities involve regular large-scale monitoring or sensitive data, or you're a public authority, and it's fine with outsourcing the role.
Malaysia's June 2025 phase made a DPO mandatory past 20,000 people's personal data, or 10,000 people's sensitive data, or with regular and systematic monitoring. The Commissioner's guideline then wants that DPO resident in Malaysia for at least 180 days a year. They also need to work in both Bahasa Malaysia and English. A regional privacy lead in Singapore with three flags on their email signature doesn't clear that bar for the third flag.
Whether the regional lead sits in Singapore or Bangkok, I honestly don't care. Pick whoever will actually answer a regulator's email on a Friday.
Does consent travel?
This is where the three really split.
Thailand has GDPR-style lawful bases in Section 24, including contract and legitimate interest, so consent is one option among several. Singapore starts from consent and widened it in 2021 with deemed consent by notification and a legitimate interests exception. Malaysia is still consent first, with a short list of exceptions in section 6 and no general legitimate interest basis. (Its notice also has to go out in both Bahasa Malaysia and English under section 7(3), which an English-only regional template quietly fails.)
Transfers are where I keep seeing GDPR clauses pasted in unchanged. Singapore's Transfer Limitation Obligation wants a comparable standard of protection, usually shown by contract, binding corporate rules, or APEC CBPR certification. Thailand's Section 28 wants the destination to meet the PDPC's adequacy standard, with safeguards like BCRs as the fallback. Malaysia's 2024 amendments dropped the ministerial whitelist and now ask whether the destination has a substantially similar law or adequate protection.
What does getting it wrong cost?
- Singapore: up to 10% of annual Singapore turnover for organizations above S$10 million, otherwise up to S$1 million. The turnover cap has applied since October 1, 2022.
- Thailand: administrative fines up to THB 5 million, criminal penalties that include prison for some misuse of sensitive data, and punitive damages up to twice actual damages.
- Malaysia: up to RM1 million and 3 years in prison per offense since January 1, 2025.
Thailand's PDPC has already shown it'll use its numbers. In August 2024 it fined an online IT retailer THB 7 million after a breach, and the missing DPO was part of the finding.
Malaysia is my honest unknown. As of September 2026 I haven't seen the Commissioner test the new ceiling in a public case. I can't tell you yet whether RM1 million is a number anyone will actually pay.
So which one do you build to?
Thailand. That's the hill.
It's the most GDPR-shaped of the three. A program built on Section 24 lawful bases and a 72-hour clock already clears Singapore's breach timing and most of its consent rules.
- A consent-first notice in two languages.
- A resident DPO once you pass 20,000 people.
- A fresh look at processor contracts, since processors picked up a direct security duty in the 2025 phases.
That's the Malaysia patch list. I'd scope it as its own workstream with its own owner.
The build I'd push back on hardest is starting from Singapore. Deemed consent by notification doesn't exist in Malaysia, so every notice gets rewritten anyway, and you've spent the budget twice.
If you're taking an APAC privacy plan to the steering committee before Q4 budgets close, that's your slide. Thailand as the base, Malaysia as the patch list, Singapore as the check.
The regulation mapper doesn't carry any of the three PDPAs yet. It'll still give you the GDPR baseline to diff against, and the policy generator keeps the bilingual notice from drifting.
Three laws, one acronym. Build to the one that's hardest to retrofit.