Joint Controller Agreement Template for Malaysia

A Joint Controller Agreement is a crucial legal document that establishes the framework for collaboration between two or more organisations that jointly determine the purposes and means of processing personal data. Under Malaysian law, this agreement ensures compliance with the Personal Data Protection Act 2010 (PDPA) and provides clear guidelines for shared data processing responsibilities.

When do you need this document?

You need a Joint Controller Agreement when your organisation shares decision-making authority over personal data processing with other entities. This commonly occurs in joint ventures where companies collaborate on projects requiring customer data analysis, shared services arrangements where multiple entities use a common data processing system, or strategic partnerships involving combined marketing campaigns. The agreement is also essential when affiliated companies within a corporate group jointly process employee or customer data, or when organisations collaborate on research projects that involve personal data collection and analysis. Without this agreement, each organisation risks being held individually liable for the entire data processing operation under Malaysian law.

Key legal considerations

The agreement must clearly define each party's roles and responsibilities to avoid overlapping obligations and potential disputes. Key provisions should include detailed allocation of data protection compliance duties, procedures for handling data subject access requests, and protocols for managing data breaches within the mandatory 72-hour notification period under PDPA. The document should establish clear data retention and deletion schedules, specify security measures each party must implement, and define liability allocation for potential data protection violations. Risk management clauses are particularly important, as joint controllers can be held jointly and severally liable for damages under Malaysian law. The agreement should also address cross-border data transfer requirements if any party processes data outside Malaysia, ensuring compliance with PDPA's international transfer restrictions.

Legal requirements in Malaysia

Under the Personal Data Protection Act 2010, joint controllers must ensure their agreement complies with all seven data protection principles, including the General Principle that requires lawful and fair processing. The agreement must designate data protection officers where required and establish procedures for obtaining valid consent from data subjects. Malaysian law requires that joint controllers maintain comprehensive records of processing activities and implement appropriate technical and organisational security measures. The agreement must also address the rights of data subjects under PDPA, including access, correction, and withdrawal of consent rights, with clear procedures for handling these requests. Additionally, the document should ensure compliance with sector-specific regulations such as the Communications and Multimedia Act 1998 for telecommunications data or the Consumer Protection Act 1999 when processing consumer information. The Contracts Act 1950 governs the formation and enforceability of the agreement itself, requiring clear terms and mutual consideration between parties.