Joint Controller Data Processing Agreement Template for Malaysia

A Joint Controller Data Processing Agreement is a crucial legal document that governs how two or more organizations share responsibility for processing personal data in Malaysia. Under the Personal Data Protection Act (PDPA) 2010, when multiple parties jointly determine the purposes and means of data processing, they must establish clear legal arrangements to ensure compliance and protect data subjects' rights.

When do you need this document?

You need this agreement whenever your organization enters into collaborative arrangements involving shared personal data processing. This includes joint ventures where both parties contribute customer data, partnership agreements requiring shared marketing databases, integrated service offerings that combine customer information from multiple sources, or research collaborations pooling participant data. The agreement is also essential when establishing shared IT systems, implementing joint loyalty programs, or creating consolidated reporting mechanisms that involve personal data from multiple controllers.

Key legal considerations

The agreement must clearly define each party's role as joint controllers and specify their individual responsibilities under the PDPA 2010. Critical clauses include detailed data processing purposes, lawful bases for processing, data security measures, and breach notification procedures. You must address data subject rights fulfillment, including how individuals can exercise access, correction, and deletion rights across both controllers. The document should establish liability allocation mechanisms, indemnification provisions, and procedures for regulatory communications with the Personal Data Protection Department. Additionally, include data retention periods, cross-border transfer restrictions, and termination procedures that ensure continued data protection compliance.

Legal requirements in Malaysia

Under Malaysian law, joint controllers must comply with all PDPA 2010 principles, including the General Principle requiring lawful processing with data subjects' consent or other legal grounds. The agreement must address the Notice and Choice Principle by specifying how privacy notices will be provided jointly or separately. Data security obligations under the Security Principle require detailed technical and organizational measures from both parties. If either party processes sensitive personal data, explicit consent requirements must be clearly allocated. The agreement should also comply with the Personal Data Protection Regulations 2013, particularly regarding data user registration requirements and notification obligations to the Commissioner.