Malaysia PDPA + AI: Does Your Custom Website Need a New Privacy Notice?

Most of the custom WordPress and Shopify sites we build for Malaysian businesses accumulate AI features gradually — a recommendation plugin added last year, a WhatsApp bot bolted on for after-hours enquiries, a live chat widget upgraded to “smart replies” without much fanfare. Individually, none of these updates usually trigger a rebuild. Collectively, they’ve quietly outpaced what most sites’ privacy policies actually say. The fix isn’t waiting for a Malaysian regulator to make a formal announcement the way Singapore’s Personal Data Protection Commission (PDPC) just did — it’s simply telling your customers, in plain language, when an AI feature on your site is collecting or using their data. That’s already what Malaysia’s own Personal Data Protection Act (PDPA) expects of you today.

What the PDPA already asks of a custom site

Under the PDPA — amended in 2024, with the main obligations effective 1 June 2025 — the baseline duty isn’t new: tell visitors what data you collect and why. What has sharpened is the expectation around AI specifically. Guidance is explicit that a generic clause like “we use your data to improve our services” is not adequate once an AI system is doing the processing. Your privacy policy needs to say, in effect, that AI is involved, roughly what it does with the data, and give visitors a way to ask questions.

That standard applies whether the AI code was custom-built for you or comes bundled in a plugin or app you installed. From a compliance standpoint, it doesn’t matter that a recommendation widget came from the Shopify App Store rather than a developer on your team — if it’s processing your customers’ personal data through an AI model, your site’s disclosure needs to reflect it.

Where custom sites typically fall short

• Recommendation and upsell apps on WooCommerce or Shopify that learn from browsing and order history.
• AI-upgraded live chat or WhatsApp Business integrations that store and learn from customer conversations, rather than just routing to a human.
• Lead-capture forms feeding a scoring or qualification model used internally.
• Content or search personalisation that adapts based on browsing behaviour across visits.

None of these are unusual or high-risk features — they’re standard e-commerce and marketing tooling. The issue is almost always that the privacy policy was written before the feature was added, and never revisited.

What a proper disclosure clause looks like

Below is roughly the shape of language that satisfies the “be specific, not generic” standard, adapted to a typical Malaysian e-commerce or corporate site. This isn’t legal advice, but it illustrates the level of detail expected:

Compare that with the vaguer, no-longer-sufficient version: “We may use your information to improve our services and personalise your experience.” The difference is naming the feature, the data, the purpose, and a contact point.

Singapore’s new rule isn’t law here — but it’s a useful wording guide

Singapore’s PDPC guidelines don’t apply to Malaysian businesses, and you don’t need to wait for Malaysia to issue an equivalent announcement before informing your own customers. But three of PDPC’s clarifications are genuinely useful reference points for how to word your own AI disclosure now:

1. Anonymised data is exempt — if a dataset can’t be tied back to an individual, the disclosure duty doesn’t apply to it.
2. No opt-out is required — you don’t need to build a consent-withdrawal flow to be considered compliant, though PDPA’s own data subject rights (like access and correction requests) still apply regardless of AI.
3. No refusing service — the notice is informational, not a gate to access your site or products.

A short update checklist

• Inventory every plugin, app and integration on your site that touches customer data, and flag which ones involve AI.
• Rewrite the relevant privacy policy clauses to name each feature specifically.
• Check whether your business needs a designated Data Protection Officer under the 2024 PDPA amendment.
• Confirm you have a basic data breach notification process in place, since this is now a mandatory obligation.