Malaysia: passenger data record

Q: What did the Auditor-General find about MyIMMs?

The 2015 report found payment and contract problems. The 2018 Series 1 report found manipulation for false foreign labour quotas.

Q: Where do I file the MDAC?

On the Immigration Department's MDAC portal.

Last checked: 21 October 2026 · Country records

Malaysia's Personal Data Protection Act 2010 (Act 709) covers personal data in commercial transactions and does not apply to the Federal Government and State Governments ¹. Amendments under Act A1727 came into force in three stages in 2025 ². The Immigration Department of Malaysia runs the Malaysia Digital Arrival Card ⁵ and autogates that match face and fingerprints to the passport chip, as its director-general described in December 2025 ¹⁰. Auditor-General reports in 2015 and 2018 found problems in the MyIMMs immigration system ^6,7.

Data protection law: Personal Data Protection Act 2010 (Act 709), Royal Assent 2 June 2010 ¹, amended by Act A1727 of 2024 ²
Data protection authority: Personal Data Protection Commissioner, Department of Personal Data Protection ³. The Act does not apply to the Federal and State Governments ¹
Agency that receives API/PNR: Not published
API/PNR status: Not confirmed as of 21 October 2026
Biometric collection at entry: Yes at autogates, which match face and fingerprints to the passport chip ¹⁰
Date checked: 21 October 2026

Data protection law and its limits

The Personal Data Protection Act 2010 received Royal Assent on 2 June 2010 and was published in the Gazette on 10 June 2010 ¹. Section 2 applies it to personal data in respect of commercial transactions ¹. Section 3(1) says the Act does not apply to the Federal Government and State Governments ¹. Section 45 exempts data processed for the prevention or detection of crime or for investigations from several principles, including the Disclosure and Access Principles ¹.

The Commissioner published a code titled Personal Data Protection Practices for the Malaysian Aviation Sector on 5 August 2024 ⁴. The Commissioner's page says breach of a registered code can lead to a fine of up to RM 100,000 or up to one year in prison or both ⁴.

The 2024 amendments

P.U. (B) 522, gazetted on 24 December 2024, set the dates on which the Personal Data Protection (Amendment) Act 2024 (Act A1727) came into operation ².

1 January 2025: sections 7, 11, 13 and 14 of the amending Act ².
1 April 2025: sections 2, 3, 4, 5, 8, 10 and 12 ².
1 June 2025: sections 6 and 9 ².
The Commissioner has issued Circular No. 1/2025 on data breach notification and Circular No. 2/2025 on appointing a Data Protection Officer, with guidelines on cross-border transfer ³.

MyIMMs, NIISe and audit findings

As reported by Reena Raj of Malay Mail on 15 December 2016, the Auditor-General's 2015 report found the RM29.9 million myIMMs system was not up to mark ⁶. The report found contract dates that came before the approval date and Letter of Acceptance, RM22.64 million in payments without complete documents, and full payment of RM10.30 million for biometric equipment that was not installed or used ⁶. The Public Accounts Committee decided in September 2016 that myIMMs did not need replacing but needed improvement ⁶. Deputy Prime Minister Ahmad Zahid Hamidi said a vendor would be appointed to integrate myIMMs ⁶. The same report said Prestariang Bhd had been appointed the year before to provide the National Immigration Control System (SKIN) ⁶.

As reported by the national news agency Bernama on 25 July 2019, the Auditor-General's Report 2018 Series 1 found MyIMMs had been manipulated to create false foreign labour quotas for 123 companies from 2016 to 2018 ⁷. Immigration Director-General Khairul Dzaimee Daud said a replacement Integrated Immigration System was being procured and that disciplinary action would follow ⁷. Home Minister Muhyiddin Yassin said the department would act on the findings ⁷.

As reported by the New Straits Times on 23 December 2025, the new system is the National Integrated Immigration System (NIISe) ¹⁰.

Autogates and MDAC

As reported by Bernama on 16 May 2024, Home Minister Saifuddin Nasution Ismail said autogates at all entry points would open to travellers from 36 more low-risk countries from 1 June 2024, including the EU, China and Canada, bringing the total to 46 ⁸. Bernama reported on 2 December 2024 that Deputy Home Minister Shamsul Anuar Nasarah told the Dewan Rakyat that visitors from 60 countries had been given autogate access ⁹. The New Straits Times reported on 23 December 2025 that Immigration Director-General Zakaria Shaaban put the figure at 63 low-risk countries ¹⁰. The sources give different totals at different dates.

Zakaria said 635 autogates would be installed at 125 entry points by 2028, with 75 in use ¹⁰. He said NIISe gates check the passport chip signature and match face and fingerprint to chip data, and run real-time watchlist checks ¹⁰.

The Malaysia Digital Arrival Card (MDAC) is filed online at a portal run by the Immigration Department of Malaysia ⁵.

Chronology

Date	Event
2 June 2010 ¹	PDPA 2010 receives Royal Assent ¹
15 December 2016 ⁶	Report on Auditor-General's 2015 findings on myIMMs ⁶
25 July 2019 ⁷	Report on Auditor-General's 2018 Series 1 findings ⁷
1 June 2024 ⁸	Autogates opened to more foreign visitors ⁸
24 December 2024 ²	Commencement order for Act A1727 gazetted ²
1 June 2025 ²	Last stage of PDPA amendments in force ²
23 December 2025 ¹⁰	Plan for 635 autogates by 2028 announced ¹⁰

Common questions

Does Malaysia's PDPA cover immigration data?

No. Section 3(1) says the Act does not apply to the Federal Government and State Governments ¹.

Can foreign visitors use Malaysian autogates?

Yes, visitors from listed low-risk countries. The count was 63 in December 2025 ¹⁰.

What data do autogates take?

The Immigration Director-General said gates match face and fingerprints to the passport chip ¹⁰.

What did the Auditor-General find about MyIMMs?

The 2015 report found payment and contract problems ⁶. The 2018 Series 1 report found manipulation for false foreign labour quotas ⁷.

Where do I file the MDAC?

On the Immigration Department's MDAC portal ⁵.

Rules and fees change. Check the official site linked above before you apply or pay. Spotted an error? Email [email protected] with the official link.

Sources

Facial recognition gates at airports
How border e-gates match a traveller's face to a passport or a stored gallery, what images are kept, who runs the gates and where they are used.
Biometric data at borders
Which fingerprints and facial images border agencies collect from travellers, the legal basis, who holds the records and how long they are kept.
Who oversees passenger data
The bodies that check how governments use API and PNR data: data protection authorities, data protection officers, courts and UN standards.
Passenger data clauses in border contracts
The terms that decide who holds passenger data in border systems: data location, fees, funding, gateway providers and what official records publish.
Watch-list matching of passenger data
How API and PNR data are compared with INTERPOL, national and UN lists, what happens after a hit, how false matches are handled and how to seek redress.