MDDI's Response to PQ on Aligning Personal Data Request Response Timeline with Data Retention Practices
5 May 2026
Parliament Sitting on 5 May 2026
Question for Oral Answer
*31. Dr Hamid Razak asked the Minister for Digital Development and Information how the Ministry ensures that the timelines for responding to personal data access requests under the Personal Data Protection Act 2012 are aligned with typical data retention practices so that individuals are able to meaningfully exercise their access rights.
Answer
The Personal Data Protection Act (PDPA) requires organisations to respond to personal data access requests as soon as reasonably practicable. If the organisation is unable to provide the requested personal data within 30 days after receiving the request, the organisation must within that time inform the individual in writing of when it will respond to the request. Organisations must also implement policies and practices to handle access requests, which include having appropriate measures to preserve the requested personal data while the request is being processed.
*Converted to written answer
