Equip your healthcare team for Malaysia's amended PDPA — with mandatory 72-hour breach notification and DPO requirements now in effect, AI-ready clinical operations are no longer optional.
Malaysia's healthcare sector is undergoing rapid digital transformation. The amended PDPA 2010 now classifies biometric data as sensitive personal data, directly impacting patient records management. With 72-hour mandatory breach notification requirements taking effect from June 2025, healthcare providers face heightened compliance obligations. Meanwhile, HRD Corp's SBL-Khas scheme provides up to RM1,000 per participant for staff training, making AI upskilling financially accessible for clinics and hospitals. This programme is structured to qualify for HRD Corp SBL-Khas claims, with training costs covered directly from employer levy contributions — no upfront payment required. The PDPA amendments, with maximum fines increased to RM1 million and mandatory 72-hour breach notification, make compliance-aware AI deployment a business imperative.
LOCAL CONTEXT
Malaysia is rapidly positioning itself as a regional AI hub through the Malaysia Digital initiative. Strong government incentives, including HRDF and MDEC grants, combined with a growing pool of digital talent, create fertile ground for AI transformation across industries.
$2.1 billion AI market by 2030
growing
THE CHALLENGE
“PDPA Amendment Compliance Gap”
“HRD Corp Funding Underutilisation”
“AI Talent Shortage Blocking Implementation”
“Patient Data Sensitivity Under Expanded PDPA”
Our team has trained executives at globally-recognized brands
OUTCOMES
FUNDING & SUBSIDIES
Up to RM1,000 per participant
Covers training costs for employees of registered employers (mandatory for 10+ staff). Direct provider payment — no upfront cost to employer.
Official SourceUp to MYR 5,000 per company
50% matching grant for digital service subscriptions adopted as part of this programme's implementation phase.
Official SourceVaries by partner institution
Part of RM1.5 billion public-private initiative supporting MSME business digitalisation through financial institutions and digital service providers.
Official SourceREGULATORY LANDSCAPE
The PDPA 2010 amendments (effective January–June 2025) are directly relevant: maximum fines increased to RM1 million, mandatory DPO appointments, 72-hour breach notification, expanded sensitive data definitions including biometrics, and new data portability rights. The Cyber Security Act 2024 requires NCII entities to conduct annual cybersecurity risk assessments, biennial audits, and notify authorities of incidents within 6 hours of discovery. MOSTI's National Guidelines on AI Governance and Ethics (AIGE) outline seven core principles for responsible AI deployment, and the National AI Office (NAIO) is developing the AI Technology Action Plan 2026–2030 as a risk-based regulatory framework.
CHALLENGES IN MALAYSIA
The 2024 PDPA amendments require mandatory DPO appointments, 72-hour breach notification, and expanded sensitive data definitions including biometrics — effective June 2025. Many Malaysian organisations lack the AI governance frameworks needed to ensure automated systems meet these heightened requirements, risking fines up to RM1 million.
Malaysian employers with 10+ staff pay a mandatory 1% levy to HRD Corp, yet many fail to fully claim these funds for AI training. The SBL-Khas scheme covers up to RM1,000 per participant with direct provider payment, but the 'apply before training' requirement and 5-10 day processing time catch unprepared organisations off-guard.
Malaysia has only 3,000 AI professionals against a projected demand of 30,000 by 2030. With 81% of employers struggling to hire AI talent and a 34% salary premium required for AI-skilled candidates, building internal capability through training is significantly more cost-effective than competing in the talent market.
The PDPA amendments reclassified biometric data as sensitive personal data and introduced data portability rights. Healthcare providers deploying AI for patient records, diagnostics, or administrative operations must ensure systems comply with both the expanded data categories and new patient rights around data transfer between providers.
OUR PROCESS
We audit your clinical workflows, administrative processes, technology systems (EHR, PACS, LIS), and regulatory environment to identify AI opportunities across patient care, diagnostics, and operations.
We tailor the training to your healthcare setting (hospital, clinic, specialty center), clinical departments (ER, radiology, surgery, primary care), and strategic priorities (patient flow, diagnostic accuracy, cost reduction).
Your clinical and administrative teams gain practical experience with AI tools for documentation, diagnostics, patient flow, chronic disease management, and billing automation across 5-6 days of intensive workshops.
Teams design 4-6 AI healthcare use cases (e.g., AI clinical documentation, radiology triage, patient flow prediction, coding automation) tailored to your hospital's patient population and operational challenges.
We provide 90-day support including AI safety validation, clinical workflow integration, regulatory documentation for MOH/FDA review, and performance monitoring to ensure AI enhances care quality without introducing patient risk.
IS THIS RIGHT FOR YOU?
Hospitals and health systems seeking to deploy AI across clinical and administrative workflows
Clinical departments (radiology, ER, surgery) overwhelmed by workload and documentation burden
Healthcare COOs facing patient flow challenges, ER overcrowding, and resource constraints
Medical staff experiencing burnout from repetitive tasks and excessive paperwork
Health systems preparing for regulatory review of AI medical devices or clinical decision support tools
Small clinics without EHR systems or digital infrastructure (AI integration may not be feasible)
Organizations expecting AI to replace clinicians (AI augments, not replaces, clinical judgment)
Teams unwilling to invest in AI safety validation and continuous monitoring
See yourself above? Let's talk about AI for Healthcare Teams in Malaysia.
Let's TalkCOMMON QUESTIONS
MORE TRAINING
WHY PERTAMA PARTNERS
Pertama combines deep ASEAN healthcare delivery experience with Malaysia-specific regulatory knowledge — particularly the intersection of PDPA amendments, Cyber Security Act 2024 requirements for NCII healthcare entities, and BNM oversight for health insurers. Local Malaysian training firms typically lack this cross-regulatory perspective.
Training is delivered in English as the primary working language, with Bahasa Malaysia terminology integrated where relevant. Facilitators are comfortable with the code-switching between English, Bahasa Malaysia, and Mandarin that is common in Malaysian professional settings. All materials reference Malaysian regulations, funding mechanisms, and market examples. On-premise delivery is available for organisations with strict information security requirements. Programme structure is designed to meet HRD Corp's 'apply before training' process requirements, with adequate lead time built into scheduling.
Let's discuss how ai for healthcare teams can help your organization in Malaysia.
Start a Conversation