MyYuza › Guides › PDPA compliance for gyms, studios and tuition centres

PDPA compliance for gyms, studios and tuition centres

If you keep members' names, phone numbers and payment records, you are handling personal data, and Malaysia's Personal Data Protection Act applies to you. The 2024 amendments raised the bar. Here is what a small membership business actually needs to know.

Updated 30 Oct 2026 · 3 min read · Bahasa Melayu

Yes, the PDPA applies to you

The Personal Data Protection Act 2010 (Act 709) governs the processing of personal data in commercial transactions in Malaysia. A gym, studio or tuition centre that stores member contact details and payment history is processing personal data, so the Act applies regardless of your size. The law is overseen by the Personal Data Protection Department (JPDP) under its Commissioner.

What the 2024 amendments changed

The Personal Data Protection (Amendment) Act 2024 modernised the law and brought it closer to international standards such as the GDPR. The changes most relevant to a small business are:

• Mandatory breach notification. If personal data you hold is breached, you must notify the Commissioner, and the widely reported standard is within 72 hours of becoming aware. Where the breach is likely to cause significant harm, you must also notify the affected individuals, reported as within 7 days.
• Data Protection Officer. Appointing a DPO became mandatory for organisations above certain processing thresholds (for example, processing the personal data of a large number of individuals, or substantial volumes of sensitive or financial data, or carrying out regular systematic monitoring). Many small gyms fall below these thresholds, but you should check where you stand as you grow.
• "Data controller" and processor duties. The term "data user" became "data controller", and data processors (the vendors who handle data on your behalf) now carry direct obligations.
• Data portability and stronger penalties. Individuals gained a right to data portability, and penalties for non-compliance were increased.

Some provisions were brought in on a phased basis during 2025. Confirm the current detail and effective dates on the Commissioner's official site.

The seven principles, in plain terms

Underneath the detail, the PDPA has always rested on a handful of common-sense principles. For a membership business they come down to:

• Only collect what you need (name, phone, plan, payments), not more.
• Tell members why you collect it and get their consent.
• Use it only for that purpose. Billing data is for billing, not for selling to third parties.
• Keep it accurate and secure. Protect it from loss and from people who should not see it.
• Do not keep it forever. Retain it only as long as you need it.
• Let members see and correct their own data.

Practical steps for a small business

• Store member data in a secure system with access control, not an open spreadsheet on a shared laptop or a WhatsApp group.
• Never post members' payment status or personal details in a shared group.
• Have a short, honest line on your sign-up explaining what you collect and why.
• Use reputable software whose provider takes security seriously, so the technical protection is handled for you.

How MyYuza helps

MyYuza keeps member data in one access-controlled system rather than scattered across chats and spreadsheets, sends invoices privately one to one rather than in groups, and is built by a team that treats security as a first-class concern. That makes good data practice the path of least resistance. See digitising member records.

This guide is general information, not legal advice. For your specific obligations, consult the Personal Data Protection Department or a qualified adviser.