Using AI With Customer Data: A Malaysian Business Review

Editorial review: 26 October 2026. Consultation paper issued 5 October 2026.

Malaysia's Personal Data Protection Department sought feedback on a proposed Artificial Intelligence and Personal Data Protection Framework under the Personal Data Protection Act 2010. The official consultation portal now marks the exercise closed and says feedback will be considered in finalising the framework. View the government consultation record.

This is a proposed framework. The consultation record should not be read as confirmation that a final framework has been adopted or that a new set of requirements has taken effect.

For businesses assessing AI tools, it provides a timely reason to understand where personal data enters a workflow and who is responsible for its use.

Begin with a practical inventory

Our suggested starting point is a list of the AI tools your team actually uses. Include tools embedded in existing software and services being trialled by individual departments.

For each one, record the purpose, the people using it and the information supplied. A customer enquiry, an employee document and a publicly available product description deserve separate consideration. Work from real examples, with sensitive details removed from the review materials where possible.

Ask the provider clear questions

Before introducing customer information, establish what the service documentation and contract say about storage, access, retention and deletion. Ask whether inputs may be used for model training, what configuration choices are available and which other providers are involved.

Keep the answers and identify unresolved points. A product demonstration alone cannot settle how your organisation's data will be handled.

Make internal responsibilities visible

As practical operational measures, agree who approves an AI use case, which information staff may provide and who checks outputs before they reach customers. Give employees a contact for uncertain situations.

Consider a customer service example: an assistant drafts a response using an enquiry. The process should identify the approved information source, the person reviewing the response and the route for correcting an error. Begin with a limited trial and review its results before broadening access.

Separate readiness work from legal conclusions

The review steps above are AIO's operational suggestions, rather than a claim that the consultation has made each step a new legal obligation. A business-specific compliance assessment should use current official materials and appropriate professional advice.

AIO can help map workflows, clarify system requirements and organise implementation responsibilities. Tell us where your team is considering AI.