PDPA and Your Parent's Care Records: A Practical Malaysia Guide

Care planning can create a concentrated file of identity, contact, health, medication, mobility, access and financial information. The safest starting point is not to collect everything. Decide the purpose first, then use the minimum accurate information needed for that purpose.

Malaysia’s Personal Data Protection Act 2010 applies to processing connected with commercial transactions. A family’s private care notes are therefore not automatically governed in the same way as records processed by a recruitment company, care service or platform. The official principles remain a useful standard for both: explain the purpose, limit disclosure, secure the information, keep it accurate, retain it only as needed and respect access or correction rights where they apply.

This is general information, not a determination of legal duties in a particular arrangement.

Separate the family record from care-service processing

There may be several data handlers in one care arrangement:

• the person receiving care;
• family members;
• an individual caregiver;
• a recruitment company or care coordination service;
• a care service;
• a hospital, clinic, pharmacy or therapist;
• a messaging or cloud platform; and
• a website used for the enquiry.

Each may have a different purpose and legal position. Ask a commercial organisation for its privacy notice and who acts as the data controller or processor under the current law. Do not assume one consent given to the family covers every onward disclosure.

The PDPA does not apply to the Federal or State Governments under Act 709, according to the Commissioner’s application page. Government records may still be governed by other laws, duties and policies. This distinction is another reason not to give a universal legal answer from a general article.

Treat health information as especially sensitive

The Commissioner’s FAQ identifies information about physical or mental health as sensitive personal data. A care file may also reveal religion, disability, location, finances and household vulnerability.

Before sharing, ask:

1. What exact care task requires this information?
2. Does the person understand and agree where they can make the decision?
3. Who will receive it?
4. Will it be forwarded or stored elsewhere?
5. How long is it needed?
6. Can a smaller summary serve the purpose?
7. How will an error be corrected?

A full discharge summary is rarely necessary for a first discussion about hours and daily-living support. A current, clinician-approved care summary may later be necessary for a confirmed caregiver to follow specific instructions.

Keep the first enquiry privacy-minimal

A useful first message can state:

• broad area, such as Cheras or Petaling Jaya;
• preferred days and hours;
• whether the person lives alone or with family only when relevant to staffing;
• broad daily-support tasks;
• mobility or communication needs in non-identifying terms; and
• whether clinical tasks are involved and require separate professional care.

Leave out:

• name and MyKad details;
• exact address, unit, lock or gate code;
• date of birth where age range is enough;
• bank, card, EPF, pension or insurance information;
• full medical reports, prescriptions or scan images;
• unrelated diagnoses;
• photographs that identify the person or home; and
• dates when the home will be empty.

The care enquiry guide uses this minimum-information approach. The approved WhatsApp flow should collect only enough to understand the requested support and location before any further verification.

Verify the recipient before sending more

Before sharing a detailed routine or health record with a caregiver or care service:

• verify the person or organisation through an appropriate channel;
• confirm the reason each item is requested;
• ask who else will receive it;
• obtain and read the privacy notice where the PDPA applies;
• clarify whether data leaves Malaysia or enters another platform;
• agree the secure handover method; and
• keep a record of what was shared and when.

Identity checking should also be proportionate. Viewing an original or using a verified recruitment-company process does not always require the family to retain a permanent MyKad copy. Ask why a copy is needed, how it will be protected and when it will be deleted.

The caregiver screening guide separates verification from unnecessary document collection.

Build a minimum working care record

A confirmed caregiver may need selected information such as:

• preferred name and communication needs;
• consented family and emergency contacts;
• current daily routine;
• agreed duties and exclusions;
• mobility or transfer instructions;
• food, allergy or swallowing information relevant to the role;
• current medication-support instructions relevant to the role;
• escalation steps; and
• access details needed for the booked visit.

The record should not become a family archive. Exclude old reports, unrelated family details and financial documents unless a specific lawful purpose genuinely requires them.

Use the person’s own words and preferences where possible. A care record should support them, not reduce them to diagnoses.

Keep one controlled current version

Multiple screenshots and forwarded files make correction and deletion difficult. Use one controlled record with:

• a clear owner;
• last-updated date;
• source of clinical instructions;
• access limited to authorised people;
• a change log for material updates; and
• an agreed retention or review date.

Remove obsolete copies from active use. Do not rely on a message buried in a family chat to override a current medication or mobility plan.

Secure both digital and paper records

Reasonable household measures include:

• a strong device passcode and current security updates;
• multi-factor authentication for the account holding records;
• limiting shared-folder permissions;
• using an encrypted or access-controlled storage method;
• avoiding shared or public devices;
• keeping paper records in a closed location;
• not leaving identity or medication pages visible to visitors;
• checking automatic photo and message backups; and
• securely deleting or destroying copies no longer required.

Do not send sensitive records through an unfamiliar link merely because it claims to be secure. Confirm the organisation and domain independently.

For organisations subject to the Act, the Commissioner’s 2015 Standard describes minimum expectations around security, permanent deletion when no longer processed and data accuracy. The 2024 amendment and subsequent official circulars also changed parts of Malaysia’s data-protection framework, so care services should use the current official material rather than an old template.

Consent and decision-making need care

Where the person can decide, ask them directly what may be shared, with whom and for what purpose. Consent should not be hidden inside a rushed admission or family group message.

Where decision-making ability is uncertain, do not assume that being a child, spouse or “next of kin” automatically gives unlimited authority over health and personal data. Follow any valid legal authority, the treating team’s process and applicable law. Obtain Malaysian legal advice when authority is disputed or consequential records are involved.

Even where another person lawfully decides, disclose no more than the care purpose requires and continue involving the person receiving care as far as possible.

Set retention by purpose, not habit

Different documents may have different legal or operational retention needs. A family should not destroy an original medical, employment, tax, insurance or legal record merely because a care shift ended.

Instead:

• identify who owns the original;
• distinguish official records from convenience copies;
• ask the care service for its retention schedule;
• remove access when a caregiver or coordinator leaves;
• delete duplicate convenience copies when no longer needed; and
• obtain professional advice before destroying a document that may be legally required.

A former caregiver’s personal information deserves the same care. Do not keep identity copies, bank details or references indefinitely without a continuing purpose or legal obligation.

Respond to a loss or wrong disclosure

If a phone, file or message containing care information is lost or sent to the wrong person:

1. stop further sharing;
2. revoke links or access where possible;
3. record what data and people are affected;
4. contact the care service or platform through an official channel;
5. change exposed access codes or credentials;
6. inform the person receiving care; and
7. obtain legal or regulatory advice where the organisation may have notification duties.

A commercial data controller should follow the current PDPA amendment, breach-notification guidance and its incident process. A family should not impersonate the affected person or conceal the incident from them.

Ask every care service the same privacy questions

Before using a recruitment company, platform or care service, ask:

• What information do you collect?
• Why is each item needed?
• Who receives it?
• Which systems and countries store it?
• How do I correct or withdraw information?
• How long do you retain it?
• What happens after a data breach?
• Who is the privacy contact?

Caregiver Malaysia’s handling is described in the privacy policy. That policy does not govern an independent caregiver, recruitment company, WhatsApp or another linked organisation, so review each party separately.

Good care-record privacy is not secrecy for its own sake. It is the discipline of giving the right person accurate information for a defined care task, while withholding everything that does not belong in that task.