When you arrange care for a parent, you end up holding a lot of sensitive information about them — their full name and IC, their diagnoses, their medication list, sometimes their bank and EPF details — and you have to share some of it with people you have only just met. Malaysia’s Personal Data Protection Act 2010, the PDPA, treats that information, health details most of all, as something to be collected sparingly, shared narrowly and kept securely.
I am a physiotherapist, not a lawyer, so this is practical guidance rather than legal advice. But I have watched families forward a full hospital discharge summary, complete with IC and address, to three strangers on WhatsApp before breakfast — and then wonder why they feel uneasy. The same discipline the PDPA asks for is also what protects your parent from fraud, gossip and identity theft. Here is how to apply it without turning a simple enquiry into a paperwork exercise.
What the PDPA actually asks of you
The PDPA sets the standard Malaysia expects for how personal data is handled. Health information counts as sensitive personal data, which means it needs clear consent before it is shared with anyone. The Act is written mainly for organisations that process data as part of a business, so a family looking after its own mother is not really its target. That is not a reason to ignore it — the principles behind it are exactly the right standard to borrow.
Two of those principles do most of the work at home. Collect only what you genuinely need for the purpose in front of you, and keep it no wider and no longer than that purpose requires. If you hold both of those in mind, most of the specific advice below follows on its own.
The person or any organisation you eventually share details with is bound by the Act properly. So it is fair — and sensible — to ask how they will store your parent’s information and who else will see it. Anyone serious about care will have an answer.
Collect only what the care actually needs
When you first sit down to plan, it is tempting to pull together everything: the thick file from the last admission, every scan report, the bank book “just in case.” Resist that. A caregiver who comes to help your mother shower, walk to the toilet and take her tablets needs a clear picture of her mobility, her main conditions, her medication and her daily routine. They do not need her bank statements, her MyKad copied front and back, or her pension slips.
Write down what a single day of care actually calls for, then stop at the edge of it:
- Needed: main diagnoses, current medication and timing, allergies, mobility and transfer needs, the daily routine, and one emergency contact.
- Rarely needed at the start: full medical history going back years, old scan images, and detailed hospital records.
- Almost never needed by a caregiver: IC number, bank, card, EPF or pension details, and copies of financial documents.
The narrower your collection, the less there is to leak, lose or misuse later.
Share the minimum with a prospective carer
First contact — before anyone is chosen — needs very little. You can describe the whole situation without a single identifying detail. Something like: “My 78-year-old mother is recovering from a hip fracture, needs help bathing and with medication reminders, mornings in Cheras.” That tells a caregiver almost everything they need to decide whether they can help, and it names nobody.
Full name, unit number, IC and the detailed medical picture come later — once you have decided to take things forward, spoken properly, and ideally met the person. Sharing in that order is not being difficult; it is simply keeping the sensitive material back until there is a real reason to hand it over. If you want a sense of how a first enquiry is meant to flow, how a care enquiry works walks through it step by step, and checking a caregiver’s identity and references covers what to verify about them before you share anything of your parent’s in return.
That last point matters. Information should move both ways. Before you send your mother’s medication list to someone, you should know their real name and have spoken to a family they cared for recently. Sharing your parent’s sensitive data with a person you cannot yet identify is the exact situation to avoid.
What not to put in a first message
The first WhatsApp message is where families give away the most, fastest, usually out of eagerness to explain everything. Keep these out of it entirely until much later:
- Your parent’s IC number, or a photo of the front or back of their MyKad.
- The full home address, unit number, or gate and lock details.
- Bank account, card, EPF, pension or any financial information.
- Complete medical reports, discharge summaries or scan images with the patient’s name on them.
- Anything that signals when the house is empty or who lives alone.
None of these help a stranger decide whether they can care for your parent. They only create risk if the message lands with the wrong person or sits in a phone that is later lost or resold.
Store the records safely
Most care information in Malaysian homes lives in a phone gallery — photographed reports, screenshots of prescriptions, forwarded messages — backed up to the cloud and visible to anyone who picks up an unlocked phone. A few small habits close most of that gap:
- Lock the phone that holds these records with a PIN or fingerprint, and keep automatic cloud backup of sensitive photos switched off if you are unsure who can see it.
- Keep your parent’s documents in one folder, not scattered across chats. One place is easier to protect and easier to clear out later.
- Never forward a medical report into a family group chat. Send it to one person, directly, when there is a reason.
- Delete duplicates as you go. Every extra copy is one more place the information can escape from.
When an arrangement ends, tidy up. Delete the copies of a former caregiver’s IC and references you no longer need, and get back or shred any paperwork of your parent’s that is no longer part of the routine. Holding onto data “in case” is exactly what the PDPA discourages.
When your parent cannot give consent
If your parent can still make their own decisions, the information is theirs, not yours. Let them say what is shared and with whom, even where that feels slower. Many older Malaysians are private about money and health, and honouring that keeps their trust as well as their data safe.
Where a stroke or dementia has taken that capacity, the family steps in and acts in the parent’s interest. The rule does not change — share what genuinely helps and protects them, and no more. Deciding on their behalf is not a reason to be looser with their information; if anything it is a reason to be more careful, because they can no longer object.
A last word on trust
Handling a parent’s records well is part of the care itself, not admin around the edge of it. The families who get this right are usually the ones who feel calmest about the whole arrangement, because they are not lying awake wondering who has a photo of their mother’s IC.
Any site you enquire through should tell you plainly what it does with the details you send and how long it keeps them; ours is set out in our privacy policy, and the disclaimer makes clear that guidance like this article is general information, not legal or medical advice. Read both, ask the same questions of anyone else you deal with, and share your parent’s information the way you would want your own handled.