Section 2. Application

(1) This Act applies to—

(a) any person who processes; and

(b) any person who has control over or authorizes the processing of, any personal data in respect of commercial transactions.

(2) Subject to subsection (1), this Act applies to a person in respect of personal data if—

(a) the person is established in Malaysia and the personal data is processed, whether or not in the context of that establishment, by that person or any other person employed or engaged by that establishment; or

(b) the person is not established in Malaysia, but uses equipment in Malaysia for processing the personal data otherwise than for the purposes of transit through Malaysia.

(3) A person falling within paragraph (2)(b) shall nominate for the purposes of this Act a representative established in Malaysia.

(4) For the purposes of subsections (2) and (3), each of the following is to be treated as established in Malaysia:

(a) an individual whose physical presence in Malaysia shall not be less than one hundred and eighty days in one calendar year;

(b) a body incorporated under the Companies Act 1965 [Act 125];

(c) a partnership or other unincorporated association formed under any written laws in Malaysia; and

(d) any person who does not fall within paragraph (a), (b) or

(c) but maintains in Malaysia—

(i) an office, branch or agency through which he carries on any activity; or

(ii) a regular practice.