Clinic24 — AI voice assistant for clinics
Back to blog
Malaysia · Data ProtectionSeptember 25, 20264 min read

What Malaysia's PDPA Means for Clinic Call Recordings

A plain-English guide to the Personal Data Protection Act 2010 and its 2024 amendments for Malaysian clinics that record or summarise patient phone calls.

Clinic manager reviewing patient call records securely on a laptop

Introduction

When a patient calls your clinic, they share personal details: name, phone number, sometimes symptoms. If you record or summarise those calls, that information is personal data under Malaysia's Personal Data Protection Act 2010 (PDPA).

This guide covers what the PDPA expects from clinics that record calls, and what changed with the 2024 amendments.

This article is general information for clinic owners, not legal advice. For decisions about your own practice, speak to a qualified adviser.

Key takeaways

  • The PDPA applies to personal data your clinic processes in commercial transactions, including call recordings.
  • Tell callers that calls may be recorded and why.
  • Keep recordings only as long as you need them, and limit who can access them.
  • The 2024 amendments added data breach notification and data protection officer requirements, phased in during 2025.

1. Why call recordings count as personal data

A recording links a voice and phone number to a person, and often to their health concern. Health information is treated as sensitive personal data under the PDPA, which means clinics should handle it with extra care.

2. The principles that matter most for calls

The PDPA sets out seven principles. For phone calls, four do most of the work:

  1. <strong>Notice and choice:</strong> tell callers their call may be recorded and what it is used for.
  2. <strong>Security:</strong> protect recordings from loss, misuse and unauthorised access.
  3. <strong>Retention:</strong> do not keep recordings longer than you need them.
  4. <strong>Access:</strong> patients can ask to see or correct the data you hold about them.

3. What changed with the 2024 amendments

The Personal Data Protection (Amendment) Act 2024 strengthened the law. Its changes came into force in stages during 2025. The points most relevant to clinics:

  1. Data breaches must be reported to the Personal Data Protection Commissioner, and in some cases to affected individuals
  2. Organisations are required to appoint a data protection officer
  3. Service providers that process data for you (data processors) now have their own security duties
  4. Individuals gained a right to data portability

4. A practical checklist for your clinic

  1. Add one line to your phone greeting: ‘This call may be recorded to help us serve you.’
  2. Update your clinic privacy notice to mention call recording and AI call handling
  3. Decide how long you keep recordings, and delete them after that
  4. Give recording access only to staff who need it
  5. Ask any phone or AI vendor how they store and protect recordings

5. How Clinic24 fits in

Clinic24 records and summarises calls so your team can follow up. You control your greeting and what the receptionist says. Read how Clinic24 protects patient data, or see Clinic24 for Malaysian clinics.

Recommended next step

Clinic24 for clinics in Malaysia

Answer every patient call 24/7 and book appointments automatically. Free 14-day trial, no credit card.

Visit Clinic24