PDPA: You Can Be Fined For Sharing A CCTV Clip Online
A person robbing your shop could evoke the Personal Data Protection Act if you expose their face online.
Subscribe to our FREE Newsletter, or Telegram and WhatsApp channels for the latest stories and updates.
If you think sharing footage from closed-circuit television (CCTV) online, whether it’s to expose a thief or some other wrongdoer, keep in mind that it’s possible for them to take you to court.
According to a video shared on TikTok by law firm Hafarizam Wan & Aisha Mubarak (HWAM), sharing personal data or information without consent — including the likeness of a person — is an offence under Section 5 of the Personal Data Protection Act 2010 (PDPA).
The only exception is if the recording was surrendered to authorities as proof.
“If the person was wrongfully accused or if it was a case of mistaken identity, you could also be fined for defamation”
The penalty for defamation includes a fine of RM300,000 or a maximum prison sentence of two years, or both.
Civil suits can also be filed for damages.
@hwamlaw Think it’s harmless to share CCTV footage? ❌ It’s ILLEGAL.# #viral #malaysia #fypmalaysia #trendingnow #undangundangmalaysia ♬ original sound – SpongeBob background music
Where does PDPA apply when it comes to CCTV footage?
In Malaysia, the Personal Data Protection Act (PDPA) 2010 treats CCTV recordings as personal data if a person can be identified in the footage. Businesses that use CCTV must notify people it is in operation, use the recordings only for the stated purpose (such as security), keep the data secure, and delete it when no longer needed. Individuals may also request access to footage of themselves, though this right has limits.
However, the PDPA does not apply in every situation. For instance, if someone installs CCTV at home purely for personal use, the law does not cover that footage since it falls outside the scope of commercial transactions.
Similarly, CCTV systems operated by government authorities—such as the police or municipal councils—are generally exempt, as federal and state government agencies are not bound by the PDPA.
In other words, the Act mainly regulates how businesses and private organizations handle CCTV recordings, but it does not extend to domestic use or government surveillance.
Even though the PDPA does not restrict private homeowners from sharing CCTV recordings, there are still other legal and practical concerns to keep in mind. If the footage is shared in a way that unfairly accuses someone or is posted widely on social media without proper context, it could open the door to defamation claims or other civil complaints.
From a law enforcement perspective, the safer approach is usually to hand over the recording directly to the police. Doing so avoids interfering with an active investigation and reduces the risk of backlash from the person caught on camera.
In practice, many Malaysians do upload clips of break-ins or attempted crimes online, but while this is not an offence under the PDPA, authorities often advise against it and stress that such evidence is better handled through official channels.
Share your thoughts with us via TRP’s Facebook, X, Instagram, or Threads.
