PDPA 2024 and Where Your Data Actually Lives: On-Prem vs Google Drive/OneDrive

Malaysia's Personal Data Protection (Amendment) Act 2024 raised the stakes on data handling significantly — and one question it forces every business to actually answer is where their data lives, who can access it, and whether that can be proven after the fact.

What changed under the 2024 amendment

The amendment introduced a mandatory Data Protection Officer appointment for many organizations, a strict requirement to notify Malaysia's Personal Data Protection Commissioner within 72 hours of becoming aware of a breach, direct legal obligations on data processors (not just data controllers) around securing personal data, and a significant jump in penalties — up to RM1 million and three years' imprisonment, up from RM300,000 and two years previously. Confirm your specific obligations with the PDPA authority or counsel rather than treating this as a compliance guarantee — this is a summary, not legal advice.

Why storage location and access control matter here

A 72-hour breach notification requirement only works if you actually know what happened — what was accessed, by whom, and when. That's an access-log and audit-trail requirement as much as it's a security one, and it's exactly where general-purpose consumer cloud storage tends to fall short for business use.

Google Drive / OneDrive: what business editions actually give you

Free personal accounts and paid business-suite accounts aren't the same product here, and it's worth not conflating them. Google Workspace's business and enterprise editions do log Drive activity — view, create, edit, download, upload, delete, rename — searchable by admins, with more advanced investigation tooling gated to higher tiers; Microsoft 365's audit logs work on a similar principle. The real gaps to check are retention windows and log depth, which vary by edition and need to actually cover what a 72-hour investigation requires, and the fact that neither platform hands you an independent, offline backup by default — sync and version history aren't the same as a tested, restorable backup outside the platform. If Google or Microsoft has an outage or your account is compromised, a platform-native copy can be exactly as unavailable as the platform is.

On-premises storage: full control, but only once it's configured and tested

A Synology NAS on your own premises, backed up on a schedule with Veeam or Synology's own tools, puts you in direct control of where data physically sits — but none of that is automatic. Access control, activity logging and a genuinely tested restore process all have to be built and verified, the same as any cloud platform's admin controls do; owning the hardware doesn't own the compliance posture by itself. What on-prem storage does give you outright is a backup copy that doesn't depend on a third-party platform's availability, which is the piece consumer-tier cloud plans usually lack.

Storing data in Malaysia isn't automatically the finish line

PDPA 2024 also has its own framework for transferring personal data outside Malaysia, so a business can use a compliant cross-border cloud service and stay within the law — physical storage location inside Malaysia isn't a requirement by itself, and it isn't a substitute for actually configuring and testing the access-control, logging and backup controls above, wherever the data sits.

A real example

We migrated a Sabah accounting and advisory firm off roughly 1TB of Google Drive storage onto an on-premises Synology NAS, with proper access control set up for around 30 users. Beyond the compliance angle, the move cut that specific Google Drive subscription's cost to zero and let staff keep working during internet outages, since their files no longer depended on a live connection to reach them.

This isn't all-or-nothing

Most businesses land somewhere hybrid — cloud tools for day-to-day collaboration, on-premises storage and backup for anything that needs a defensible access trail and a tested recovery path. The right split depends on what you're actually storing, which edition or configuration you're already paying for, and where your data needs to be able to move.

Sources: Personal Data Protection (Amendment) Act 2024, Department of Personal Data Protection, Malaysia; Google Workspace Drive audit logging, Google; PDPA cross-border transfer guidance, Department of Personal Data Protection, Malaysia.