Malaysia's Personal Data Protection Act 2010 (PDPA) applies to any commercial organisation that collects, stores, or processes personal data in the course of a transaction. That includes laundromats. If your outlet uses a mobile app, a loyalty system, a cashless payment platform, or has CCTV cameras, you are collecting personal data and you have legal obligations under the PDPA.
This is not a topic most laundromat operators spend time on during setup, but non-compliance carries real consequences, and the requirements are not difficult to meet once you understand what they are.
What Data Do Laundromats Collect?
A typical self-service laundromat using modern infrastructure collects more data than operators often realise:
- App registration data: name, phone number, email address
- Payment records: transaction history, preferred payment method, wallet top-up history
- Loyalty and usage data: how often a customer visits, which machines they use, credit balances
- CCTV footage: video recordings of customers inside and outside the premises
All of this falls under the definition of personal data in the PDPA, and the Act requires that you handle it responsibly.
Is CCTV Footage Personal Data?
Yes. Under the PDPA, any information that can identify a living individual is personal data. Video footage where faces are visible is personal data. This means your CCTV system is part of your data compliance obligation, not just a security tool.
There are two main requirements for CCTV:
Visible signage: You must display a clear notice informing people that CCTV is in operation on the premises. The notice should be placed at the entrance and in any area under surveillance. This notice informs customers that their image may be recorded, which satisfies the notice principle under the PDPA.
Retention policy: You need to decide how long you keep footage and document that decision. Most operators keep footage for 14 to 30 days, which is sufficient for most incident or dispute purposes. Keeping footage indefinitely without a defined policy is not compliant.
Key PDPA Obligations for Laundromat Operators
The PDPA is built around seven principles. For a laundromat, the most practically relevant ones are:
General principle: Only collect data that is necessary for the purpose. If your app only needs a phone number to send cycle completion alerts, you do not need to also collect a home address.
Notice and choice principle: Customers must be informed of what data is being collected, why it is being collected, and who it may be shared with. This is typically delivered through a privacy notice shown during app registration or account creation.
Disclosure principle: You cannot share customer data with third parties without consent. This applies to your app provider, payment processor, and any marketing partners. Review the data handling terms of every platform you use.
Security principle: Personal data must be stored securely. This means your app provider or payment system should use encryption and access controls. You should not store customer records in unprotected spreadsheets or shared drives.
Access principle: Customers have the right to request access to their data and to correct inaccurate information. Your app or platform should provide a mechanism for this.
What to Include in Your App Privacy Notice
A basic privacy notice for a laundromat app should cover:
- What data is collected (name, phone number, transaction records)
- Why it is collected (account management, service delivery, loyalty programme)
- How long it is kept (state a specific period or the criteria used to determine it)
- Who it may be shared with (payment processor, app platform, and no one else without consent)
- How customers can access or correct their data (contact email or in-app option)
- How customers can withdraw consent or delete their account
This notice should be shown and acknowledged before a customer creates an account. Most established laundromat app platforms in Malaysia include a template for this, but operators should review the template rather than accepting it without reading.
Consequences of Non-Compliance
Under the PDPA, penalties for non-compliance include fines of up to RM 500,000 and imprisonment in serious cases. More practically, a customer complaint to the Department of Personal Data Protection (JPDP) can trigger an investigation that is disruptive to operations and damaging to your outlet's reputation.
For a single-outlet laundromat, achieving basic compliance is not complicated. The investment is mainly in attention during setup, not in expensive legal infrastructure.
Practical Compliance Checklist for a Single Outlet
- [ ] Privacy notice displayed during app registration and acknowledging by customer
- [ ] CCTV signage posted at entrance and visible in camera coverage areas
- [ ] CCTV footage retention period defined and documented (recommended: 14 to 30 days)
- [ ] Payment platform and app provider data handling terms reviewed
- [ ] Data sharing limited to necessary service providers only
- [ ] Customer data access request process in place (contact email at minimum)
- [ ] No unnecessary data collected beyond what the service requires
Review Your Systems at Setup, Not After
The best time to address PDPA compliance is when you are setting up your outlet and choosing your technology stack. Retrofitting compliance requirements into an existing app platform or payment system is harder than selecting compliant providers from the start.
Working with laundromat business consultancy advisors who are familiar with the regulatory environment in Malaysia helps you ask the right questions before you commit to a platform or sign an agreement. For operators concerned about the financial planning side of compliance investment, finance advisory for laundromats can help you factor these requirements into your startup budget from the beginning.
---
Frequently Asked Questions
Does PDPA apply to a small single-outlet laundromat?
Yes. The PDPA applies to any commercial organisation that processes personal data in the course of a transaction, regardless of size. A single-outlet self-service laundromat that collects customer names and phone numbers through an app is covered.
Do I need a formal privacy policy document on my website?
If your laundromat has a website where customers can register or access their account, a privacy policy page is recommended and reflects good practice. For outlets that only use a standalone app, the privacy notice should appear within the app at registration. A website privacy policy is not a specific requirement under the PDPA but protects you and builds customer trust.
How long should I keep CCTV footage?
There is no fixed period specified in the PDPA, but the data minimisation principle applies. Most operators keep footage for 14 to 30 days, which is long enough to address incidents or disputes. The key is to define a retention period, document it, and delete footage consistently after that period.
Can I share customer data with my marketing agency or social media manager?
Not without explicit consent. Sharing identifiable customer data such as phone numbers or email addresses with a third-party marketing provider requires customer consent and a data processing agreement with the third party. For general social media marketing that does not use individual customer records, this restriction does not apply.
