Malaysia

Although the Penal Code creates offences for the receiving, concealing or disposing of stolen property generally, there are no specific offences for the receiving and disposing of / handling stolen data.
However, where the data in question constitutes “personal data” as defined under the Personal Data Protection Act 2010 (the “PDPA”), section 130 of the PDPA provides that any person who knowingly or recklessly, without the consent of the data user (i.e. a person who alone or jointly with other persons processes any personal data or has control over or authorizes the processing of any personal data):
(a) collects or discloses personal data held by the data user; or
(b) procures the disclosure to another person of personal data held by the data user,
such collection or disclosure of personal data and/or the act of procuring the disclosure of personal data is an offence.
In addition, any person who sells or offers to sell personal data which was collected in the circumstances described above commits an offence.
Commission of any of the offences above is punishable by a fine not exceeding RM500,000, imprisonment for up to three (3) years, or both.