Company: GCL
Filing Date: 2025-07-31
Form Type: 20-F
Source: 0001213900-25-069672
Chunk: 77

Company: GCL Global Holdings Ltd
Filing Date: 2025-07-31
Form: 20-F
Item: Item 4
Chunk 77
---
 “Malaysia PDPA”) regulates the processing of personal data in commercial transactions
in Malaysia and is enforced by the Personal Data Protection Commission. The Malaysia PDPA applies to (a) any person who processes,
and (b) any person who has control over or authorizes the processing of, any personal data in respect of commercial transactions.
The Malaysia PDPA also applies to a person in respect of personal data if (a) the person is established in Malaysia and personal
data is processed, whether or not in the context of that establishment, by that person or any other person employed or engaged by that
establishment, or (b) the person is not established in Malaysia but uses equipment in Malaysia for processing the personal data,
except for the purposes of transit through Malaysia.

“ Personal data” is
statutorily defined to mean any information in respect of commercial transactions, which (a) is being processed wholly or partly
by means of equipment operating automatically in response to instructions given for that purpose, (b) is recorded with the intention
that it should wholly or partly be processed by means of such equipment, or (c) is recorded as part of, or with the intention that
it should form a part of, a relevant filing system that relates directly or indirectly to a data subject (i. e., an individual who is the
subject of the personal data) who is identified or identifiable from that information or from that and other information in the possession
of a data user, including any sensitive personal data and expression of opinion about the data subject. “ Personal data” does
not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under
the Credit Reporting Agencies Act 2010 of Malaysia.

Under the Malaysia PDPA, a “data
user” is a person who either alone or jointly, or in common with other persons, processes any personal data or has control over,
or authorizes the processing of, any personal data but does not include a processor. The Malaysia PDPA provides that data users must adhere
to the following principles with respect to the processing of personal data:

  (a)      the general principle;  

  (b)      the notice and choice principle;  

  (c)      the disclosure principle;  

  (d)      the security principle;  

  (e)      the retention principle;  

  (f)      the data integrity principle; and  

  (g)      the access principle.  

In general, to