Company: GCL
Filing Date: 2025-09-04
Form Type: F-1
Source: 0001213900-25-084489
Chunk: 110

Company: GCL Global Holdings Ltd
Filing Date: 2025-09-04
Form: F-1
Chunk 110
---
 the person is not established in Malaysia but uses equipment in Malaysia for processing the personal data, except for the purposes of transit through Malaysia. “Personal data” is statutorily defined to mean any information in respect of commercial transactions, which (a) is being processed wholly or partly by means of equipment operating automatically in response to instructions given for that purpose, (b) is recorded with the intention that it should wholly or partly be processed by means of such equipment, or (c) is recorded as part of, or with the intention that it should form a part of, a relevant filing system that relates directly or indirectly to a data subject (i.e., an individual who is the subject of the personal data) who is identified or identifiable from that information or from that and other information in the possession of a data user, including any sensitive personal data and expression of opinion about the data subject. “Personal data” does not include any information that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under the Credit Reporting Agencies Act 2010 of Malaysia. 68 Under the Malaysia PDPA, a “data user” is a person who either alone or jointly, or in common with other persons, processes any personal data or has control over, or authorizes the processing of, any personal data but does not include a processor. The Malaysia PDPA provides that data users must adhere to the following principles with respect to the processing of personal data:

| (a) | the general principle; |

| (b) | the notice and choice principle; |

| (c) | the disclosure principle; |

| (d) | the security principle; |

| (e) | the retention principle; |

| (f) | the data integrity principle; and |

| (g) | the access principle. |

In general, to process or disclose personal data relating to any individuals would require (i) consent from such individuals, particularly pertaining to sensitive personal data, which may be obtained in any form that can be recorded and maintained properly by the data user; and (ii) written notice to such individuals informing such individuals amongst others, (a) personal data that is being processed by or on behalf of the data user and whether it is obligatory or voluntary for the individual to supply the personal data and, where it is obligatory for the individual to supply the personal data, the consequences that the individual may face if the individual fails to supply the personal data, (b) the purposes for which the personal data is being or is