Company: GCL
Filing Date: 2025-03-17
Form Type: DRS
Source: 0001213900-25-024502
Chunk: 131

Company: GCL Global Holdings Ltd
Filing Date: 2025-03-17
Form: DRS
Chunk 131
---
 transactions. The Malaysia PDPA
also applies to a person in respect of personal data if (a) the person is established in Malaysia and personal data is processed,
whether or not in the context of that establishment, by that person or any other person employed or engaged by that establishment, or
(b) the person is not established in Malaysia but uses equipment in Malaysia for processing the personal data, except for the purposes
of transit through Malaysia.

<div align='center'>78</div>

“Personal data” is statutorily defined
to mean any information in respect of commercial transactions, which (a) is being processed wholly or partly by means of equipment
operating automatically in response to instructions given for that purpose, (b) is recorded with the intention that it should wholly
or partly be processed by means of such equipment, or (c) is recorded as part of, or with the intention that it should form a part
of, a relevant filing system that relates directly or indirectly to a data subject (i.e., an individual who is the subject of the personal
data) who is identified or identifiable from that information or from that and other information in the possession of a data user, including
any sensitive personal data and expression of opinion about the data subject. “Personal data” does not include any information
that is processed for the purpose of a credit reporting business carried on by a credit reporting agency under the Credit Reporting Agencies
Act 2010 of Malaysia.

Under the Malaysia PDPA, a “data user”
is a person who either alone or jointly, or in common with other persons, processes any personal data or has control over, or authorizes
the processing of, any personal data but does not include a processor. The Malaysia PDPA provides that data users must adhere to the following
principles with respect to the processing of personal data:

| (a) | the general principle; |

| (b) | the notice and choice principle; |

| (c) | the disclosure principle; |

| (d) | the security principle; |

| (e) | the retention principle; |

| (f) | the data integrity principle; and |

| (g) | the access principle. |

In general, to process or disclose personal data
relating to any individuals would require (i) consent from such individuals, particularly pertaining to sensitive personal data,
which may be obtained in any form that can be recorded and maintained properly by the data user; and (ii) written notice to such