E-Commerce and Data Protection Laws: A Comparative Study of Malaysia, Singapore, and Australia

The increasing use of e-commerce in Malaysia, Singapore, and Australia has broadened the volume and types of personal data processed by online platforms, prompting closer attention to data protection frameworks. This study conducts a doctrinal and comparative analysis of the principal laws governing personal data protection in e-commerce across the three jurisdictions, including recent developments in Malaysia such as the introduction of mandatory personal data breach notification under Section 12B of the Personal Data Protection Act 2010 and the issuance of the 2025 Data Breach Notification Guideline. The research examines statutory requirements, regulatory structures, and procedural obligations to address three questions: the legal frameworks applicable to data protection in e-commerce; main divergence among Malaysia, Singapore, and Australia; and potential recommendations Malaysia may consider as its framework evolves. The findings indicate that although the jurisdictions share core data protection principles, differences arise in enforcement approaches, scope, governance mechanisms, and the management of sensitive information. Malaysia’s recent amendments reflect an expanding regulatory framework that introduces more structured breach notification and accountability processes. The comparative observations provide insight into how the three jurisdictions address similar regulatory challenges and may inform Malaysia’s ongoing regulatory development in the context of its growing digital economy.