For over a decade, Malaysia's Personal Data Protection Act 2010 (PDPA) was viewed by many international observers as a "soft touch" regime—functional, but