A data controller or a data processor must appoint one or more DPOs, if their processing of personal data involves: personal data exceeding 20,000 data subjects; ... //daftar.pdp.gov.my. ...