Yes, firms must comply with Malaysia’s Personal Data Protection Act (PDPA) and ensure that AI tools handling sensitive data are governed by proper security, transparency, and ethical standards.