Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Jurisdiction

Malaysia: data, AI and cyber laws

Part of APAC.

Regulations

Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics
In force
Malaysia Online Safety ActPuts duties on licensed application service providers and content application service providers to reduce users' exposure to harmful content. They must issue user guidelines, give users safety tools and reporting channels, protect child users, make priority harmful content (such as child sexual abuse material) inaccessible, and prepare an Online Safety Plan. An Online Safety Appeal Tribunal hears appeals.Next: Dec 28 Online Safety Plan due to MCMC · in 2 months
In force
Malaysia Cyber Security ActMalaysia's first standalone cybersecurity law. It sets up the National Cyber Security Committee, gives powers to the Chief Executive of NACSA, and places duties on national critical information infrastructure (NCII) sector leads and entities. NCII entities must follow codes of practice, run a risk assessment at least once a year and an audit at least once every two years, and notify cybersecurity incidents within 6 hours. Cybersecurity service providers must be licensed.In effect since Aug 26, 2024
Amended
Malaysia PDPAMalaysia's commercial-sector data protection law. The 2024 amendments, phased in during 2025, rename 'data users' as 'data controllers', add biometric data to sensitive data, apply the Security Principle directly to processors, replace the transfer whitelist with adequacy and safeguards tests, raise fines, and add mandatory DPOs, data breach notification and data portability.In effect since Nov 15, 2013

Upcoming deadlines

ComplianceDec 28 · in 2 months
Malaysia Online Safety ActOnline Safety Plan due to MCMCLicensed providers must prepare an Online Safety Plan and submit it to MCMC within 180 days of 1 July 2026. Updates are due each year and after material changes.Malaysia

Past deadlines

Takes effectJul 1 · 4 months ago
Malaysia Online Safety ActOnline Safety Plan and compounding regulations in forceP.U. (A) 244/2026 and P.U. (A) 245/2026 take effect.Malaysia
Takes effectJan 1 · 10 months ago
Malaysia Online Safety ActOnline Safety Act and first regulations in forceThe Act and the Period, Fees, Form of Undertaking and Appeal Tribunal regulations take effect.Malaysia
ComplianceJun 1, 2025 · 17 months ago
Malaysia PDPAPDPA amendments phase 3Mandatory DPO appointment, data breach notification, and data portability take effect.Malaysia
Takes effectApr 1, 2025 · 19 months ago
Malaysia PDPAPDPA amendments phase 2'Data controller' terminology, biometric data as sensitive data, higher penalties, Security Principle for processors, and removal of the cross-border whitelist take effect.Malaysia
Takes effectJan 1, 2025 · 22 months ago
Malaysia PDPAPDPA amendments phase 1Miscellaneous provisions commence (e.g. electronic service of notices).Malaysia
Takes effectAug 26, 2024 · 2.2 years ago
Malaysia Cyber Security ActAct 854 and first regulations in forceThe Act and its incident notification, risk assessment and audit, and licensing regulations take effect.Malaysia