Malaysia Cyber Security Act
In force Malaysia · In force Aug 26, 2024 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Malaysia's first standalone cybersecurity law. It sets up the National Cyber Security Committee, gives powers to the Chief Executive of NACSA, and places duties on national critical information infrastructure (NCII) sector leads and entities. NCII entities must follow codes of practice, run a risk assessment at least once a year and an audit at least once every two years, and notify cybersecurity incidents within 6 hours. Cybersecurity service providers must be licensed.
- Who it applies to
- Government and private NCII sector leads and NCII entities in 11 sectors, and providers of licensable cybersecurity services in Malaysia.
- Penalties
- Fines of up to MYR 500,000 and up to 10 years in prison for the most serious offences. Other offences carry fines of MYR 100,000 to MYR 200,000 and up to 2 or 3 years in prison.
- Enforced by
- National Cyber Security Agency (NACSA), National Security Council, Prime Minister's Department
- Official name
- Cyber Security Act 2024 (Act 854)
- Citation
- Act 854; commencement P.U. (B) 334/2024
- Topics
- cybersecurity, breach-notification
Research notes
Royal Assent 2024-06-18; gazetted 2024-06-26. The incident regulations (P.U. (A) 220/2024) require initial notice within 6 hours and full details within 14 days. P.U. (A) 219/2024 sets the risk assessment (yearly) and audit (every two years) cycle. An exemption order, P.U. (A) 47/2025, was published 2025-01-28.
Related
Questions about Malaysia Cyber Security Act
- What are the Malaysia Cyber Security Act compliance deadlines?
- Aug 26, 2024: Act 854 and first regulations in force.
- When does Malaysia Cyber Security Act take effect?
- Malaysia Cyber Security Act took effect on Aug 26, 2024.
- Who does Malaysia Cyber Security Act apply to?
- Government and private NCII sector leads and NCII entities in 11 sectors, and providers of licensable cybersecurity services in Malaysia.
- What are the penalties under Malaysia Cyber Security Act?
- Fines of up to MYR 500,000 and up to 10 years in prison for the most serious offences. Other offences carry fines of MYR 100,000 to MYR 200,000 and up to 2 or 3 years in prison.