Data, privacy and AI rules

Due in 60 days12Regulations190

12 due in 60 days · 190 regulations

Malaysia Online Safety Act

In force Malaysia · In force Jan 1, 2026 · next deadline Dec 28, 2026 (in 2 months)

Official text
Add to calendar
Apple Calendar or OutlookGoogle Calendar Download .ics

Deadlines

Coming up
ComplianceDec 28 · in 2 months · Source
Online Safety Plan due to MCMCLicensed providers must prepare an Online Safety Plan and submit it to MCMC within 180 days of 1 July 2026. Updates are due each year and after material changes.
Already passed
Takes effectJul 1 · 4 months ago · Source
Online Safety Plan and compounding regulations in forceP.U. (A) 244/2026 and P.U. (A) 245/2026 take effect.
Takes effectJan 1 · 10 months ago · Source
Online Safety Act and first regulations in forceThe Act and the Period, Fees, Form of Undertaking and Appeal Tribunal regulations take effect.

Summaries for reference, not legal advice. Check the official text.

What it does

Puts duties on licensed application service providers and content application service providers to reduce users' exposure to harmful content. They must issue user guidelines, give users safety tools and reporting channels, protect child users, make priority harmful content (such as child sexual abuse material) inaccessible, and prepare an Online Safety Plan. An Online Safety Appeal Tribunal hears appeals.

Who it applies to
Application service providers and content application service providers licensed under Malaysia's communications licensing regime, including large social media and messaging platforms operating in Malaysia.
Penalties
Fines of up to MYR 1 million for many offences, with lower caps (MYR 100,000 to MYR 500,000) for others. Offences can be compounded under the 2026 compounding regulations.
Enforced by
Malaysian Communications and Multimedia Commission (MCMC)
Official name
Online Safety Act 2025 (Act 866)
Citation
Act 866; commencement P.U. (B) 449/2025
Topics
Online safety, Children
Verified 2026-09-25 lom.agc.gov.my lom.agc.gov.my lom.agc.gov.my
Research notes

Royal Assent 2025-05-06; published 2025-05-22. The 2026-12-28 date is 180 days after the 2026-07-01 start of the Online Safety Plan Regulations. Providers licensed after that date have 180 days from licence start.

Related

AmendedAustralia
Australia Online Safety ActSets up the eSafety Commissioner and removal schemes for cyber-bullying of children, adult cyber-abuse, non-consensual intimate images and abhorrent violent material. It also sets Basic Online Safety Expectations with reporting duties, and binding industry codes and standards. The Unlawful Material codes and standards cover class 1A and 1B material such as child sexual exploitation and pro-terror content. The Age-Restricted Material codes cover class 1C and class 2 material such as online pornography, and require age assurance and other measures to protect children.In effect since Jan 23, 2022
AmendedAustralia
Australia Privacy ActAustralia's federal privacy law (13 Australian Privacy Principles, Notifiable Data Breaches scheme). The 2024 amendment adds a statutory tort for serious invasions of privacy, tiered civil penalties and infringement notices, a mandate for a Children's Online Privacy Code, clearer security duties, and privacy-policy transparency for substantially automated decisions from 10 December 2026. It also adds criminal doxxing offences.Next: Dec 10 Children's Online Privacy Code must be registered · in 44 days
In forceAustralia
Australia Social Media Minimum AgeRequires providers of age-restricted social media platforms to take reasonable steps to stop Australians under 16 from having accounts. Platforms may not rely only on government ID for age assurance, and must protect data collected for age checks and destroy it after use. eSafety has named platforms including Facebook, Instagram, Snapchat, TikTok, X, YouTube, Reddit, Threads, Twitch and Kick.In effect since Dec 10, 2025
In forceChina
China AI Content Labeling MeasuresRequires generative AI service providers to add explicit (visible) labels to AI-generated text, images, audio, video and virtual scenes, and implicit labels (metadata) to generated files. Content distribution platforms must detect and label AI-generated content, and app stores must check labeling functions when apps are listed. A mandatory national standard (GB 45438-2025) takes effect on the same date.In effect since Sep 1, 2025
In forceChina
China Algorithmic Recommendation ProvisionsRegulates recommendation, ranking, personalization, generation and dispatch algorithms used in internet services in China. Users must be able to switch off personalized recommendations and manage tags, and providers may not use algorithms for price discrimination or to induce addiction. Providers with public opinion attributes or social mobilization capacity must file their algorithms with the CAC within 10 working days of launching a service.In effect since Mar 1, 2022
In forceChina
China Anthropomorphic AI MeasuresRegulates AI companion and emotional interaction services that simulate human personality. Providers must tell users they are talking to AI, remind users after every 2 hours of use, intervene in crises such as self-harm, offer easy exit, and may not offer virtual partner or relative services to minors. Users' interaction data may not be shared or used for training on sensitive data without consent, and services with 1 million registered or 100,000 monthly active users need a security assessment filed with the provincial CAC.In effect since Jul 15, 2026
In forceChina
China Deep Synthesis ProvisionsRegulates deepfakes and other deep synthesis services such as synthetic text, voice cloning, face swapping and immersive scenes. Providers must verify user identity, review content, add technical marks to generated content, and add prominent labels where content could confuse the public. Providers with public opinion attributes must file algorithms, and app stores must check filings and security assessments.In effect since Jan 10, 2023
In forceChina
China Generative AI MeasuresChina's main rule for generative AI services offered to the public in China. Providers must use lawfully sourced training data, respect IP and personal information rights, label generated content, handle illegal content, and protect minors. Services with public opinion attributes or social mobilization capacity need a security assessment and algorithm filing.In effect since Aug 15, 2023
Questions about Malaysia Online Safety Act
What are the Malaysia Online Safety Act compliance deadlines?
Jan 1, 2026: Online Safety Act and first regulations in force. Jul 1, 2026: Online Safety Plan and compounding regulations in force. Dec 28, 2026: Online Safety Plan due to MCMC.
When does Malaysia Online Safety Act take effect?
Malaysia Online Safety Act took effect on Jan 1, 2026. The next milestone is Dec 28, 2026: Online Safety Plan due to MCMC.
Who does Malaysia Online Safety Act apply to?
Application service providers and content application service providers licensed under Malaysia's communications licensing regime, including large social media and messaging platforms operating in Malaysia.
What are the penalties under Malaysia Online Safety Act?
Fines of up to MYR 1 million for many offences, with lower caps (MYR 100,000 to MYR 500,000) for others. Offences can be compounded under the 2026 compounding regulations.