Malaysia introduces cloud service regulation to increase accountability for user data security and sustainability of services

29 November 2021

On 16 October 2021, the Malaysian Communications and Multimedia Commission (“MCMC”) issued an advisory notice in relation to the implementation of a regulation relating to cloud services which will take effect from 1 January 2022. MCMC has defined the term “cloud services” as any service made available to end users on demand via the Internet from a cloud computing provider’s server. The aim of the regulation is to ensure cloud service providers maintain a high level of, among other things, data security, data privacy and data protection.

Key features of the regulation include:

• Cloud services will be licensed under the Applications Service Providers Class (“ASP (C)”) licence. 
• Persons providing cloud services via a local presence or a local data centre in Malaysia are required to be registered under an ASP (C) licence.
• The licensing requirement under the ASP (C) licence will be imposed on the provision of cloud services only. Web hosting and client server activity will remain exempted applications services under the Communications and Multimedia (Licensing) (Exemption) Order 2000.
• There will be no restriction on foreign shareholding under the ASP (C) licence.
• The ASP (C) licence will have a validity period of one year.

Further information, documents and checklists on the application for an ASP (C) licence can be downloaded from the MCMC website www.mcmc.gov.my.