Short Deadlines, Significant Penalties: Malaysia's Online Safety Act In Focus

• Published date: 07 July 2026
• Subject Matter: Corporate/Commercial Law, Media, Telecoms, IT, Entertainment, Privacy, Compliance, IT and Internet, Data Protection
• Law Firm: Mayer Brown
• Author: Ms Amita Kaur Haylock and Justin Lai

On 1 January 2026, Malaysia's online-safety framework came into force, comprised of the Online Safety Act 2025 ("ONSA") and four subsidiary instruments: the (Period) Regulations, Online Safety (Fees) Regulations, (Form of Undertaking) Regulations, and (Online Safety Appeal Tribunal) Regulations. Further to our previous Legal Update, Malaysia's Proposed Social Media Ban for Children: How It Compares with Australia and Singapore, these rules turn platform safety from a policy discussion into a set of legal duties, short response deadlines, and significant penalties.

ONSA stands out in the Asia-Pacific region because it is detailed and operational. It sets response periods as short as one hour and includes penalties that may affect both companies and individual officers. For many platforms, trust-and-safety functions will now need to be treated as a formal compliance function.

Scope and Definitions

ONSA applies to three categories of licensee under the Communications and Multimedia Act 1998 ("CMA"): applications service providers ("ASPs"), which enable user-to-user communications over internet access; content applications service providers ("CASPs"), which provide content over the internet; and network service providers ("NSPs").

Service providers that are not formally licensed may still be brought within scope where they are required or deemed to be registered under the CMA licensing framework, including through the deemed-registration mechanism for qualifying internet messaging and social media service providers pursuant to section 46A of the CMA. Specifically, from 1 January 2025, service providers with at least eight million Malaysian users were required to hold applications service provider class licences from the Malaysian Communications and Multimedia Commission ("MCMC"), rendering them now subject to ONSA.

Three further points regarding scope are particularly important:

• ONSA does not impose obligations on individual users;
• ONSA does not apply to private messaging features; and
• ONSA applies outside Malaysia when a person provides covered services in Malaysia and holds a CMA licence.

ONSA's scope is also determined with reference to content definitions, establishing when reporting, assessment and takedown obligations apply. ONSA's First Schedule lists nine categories of harmful content: child sexual abuse material ("CSAM"); financial fraud; obscene content; indecent content; content that may cause harassment, distress, fear or alarm through threatening, abusive or insulting words, communication or acts; content that may incite violence or terrorism; content that may induce a child to harm himself or herself; content that may promote ill-will, hostility or disturbance of public tranquillity; and content that promotes the use or sale of dangerous drugs. CSAM...