# Do You Need a Licence to Sell Online in Malaysia?

> There is no e-commerce licence in Malaysia. What binds an online seller is business registration, the ten disclosures in the Consumer Protection (Electronic Trade Transaction) Regulations 2024 — which revoked the 2012 rules most guides still quote — and the PDPA duties that arrived in 2025.

- Category: business
- Language: en
- Status: published
- Updated: 2026-08-14
- Canonical: https://negaraku.md/en/business/online-business-licence-malaysia

---

There is no such thing as an e-commerce licence in Malaysia. No statute creates one, no
agency issues one, and no fee is payable for one.

There is, however, a much more expensive problem: **almost every guide to selling online
in Malaysia is citing revoked law.** The Consumer Protection (Electronic Trade
Transactions) Regulations 2012 were revoked on 25 December 2024. If your compliance
checklist has eight disclosure items on it, it is roughly eighteen months out of date.

## Why there is no licence — and how we know

KPDN administers ten Acts, none of which creates an e-commerce licence. Its own
**E-Commerce Regulatory Review** treats the licensing of e-commerce intermediaries as a
policy option that was considered and **not adopted**, and records MCMC's position that
e-commerce platforms are outside its jurisdiction and that s.126 of the Communications and
Multimedia Act 1998 is not used to license them.

That is a negative finding assembled from a statute list and a policy study rather than a
single official sentence — but it is the strongest evidence available, and it points one
way.

**The MCMC licensing that does exist is not about you.** Since 1 January 2025, social media
services and internet messaging services are class-licensable under P.U.(A) 205/2024. The
much-reported "8 million user" figure comes from P.U.(A) 206/2024 and is an **exemption**
threshold — providers with *fewer* than eight million Malaysian users are exempt. It is
routinely reported backwards, and it applies to platforms, not to sellers on them.

## Register the business

In Peninsular Malaysia, **ROBA 1956 s.2** defines business as "every form of trade,
commerce, craftsmanship, calling, profession, or other activity carried on for the purposes
of gain". Nothing in that turns on premises or stock. A person selling from a phone is
carrying on a business.

- **s.5(1)** — apply within **30 days** of commencement
- **s.11A** — display the certificate at the principal place of business; s.12(2) fine
  RM2,000 or six months
- **s.12(1)(a)** — carrying on an unregistered business: fine up to **RM50,000**,
  imprisonment up to **two years**, or both

The sanction almost nobody writes about is **s.8**. While the prescribed particulars of an
associate of the business are not on the register, no right of that person arising out of a
contract made in relation to the business is enforceable by suit, in any name. Relief comes
only on application to the High Court. An unregistered online seller who gets stiffed by a
supplier starts the dispute unable to sue on the contract.

**ROBA 1956 applies to Peninsular Malaysia only** (s.1(2), extended to Labuan in 1996);
Sabah and Sarawak never adopted it. Sellers there register under state instruments instead:
in **Sarawak**, the Business Names Ordinance (Cap. 64) and the Business, Professions and
Trade Licensing Ordinance (Cap. 33); in **Sabah**, business and trade registration runs
through the Trades Licensing Ordinance (Sabah Cap. 144), administered by the local
authorities.

## What must appear on the listing — the ten items

The current instrument is the **Consumer Protection (Electronic Trade Transaction)
Regulations 2024, P.U.(A) 449/2024**, made under s.150(2)(a) of the Consumer Protection Act
1999, made 20 December 2024 and in force **25 December 2024**. Regulation 10 revokes the
2012 regulations outright.

**Regulation 2** defines an *online marketplace* as "any electronic trade platform that is
conducted through electronic means by any supplier", and an *online marketplace supplier* as
"any person who conducts a trade or advertisement through an online marketplace". On its face
that wording is broad enough to reach a seller's own website, not only third-party platforms
like Shopee or Lazada — but KPDN has published no interpretive guideline settling the point,
so whether a proprietary e-shop is caught remains genuinely open.

The Schedule to regulation 3 requires the **online marketplace supplier** to disclose:

1. Name of the supplier or company
2. Website address of the online marketplace, **if any**
3. Email address **and** telephone number
4. Address of the trade or advertisement
5. Description of the main characteristics of the goods or services
6. Full price including transportation costs, taxes and any other cost
7. Method of payment
8. Terms and conditions of the sale and purchase
9. Estimated time of delivery
10. Certificate that the goods or services meet safety and health standards determined by
    the competent authority, **if any**

**Three changes catch people out.**

**Regulation 4 requires the disclosures to be in the national language**, with other
languages permitted in addition. There was no equivalent in 2012, and an English-only
product page does not comply.

**The business or company registration number is no longer a disclosure item.** It moved to
regulation 8(1)(c), as a record the *operator* must keep. Displaying it remains sensible;
it is no longer what the Schedule requires.

**Regulation 6(1)(a) now requires a means to rectify errors "prior to or after the
confirmation of the order".** The 2012 version stopped at *prior to*. Regulation 6(1)(b)
still requires acknowledgement of receipt without undue delay.

Regulation 5 is new: the supplier bears the cost of re-delivery where goods are materially
different or defective, or must provide services reasonably fit for purpose.

## Records, and who keeps them

**Three years, not two.** Regulation 8(1) puts on the **operator** a duty to keep the
supplier's name, address, telephone number, **IC or passport number**, **business account
number** and email; the website address; the trade or company name and registration number;
and the records of electronic trade transactions or advertisements. Regulation 8(2) extends
the transaction and advertisement record duty to the **supplier**.

Regulation 7 is the operator's gatekeeping duty — ensure the supplier complies with
regulation 3 **before** any transaction is permitted, provide a complaints channel, and
ensure advertisements comply. This is why marketplaces chase you for documents: they are
discharging their own obligation, not certifying yours.

**Penalty — and here the law is genuinely unsettled.** Regulation 9 provides that "any
person who fails to comply with any provision of these Regulations commits an offence", but
prescribes no penalty of its own. Two routes could fill the gap, and no case law resolves
which governs. On one reading the general penalty in **s.145 of the Consumer Protection Act
1999** applies — an individual up to RM50,000 or three years, rising to RM100,000 or five
years; a body corporate up to RM100,000, rising to RM200,000; plus up to RM1,000 for each
day a continuing offence persists. But **s.150(3)** sets a *dedicated* regime for offences
created by subsidiary legislation under the Act — a fine up to RM100,000 or three years,
rising to RM250,000 or six years for a second or subsequent offence. Because P.U.(A) 449 set
no penalty of its own under s.150(3), whether the fallback is s.145 (as "an offence under
this Act for which no penalty is expressly provided") or the unused s.150(3) route is open.

That also explains the figures other guides cite. **RM250,000** is the s.150(3)
subsequent-offence cap for subsidiary-legislation offences; **RM500,000** is the separate
s.16(4) PDPA penalty for processing personal data within a prescribed class without a valid
data-controller registration certificate — not fabrications, but different provisions.

## The data protection layer that arrived in 2025

The Personal Data Protection (Amendment) Act 2024 (**Act A1727**, not A1717 — that is the
Free Zones amendment) commenced in three tranches under P.U.(B) 522/2024:

| Date | What changed |
| --- | --- |
| 1 Jan 2025 | Registrar becomes Commissioner; electronic service provisions |
| 1 Apr 2025 | **Data user becomes data controller**; the Security Principle extends to data **processors**; the cross-border whitelist in s.129(1) is deleted |
| 1 Jun 2025 | **s.12A data protection officer**, **s.12B breach notification**, and s.43A data portability |

**The DPO threshold catches ordinary online retailers.** JPDP's February 2025 guideline,
read with Circular 1/2025, sets three limbs: more than 20,000 data subjects; more than
10,000 data subjects' sensitive personal data; or **regular and systematic monitoring**. The
guideline's own worked example of that third limb is a retail website using algorithms to
monitor searches and purchases and offer recommendations. If you run a recommendation
engine, volume does not save you. A DPO must be registered with the Commissioner within
21 days of appointment.

**Breach notification runs from occurrence, not awareness.** Notify the Commissioner as soon
as practicable and no later than **72 hours from the occurrence** of the breach, where it
causes or is likely to cause significant harm, or affects more than 1,000 data subjects.
Affected individuals must be told without unnecessary delay and no later than **seven days**
after the Commissioner is notified — and that limb is triggered by significant harm only,
not by the 1,000-subject scale test. Section 12B(3) carries a fine up to **RM250,000** or
two years.

**Registration as a data controller is a separate question again.** The Personal Data
Protection (Class of Data Users) Order 2013 (**P.U.(A) 336/2013**) lists the classes that
must register; class 9(b) covers a company or partnership "who conducts retail dealing and
wholesale dealing as defined under the Control of Supplies Act 1961". Because those terms are
tied to that Act — which governs controlled, scheduled supplies — whether an ordinary online
retailer *not* dealing in controlled goods falls within class 9(b) is genuinely open, and
JPDP has published no interpretation. JPDP's **Circular 1/2026** (in force 1 June 2026, and
revoking the 2024 circular) restates the registration and renewal duty: processing personal
data within a prescribed class without a valid registration certificate is an offence under
**s.16(4)** with a fine up to **RM500,000** or three years, and continuing to process after a
certificate lapses is an offence under reg 5(2) of P.U.(A) 337/2013 with a fine up to
**RM250,000** or two years. This registration duty is distinct from the s.12A DPO threshold
above.

## The product still decides the licence

Selling online changes the channel, not the regulator. Food, cosmetics, supplements, medical
devices, alcohol, tobacco and financial products answer to the same authority whether they
leave a shop or a listing. Importing your own stock puts you inside the Customs (Prohibition
of Imports) Order 2023, where some goods need an import licence and others a prescribed
certificate.

## Common mistakes

- **Working from the 2012 regulations.** They were revoked on 25 December 2024. Eight
  disclosure items is the old law.
- **English-only product pages.** Regulation 4 requires the national language.
- **Two-year record retention.** It is three, and the field list is longer.
- **Assuming a hobby is not a business.** ROBA turns on activity carried on for gain.
- **Assuming the PDPA is only for big companies.** The monitoring limb has no volume floor.
- **Treating the marketplace's document request as the legal test.** That is regulation 7,
  their duty, not yours.

## What's next

Do three things this week. Re-read your product page against the ten Schedule items and put
the disclosures into Bahasa Malaysia. Extend record retention to three years and add the
fields regulation 8 now names. Then work out honestly whether anything you do amounts to
regular and systematic monitoring — because if it does, the DPO duty has been live since
1 June 2025.

## Sources

- Consumer Protection (Electronic Trade Transaction) Regulations 2024, P.U.(A) 449/2024 — https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/2587477/PUA%20449%20(2024).pdf (Attorney General's Chambers)
- Registration of Businesses Act 1956 (Act 197), as at 1 June 2017 — https://www.ssm.com.my/Pages/Legal_Framework/Document/ROBA%201956_Act%20197_as%20at%201%20June%202017.pdf (SSM)
- Consumer Protection Act 1999 (Act 599) — https://lom.agc.gov.my/ilims/upload/portal/akta/outputaktap/1690994_BI/011121_Act%20599_final.pdf (Attorney General's Chambers)
- Personal Data Protection (Amendment) Act 2024 (Act A1727) — commencement, P.U.(B) 522/2024 — https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/2587515/PUB%20522_2024.pdf (Attorney General's Chambers)
- Garis Panduan Perlindungan Data Peribadi — Pelantikan Pegawai Perlindungan Data — https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2025/02/GARIS-PANDUAN-PERLINDUNGAN-DATA-PERIBADI_PELANTIKAN-PEGAWAI-PERLINDUNGAN-DATA.pdf (Jabatan Perlindungan Data Peribadi)
- KPDN E-Commerce Regulatory Review — https://www.kpdn.gov.my/images/2025/pengumuman/KPDN-E-Com-Review-FINAL-BM.pdf (KPDN)
- Personal Data Protection (Class of Data Users) Order 2013 [P.U.(A) 336/2013], consolidated — class 9(b) — https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2024/07/Perintah-Perlindungan-Data-Peribadi-.pdf (Jabatan Perlindungan Data Peribadi)
- Pekeliling Pesuruhjaya Perlindungan Data Peribadi Bilangan 1 Tahun 2026 (Pendaftaran Pengawal Data) — https://www.pdp.gov.my/ppdpv1/wp-content/uploads/2026/06/Pekeliling-Pesuruhjaya-Bil.1-2026.pdf (Jabatan Perlindungan Data Peribadi)
- JPDP landing page for Circular Bil. 1 Tahun 2026 (Pendaftaran Pengawal Data) — https://www.pdp.gov.my/ppdpv1/akta/pekeliling-pesuruhjaya-perlindungan-data-peribadi-bilangan-1-tahun-2026-pendaftaran-pengawal-data/ (Jabatan Perlindungan Data Peribadi)
- Business Names Ordinance (Laws of Sarawak, Chapter 64) — https://lawnet.sarawak.gov.my/lawnet_file/Ordinance/ORD_F-BUSINEcp64Lawnet(WH).pdf (Sarawak Lawnet (State Attorney-General's Chambers))
- Business, Professions and Trade Licensing Ordinance (Laws of Sarawak, Chapter 33) — https://lawnet.sarawak.gov.my/lawnet_file/Ordinance/ORD_F-PROFEScp33Lawnet(WH).pdf (Sarawak Lawnet (State Attorney-General's Chambers))
- Trades Licensing Ordinance (Sabah Cap. 144) — https://sagc.sabah.gov.my/sites/default/files/law/TradesLicensingOrdinance(SabahCap144).pdf (Sabah State Attorney-General's Chambers)
- Nanta: Sarawak, Sabah have not adopted Business Registration Act 1956 — https://www.theborneopost.com/2022/09/10/nanta-sarawak-sabah-have-not-adopted-business-registration-act-1956/ (Borneo Post (reporting KPDNHEP Minister))

---
Source of truth: https://github.com/negaraku-md/NegaraKu.md
License: CC BY-SA 4.0