# The Online Safety Act 2025: Who It Binds and What It Demands

> Act 866 commenced 1 January 2026 and binds licensed applications and content applications service providers — not ordinary businesses. Seven subsidiary instruments now set the clocks, the Online Safety Plan and the RM10 million financial penalty.

- Category: business
- Language: en
- Status: published
- Updated: 2026-07-20
- Canonical: https://negaraku.md/en/business/online-safety-act-malaysia

---

Malaysia's Online Safety Act 2025 is frequently described as a social media law. It is not, quite. It is a **licensee-conduct** law, and the difference decides whether it reaches you at all.

Act 866 received Royal Assent on 6 May 2025 and was gazetted on 22 May 2025, but did nothing until the Minister appointed **1 January 2026** as its commencement date by P.U.(B) 449/2025, dated 8 December 2025 and gazetted 12 December 2025. Since then seven subsidiary instruments have been gazetted — one more than most current commentary records.

## Who does Act 866 bind?

Section 2(1) applies the Act to any applications service using internet access service that enables communications between users, any content applications service providing content over internet access, and any network service.

But the substantive duties in Part III fall on a **licensed applications service provider** and a **licensed content applications service provider** — and s.4 defines both by reference to being licensed under the Communications and Multimedia Act 1998. No CMA licence, no Part III duties.

Two carve-outs matter:

- **Section 2(2) excludes private messaging features.** Section 2(3) defines that as a feature letting a user communicate content to a specific and limited number of recipients determined by the user.
- **Section 3** gives the Act extra-territorial reach, but s.3(2) qualifies it: it reaches a person outside Malaysia who provides a service in a place within Malaysia **and is a licensee under Act 588**. The extra-territoriality tracks the licence, not the audience.

## What content is regulated?

The **First Schedule** lists nine categories of harmful content: child sexual abuse material as defined in s.4 of the Sexual Offences against Children Act 2017; financial fraud; obscene content; indecent content; content causing harassment, distress, fear or alarm; content inciting violence or terrorism; content inducing a child to self-harm; content promoting ill-will or hostility or disturbing public tranquility; and content promoting the use or sale of dangerous drugs.

Three notes carve out educational and awareness material on financial fraud and drug abuse, and material portraying private parts for education, scientific or medical purposes.

The **Second Schedule** is short: priority harmful content means only paragraphs 1 and 2 of the First Schedule — child sexual abuse material and financial fraud. Everything else is harmful content on the slower track.

## The eight duties in Part III

| Section | Duty |
| --- | --- |
| 13 | Implement measures specified in the code to mitigate exposure to harmful content, without unreasonably limiting expression |
| 14 | Issue user guidelines describing those measures plus terms of use |
| 15 | Provide tools and settings letting users manage their own online safety |
| 16 | Provide a mechanism for users to report harmful content |
| 17 | Provide a user-assistance mechanism, accessible and responsive at all times |
| 18 | Protect child users, including age-appropriate defaults and controlled recommendation systems |
| 19 | Establish a mechanism to make priority harmful content inaccessible |
| 20 | Prepare an Online Safety Plan and submit a copy to MCMC |

Sections 13 and 18 both allow **alternative measures** in place of the code's, if the provider proves to MCMC's satisfaction that the alternative mitigates risk better.

Section 18(3) is the sharpest of them for product teams: it requires measures to prevent a child accessing suspected harmful content, limit adult-to-child contact, **limit features that increase, sustain or extend a child's use of the service**, hide a child's personal information from adults, and control personalised recommendation systems for children.

## The clocks

The Online Safety (Period) Regulations 2025 came into force with the Act on 1 January 2026 and are where compliance actually bites.

| Trigger | Period |
| --- | --- |
| Acknowledge a user report (s.21(2)(a)) | **1 hour** from receipt through official channel |
| Notify report status and assess the report (s.21(2)(b), (c)) | **12 hours** from acknowledgment |
| Make suspected priority harmful content inaccessible (s.22(1)) | **24 hours** |
| Make determined priority harmful content permanently inaccessible (s.22(3)(a)) | **1 hour** from determination |
| Act on suspected harmful content (s.23(1)) | **4 hours** from the report not being dismissed |
| Make determined harmful content permanently inaccessible (s.23(3)(a)) | **12 hours** from determination |
| User inquiry after a dismissed report (s.21(5)) | **15 days** |
| Provider's decision on that inquiry (s.21(7)) | **7 days** |
| Provider's decision after an action inquiry (s.22(7)) | **5 days** |
| User's request for other online-safety information (s.17(2)(b)) | **7 days** |

Regulation 3 makes only two of these criminal: breaching the 1-hour priority-content removal in subitem 7(a), or the 12-hour harmful-content removal in item 12. Either is a fine up to **RM1 million**.

## The Online Safety Plan

The Online Safety (Online Safety Plan) Regulations 2026 were gazetted on 30 June 2026 and came into operation **1 July 2026**.

Regulation 2(1) gives licensees **180 days from 1 July 2026** to prepare a Plan and submit a copy to MCMC. Providers licensed after that date get 180 days from the effective date of their licence. Regulation 2(3) requires the Plan to be kept current and resubmitted **every year**, and at any time there is a material change to the service or to compliance obligations.

The Schedule prescribes the form. Part A takes provider identity, licence number, licence effective date, service type, service launch date and last update date. Part B walks each Part III duty and requires the specific actions taken plus compliance information.

Regulation 4 requires the appointment of **one or more Online Safety officers**. Regulation 5 makes contravention of the Regulations an offence with a fine up to **RM1 million**.

## Enforcement, undertakings and appeals

MCMC may issue **directions** under s.30, but must first serve a notice specifying the required compliance and consider any submission. Directions are registered under s.31, and members of the public may inspect the register for RM100 or take copies at RM1 per page under the Fees Regulations 2025.

Section 36 lets a provider give a written **undertaking** before a notice of non-compliance is issued — the prescribed form is in the Online Safety (Form of Undertaking) Regulations 2025. Section 37 then governs the notice of non-compliance, which must state the financial penalty; s.38 allows a review by representation.

Section 39(2) sets the ceiling: a provider failing any Part III duty is liable to a financial penalty **not exceeding ten million ringgit**, recoverable as a civil debt.

Appeals go to the **Online Safety Appeal Tribunal** under Part VII, chaired by a High Court judge with at least two other members. The Tribunal Regulations 2025 require a notice of appeal within **45 days** of service, with a filing fee of RM1,000, record of appeal at 50 sen per page, the decision at RM50 per copy and certified true copies at RM10 each. The chairman and members were appointed by P.U.(A) 255/2026, published 14 July 2026.

## Common mistakes

**Assuming the Act reaches any website with user comments.** Part III binds licensees under Act 588. Licensing status is the gate.

**Counting six subsidiary instruments.** There are seven. The Appointment of Chairman and Members Order, P.U.(A) 255/2026, was published on 14 July 2026 and postdates most published summaries.

**Treating all harmful content as urgent.** The 1-hour and 24-hour clocks attach to *priority* harmful content — child sexual abuse material and financial fraud only. Everything else runs on 4 and 12 hours.

**Reading s.39 as a fine.** It is an administrative **financial penalty** imposed by MCMC and recoverable as a civil debt, not a court-imposed fine, and it sits alongside the criminal offences in the Period and Online Safety Plan Regulations.

**Confusing this with licensing.** Getting or not getting an ASP Class licence is decided under the Communications and Multimedia Act 1998. Act 866 assumes you already have one.

## What's next

If you hold a CMA licence, the immediate date is the Online Safety Plan deadline 180 days after 1 July 2026, and the immediate operational work is instrumenting the 1-hour acknowledgment and 1-hour priority-removal clocks — neither is achievable with a manual queue. Appoint the Online Safety officer required by regulation 4 at the same time.

If you do not hold one, the prior question is whether you need one at all, which is a Communications and Multimedia Act 1998 question rather than an Online Safety Act one.

## Sources

- Online Safety Act 2025 [Act 866] — https://lom.agc.gov.my/ilims/upload/portal/akta/outputaktap/2867049_BI/Act%20866-Online%20Safety%20Act%202025.pdf (Attorney General's Chambers)
- Online Safety Act 2025 — Appointment of Date of Coming into Operation [P.U. (B) 449/2025] — https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/3240953/PUB449_2025.pdf (Attorney General's Chambers)
- Online Safety (Period) Regulations 2025 [P.U. (A) 465/2025] — https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/3269307/PUA%20465_2025.pdf (Attorney General's Chambers)
- Online Safety (Online Safety Plan) Regulations 2026 [P.U. (A) 244/2026] — https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/3582105/PUA%20244_2026.pdf (Attorney General's Chambers)
- Online Safety (Online Safety Appeal Tribunal) Regulations 2025 [P.U. (A) 478/2025] — https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/3279049/PUA%20478_2025.pdf (Attorney General's Chambers)
- Online Safety (Compounding of Offences) Regulations 2026 [P.U. (A) 245/2026] — https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/3582943/PUA%20245_2026.pdf (Attorney General's Chambers)
- Online Safety (Fees) Regulations 2025 [P.U. (A) 466/2025] — https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/3274709/PUA%20466_2025.pdf (Attorney General's Chambers)
- Online Safety (Form of Undertaking) Regulations 2025 [P.U. (A) 469/2025] — https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/3276929/PUA%20469_2025.pdf (Attorney General's Chambers)
- Online Safety (Appointment of Chairman and Members of the Online Safety Appeal Tribunal) Order 2026 [P.U. (A) 255/2026] — https://lom.agc.gov.my/ilims/upload/portal/akta/outputp/3600538/PUA%20255_2026.pdf (Attorney General's Chambers)

---
Source of truth: https://github.com/negaraku-md/NegaraKu.md
License: CC BY-SA 4.0