The Online Safety Act 2025: Who It Binds and What It Demands

Malaysia’s Online Safety Act 2025 is frequently described as a social media law. It is not, quite. It is a licensee-conduct law, and the difference decides whether it reaches you at all.

Act 866 received Royal Assent on 6 May 2025 and was gazetted on 22 May 2025, but did nothing until the Minister appointed 1 January 2026 as its commencement date by P.U.(B) 449/2025, dated 8 December 2025 and gazetted 12 December 2025. Since then seven subsidiary instruments have been gazetted — one more than most current commentary records.

Who does Act 866 bind?

Section 2(1) applies the Act to any applications service using internet access service that enables communications between users, any content applications service providing content over internet access, and any network service.

But the substantive duties in Part III fall on a licensed applications service provider and a licensed content applications service provider — and s.4 defines both by reference to being licensed under the Communications and Multimedia Act 1998. No CMA licence, no Part III duties.

Two carve-outs matter:

• Section 2(2) excludes private messaging features. Section 2(3) defines that as a feature letting a user communicate content to a specific and limited number of recipients determined by the user.
• Section 3 gives the Act extra-territorial reach, but s.3(2) qualifies it: it reaches a person outside Malaysia who provides a service in a place within Malaysia and is a licensee under Act 588. The extra-territoriality tracks the licence, not the audience.

What content is regulated?

The First Schedule lists nine categories of harmful content: child sexual abuse material as defined in s.4 of the Sexual Offences against Children Act 2017; financial fraud; obscene content; indecent content; content causing harassment, distress, fear or alarm; content inciting violence or terrorism; content inducing a child to self-harm; content promoting ill-will or hostility or disturbing public tranquility; and content promoting the use or sale of dangerous drugs.

Three notes carve out educational and awareness material on financial fraud and drug abuse, and material portraying private parts for education, scientific or medical purposes.

The Second Schedule is short: priority harmful content means only paragraphs 1 and 2 of the First Schedule — child sexual abuse material and financial fraud. Everything else is harmful content on the slower track.

The eight duties in Part III

Section	Duty
13	Implement measures specified in the code to mitigate exposure to harmful content, without unreasonably limiting expression
14	Issue user guidelines describing those measures plus terms of use
15	Provide tools and settings letting users manage their own online safety
16	Provide a mechanism for users to report harmful content
17	Provide a user-assistance mechanism, accessible and responsive at all times
18	Protect child users, including age-appropriate defaults and controlled recommendation systems
19	Establish a mechanism to make priority harmful content inaccessible
20	Prepare an Online Safety Plan and submit a copy to MCMC

Sections 13 and 18 both allow alternative measures in place of the code’s, if the provider proves to MCMC’s satisfaction that the alternative mitigates risk better.

Section 18(3) is the sharpest of them for product teams: it requires measures to prevent a child accessing suspected harmful content, limit adult-to-child contact, limit features that increase, sustain or extend a child’s use of the service, hide a child’s personal information from adults, and control personalised recommendation systems for children.

The clocks

The Online Safety (Period) Regulations 2025 came into force with the Act on 1 January 2026 and are where compliance actually bites.

Trigger	Period
Acknowledge a user report (s.21(2)(a))	1 hour from receipt through official channel
Notify report status and assess the report (s.21(2)(b), (c))	12 hours from acknowledgment
Make suspected priority harmful content inaccessible (s.22(1))	24 hours
Make determined priority harmful content permanently inaccessible (s.22(3)(a))	1 hour from determination
Act on suspected harmful content (s.23(1))	4 hours from the report not being dismissed
Make determined harmful content permanently inaccessible (s.23(3)(a))	12 hours from determination
User inquiry after a dismissed report (s.21(5))	15 days
Provider’s decision on that inquiry (s.21(7))	7 days
Provider’s decision after an action inquiry (s.22(7))	5 days
User’s request for other online-safety information (s.17(2)(b))	7 days

Regulation 3 makes only two of these criminal: breaching the 1-hour priority-content removal in subitem 7(a), or the 12-hour harmful-content removal in item 12. Either is a fine up to RM1 million.

The Online Safety Plan

The Online Safety (Online Safety Plan) Regulations 2026 were gazetted on 30 June 2026 and came into operation 1 July 2026.

Regulation 2(1) gives licensees 180 days from 1 July 2026 to prepare a Plan and submit a copy to MCMC. Providers licensed after that date get 180 days from the effective date of their licence. Regulation 2(3) requires the Plan to be kept current and resubmitted every year, and at any time there is a material change to the service or to compliance obligations.

The Schedule prescribes the form. Part A takes provider identity, licence number, licence effective date, service type, service launch date and last update date. Part B walks each Part III duty and requires the specific actions taken plus compliance information.

Regulation 4 requires the appointment of one or more Online Safety officers. Regulation 5 makes contravention of the Regulations an offence with a fine up to RM1 million.

Enforcement, undertakings and appeals

MCMC may issue directions under s.30, but must first serve a notice specifying the required compliance and consider any submission. Directions are registered under s.31, and members of the public may inspect the register for RM100 or take copies at RM1 per page under the Fees Regulations 2025.

Section 36 lets a provider give a written undertaking before a notice of non-compliance is issued — the prescribed form is in the Online Safety (Form of Undertaking) Regulations 2025. Section 37 then governs the notice of non-compliance, which must state the financial penalty; s.38 allows a review by representation.

Section 39(2) sets the ceiling: a provider failing any Part III duty is liable to a financial penalty not exceeding ten million ringgit, recoverable as a civil debt.

Appeals go to the Online Safety Appeal Tribunal under Part VII, chaired by a High Court judge with at least two other members. The Tribunal Regulations 2025 require a notice of appeal within 45 days of service, with a filing fee of RM1,000, record of appeal at 50 sen per page, the decision at RM50 per copy and certified true copies at RM10 each. The chairman and members were appointed by P.U.(A) 255/2026, published 14 July 2026.

Common mistakes

Assuming the Act reaches any website with user comments. Part III binds licensees under Act 588. Licensing status is the gate.

Counting six subsidiary instruments. There are seven. The Appointment of Chairman and Members Order, P.U.(A) 255/2026, was published on 14 July 2026 and postdates most published summaries.

Treating all harmful content as urgent. The 1-hour and 24-hour clocks attach to priority harmful content — child sexual abuse material and financial fraud only. Everything else runs on 4 and 12 hours.

Reading s.39 as a fine. It is an administrative financial penalty imposed by MCMC and recoverable as a civil debt, not a court-imposed fine, and it sits alongside the criminal offences in the Period and Online Safety Plan Regulations.

Confusing this with licensing. Getting or not getting an ASP Class licence is decided under the Communications and Multimedia Act 1998. Act 866 assumes you already have one.

What’s next

If you hold a CMA licence, the immediate date is the Online Safety Plan deadline 180 days after 1 July 2026, and the immediate operational work is instrumenting the 1-hour acknowledgment and 1-hour priority-removal clocks — neither is achievable with a manual queue. Appoint the Online Safety officer required by regulation 4 at the same time.

If you do not hold one, the prior question is whether you need one at all, which is a Communications and Multimedia Act 1998 question rather than an Online Safety Act one.