Malaysia has not adopted national legislation based on or influenced by the United Nations Commission on International Trade Law (UNCITRAL) Model Law on Electronic Signatures.

Section 4.2 of the "Code of Conduct (Best Practice) for Internet Messaging Service Providers and Social Media Service Providers" stipulates that Internet messaging and social media service providers shall: establish clear, comprehensive, and resilient systems, mechanisms, and procedures to ensure the prompt identification, evaluation, and removal of harmful content; maintain a dedicated, locally based content moderation team within Malaysia that is consistently available and adequately trained and supported; and prevent and eradicate child sexual abuse material by immediately reporting any identified harmful content to the relevant law enforcement authorities, including the Commission, and ensuring its removal within 24 hours of such reporting, or otherwise handling the material in accordance with the directions issued by the competent law enforcement agency or agencies.

It is reported that access to Grindr began to be blocked in Malaysia on 17 April 2024. Although the restriction has not been implemented uniformly across all networks, it has continued into 2025.

According to the guidelines issued by the Malaysian Communications and Multimedia Commission (MCMC), Content Applications Service Providers (CASP) and Applications Service Providers (ASP) must obtain the relevant licenses to operate in Malaysia. In assessing the shareholding structure of an applicant, the MCMC considers the need to promote local small and medium-sized enterprises (SMEs) of Malaysian origin within the information and communications technology industry.
Furthermore, under Part IV of the Communications and Multimedia (Licensing) Regulations 2000, as amended in April 2022, a new licensed category was introduced for cloud service providers and data centres hosting cloud service applications under the ASP classification. Cloud service providers with a local presence are required to apply for an ASP license and are permitted to remain fully foreign-owned. However, cross-border suppliers of cloud services without a local presence do not need to register or obtain ASP licenses.

Under Section 3 of the "Communications and Multimedia (Licensing) (Exemption) (Amendment) Order 2024", providers of social media platforms and internet messaging services with more than eight million users in Malaysia are required to obtain a licence.

According to the Certification Requirements for Compliance Approval on Communication, Multimedia, and Hybrid Equipment, import licenses are required for hybrid ICT products. These include those devices with multiple features, including toys, medical devices, and computer products.

It is reported that in Malaysia, electromagnetic compatibility (EMC) requirements for communication equipment require the equipment to be physically submitted to the national regulator or its delegated body, SIRIM QAS, for formal certification. In contrast, electromagnetic interference (EMI) remains outside any mandatory assessment regime.
SIRIM QAS International is the sole certifying agency appointed by the Malaysian authority. Type Approval is mandatory for a communications product before it can be sold in Malaysia. Among the products that need to be certified are netbooks, tablet PC, mobile phones, security devices, smart TVs, WiFi/3G/Bluetooth modules and broadcasting equipment. Foreign applicants shall appoint a local management representative in Malaysia to be responsible for the Type Approval application. As a member of the Asia-Pacific Economic Cooperation Mutual Recognition Arrangement (APEC-MRA), Malaysia accepts product approvals issued by APEC members.

Pursuant to Section 40 of the Cyber Security Act, an authorised officer who is satisfied, on the basis of information received, that there is reasonable cause to believe a delay in obtaining a search warrant would adversely affect an investigation or risk the tampering, removal, damage, or destruction of evidence may enter premises without a warrant and exercise full investigative powers, including the search for and seizure of any book, account, document, or computerised data, as well as any facility, apparatus, vehicle, equipment, or device. Section 46 further provides that an authorised officer conducting such a search must be granted access to computerised data, whether stored on a computer or otherwise, and must be furnished with any password, encryption or decryption code, software, hardware, or other means required to comprehend that data; the section does not mandate the issuance of a court order. Under Section 2, an “authorised officer” includes any police officer, regardless of rank, and any public officer authorised by the Minister responsible for cyber security. Additionally, Section 14 empowers the Chief Executive of the National Cyber Security Agency to direct any person to produce any document, whether in physical or electronic form, and this provision likewise contains no requirement for judicial authorisation.

Part VIB of the Copyright Act establishes a safe harbour regime for intermediaries for copyright infringements.

A basic legal framework on intermediary liability beyond copyright infringement is absent in Malaysia's law and jurisprudence.

It is reported that Malaysia imposes an identity requirement for SIM registration. Anyone wanting to purchase a SIM card has to provide their national ID card or a passport in case of foreigners to activate a new prepaid SIM card.

Applications for individual licenses are reportedly assessed on a case-by-case basis. The Minister may grant a license based on the recommendations of the Malaysian Communications and Multimedia Commission (MCMC) under the Communications and Multimedia Act (CMA), taking into account the specified documents outlined in Regulation 7 of the Communications and Multimedia (Licensing) Regulations 2000. Applicants must submit an application to the MCMC, provide supporting documentation, and pay an application fee of RM 10,000 (approx. 2,000 USD) per individual license. The MCMC then has 60 days to evaluate the application and make a recommendation to the Minister, who has 30 days to approve it.
It is reported that the acquisition of a licence in the telecommunications sector is subject to various restrictions, including a legally prescribed limit on the number of licences that may be issued, minimum capital requirements for applicants, and other regulatory conditions.

Malaysia has only partially appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

According to the Malaysian Communications And Multimedia Commission Act 1998, the Malaysian Communications and Multimedia Commission, the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

Section 4.1 of the National Cloud Computing Policy stipulates that confidential data must be stored exclusively within sovereign cloud zones located in Malaysia. This requirement encompasses classified governmental documents as well as data pertaining to national critical information infrastructure. The term national critical information infrastructure refers to any computer or computer system whose disruption or destruction would adversely affect the provision of services essential to Malaysia’s security, defence, foreign relations, economy, public health, public safety, or public order, or would impair the capacity of the Federal Government or any State Government to discharge its functions effectively.