Malaysia has joined an agreement with binding commitments to open transfers of data across borders: the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11)

Data protection is primarily governed by the Personal Data Protection Act 2010, Malaysia's first comprehensive personal data protection legislation. It purports to safeguard personal data by requiring data users to comply with certain obligations and conferring certain rights to the data subject in relation to their personal data.

Section 129(1) of the Personal Data Protection Act (PDPA) prohibits a data user from transferring the personal data of a data subject to a place outside of Malaysia unless to places specified by the Minister, upon the recommendation of the Personal Data Protection Commissioner, by notification published in the Gazette. The Minister may specify such places that have any law in force which is substantially similar to the PDPA, serves the same purpose as the PDPA, or ensures an adequate level of protection in relation to the processing of personal data which is at least equivalent to the level of protection afforded by the PDPA. Section 129(3) of the PDPA provides exceptions whereby a data user may transfer any personal data to a place outside Malaysia if:
- the data subject has given their consent to the transfer;
- the transfer is necessary for the performance of a contract between the data subject and the data user;
- the transfer is necessary for the conclusion or performance of a contract between the data user and a third party which: is entered into at the request of the data subject; or is in the interests of the data subject;
- the transfer is for the purpose of any legal proceedings, obtaining legal advice or for establishing, exercising, or defending legal rights;
- the data user has reasonable grounds for believing that in all circumstances of the case: the transfer is for the avoidance or mitigation of adverse action against the data subject; it is not practicable to obtain the consent in writing of the data subject to that transfer; and where it is practicable to obtain consent, the data subject would have given their consent;
- the data user has taken all reasonable precautions and exercised all due diligence to ensure that personal data will not be processed in any manner which if that place were Malaysia, would be a contravention of the PDPA;
- the transfer is necessary in order to protect the vital interests of the data subject; or
- the transfer is necessary as being in the public interest in circumstances as determined by the Minister.

Section 36(2)(c) of the Goods and Services Tax Act creates a duty to keep records described in Section 36(1) in Malaysia, except as otherwise approved by the Director-General of the Royal Malaysian Customs Department. These include all records of goods and services provided by a taxable person, all imports records by the same, and, as per paragraph 133(c) of the Guide to Goods and Services Tax, any other supporting documents such as contracts or price quotations that affect or may affect said person's liability under the Act. Paragraph 134(b) of the Guide states that the requirements cover documents in electronic form.
Section 36(6) of the Act extends the requirements to certain non-taxable persons. Paragraph 135 of the Guide specifies that these include:
- any person who has ceased to be a taxable person and has made or may make a bad debt relief claim;
- imported services supplied to a recipient who is a non-taxable person for the purposes of business;
- goods of a taxable person sold by a non-taxable person to recover any debt owed by the taxable person;
- supply by auctioneer, who is a non-taxable person, in his own name on behalf of the principal/owner of the goods who is a taxable person; and
- a non-taxable person in Malaysia who receives goods in the course or furtherance of business, from an approved toll manufacturer.

Section 82(8) of the Income Tax Act 1967 states that all records that relate to any business in Malaysia shall be kept and retained in Malaysia. 

Under Section 167(3) of the Companies Act 1965, accounting and other such financial records pertaining to operations in Malaysia must be stored at the company's registered address or at any other such place in Malaysia. Section 167(5) of the Companies Act states that if records are kept at a place outside of Malaysia, pursuant to Section 167(4) regarding operations outside of Malaysia, these records must be made available in Malaysia if required by the Registrar.

Malaysia has only partially appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

According to Malaysian Communications And Multimedia Commission Act 1998, the Malaysian Communications and Multimedia Commission, the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

It is reported that Malaysia does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there is an obligation of accounting separation since 2016.

Malaysia allows full foreign equity participation in a license category of particular interest to foreign suppliers called “application service providers” (i.e., suppliers who do not own underlying transmission facilities). However, the country has not allowed equal liberalization of the network facilities provider or network service provider license categories. Only 70% foreign participation is permitted in those categories, although in certain instances Malaysia has allowed greater equity participation.

The Malaysian Government expected to liberalize these categories fully in 2020 as part of the National Fiberisation and Connectivity Plan (NFCP); however, the change in government led the NFCP to drop these changes in favor of the National Digital Infrastructure Plan (NDIP). It is not yet clear whether the NDIP will include further liberalization of these subsectors.

It is reported that more than 50% of the shares of Telekom Malaysia, Malaysia's incumbent telecommunications operator, are owned by sovereign wealth funds, boards and companies linked to the government or state-owned enterprises.

It is reported that there is an obligation for passive infrastructure sharing in Malaysia to deliver telecom services to end users.

Section 116B(1) of the Criminal Procedure Code (Act 593) provides police officers with a warrant from a magistrate with the power to be given access to encrypted data, including through the provision of a “necessary password, encryption code, decryption code, software or hardware and any other means required to enable comprehension of the computerised data”. Failure to comply is an offence punishable by imprisonment or a fine.

In Malaysia, trade secrets and confidential information are protected by the common law tort of breach of confidential information and/or by contract. Trade secrets are protected as long as they consistently meets the eligibility for being confidential information.
According to Art. 35 of the Trade Descriptions Act, any person who discloses or makes use of any confidential information or document with respect to a particular enterprise or the affairs of an individual obtained by virtue of any provision of this Act commits an offence. The law defines confidential information as trade, business or industrial information that belongs to any person, that has economic value and is not generally available to or known by others.

Malaysia has ratified the World Intellectual Property Organization (WIPO) Copyright Treaty.