Section 4.2 of the "Code of Conduct (Best Practice) for Internet Messaging Service Providers and Social Media Service Providers" stipulates that Internet messaging and social media service providers shall: establish clear, comprehensive, and resilient systems, mechanisms, and procedures to ensure the prompt identification, evaluation, and removal of harmful content; maintain a dedicated, locally based content moderation team within Malaysia that is consistently available and adequately trained and supported; and prevent and eradicate child sexual abuse material by immediately reporting any identified harmful content to the relevant law enforcement authorities, including the Commission, and ensuring its removal within 24 hours of such reporting, or otherwise handling the material in accordance with the directions issued by the competent law enforcement agency or agencies.

It is reported that access to Grindr began to be blocked in Malaysia on 17 April 2024. Although the restriction has not been implemented uniformly across all networks, it has continued into 2025.

According to the guidelines issued by the Malaysian Communications and Multimedia Commission (MCMC), Content Applications Service Providers (CASP) and Applications Service Providers (ASP) must obtain the relevant licenses to operate in Malaysia. In assessing the shareholding structure of an applicant, the MCMC considers the need to promote local small and medium-sized enterprises (SMEs) of Malaysian origin within the information and communications technology industry.
Furthermore, under Part IV of the Communications and Multimedia (Licensing) Regulations 2000, as amended in April 2022, a new licensed category was introduced for cloud service providers and data centres hosting cloud service applications under the ASP classification. Cloud service providers with a local presence are required to apply for an ASP license and are permitted to remain fully foreign-owned. However, cross-border suppliers of cloud services without a local presence do not need to register or obtain ASP licenses.

Under Section 3 of the "Communications and Multimedia (Licensing) (Exemption) (Amendment) Order 2024", providers of social media platforms and internet messaging services with more than eight million users in Malaysia are required to obtain a licence.

According to the Certification Requirements for Compliance Approval on Communication, Multimedia, and Hybrid Equipment, import licenses are required for hybrid ICT products. These include those devices with multiple features, including toys, medical devices, and computer products.

Section 245.5 of the Companies Act stipulates that a company may maintain certain accounting and other operational records outside the country only provided that a copy of these records is accessible at a place within Malaysia for inspection by the directors at all times. The records must be kept for at least seven years after the completion of the transactions or operations to which they relate.

Section 82.8 of the Income Tax Act 1967 states that all records that relate to any business in Malaysia shall be kept and retained in Malaysia. 

Pursuant to Section 129 of the Personal Data Protection Act, a data controller is permitted to transfer personal data to a location outside Malaysia, provided that the receiving jurisdiction possesses legal provisions that are substantially similar to, or offer a level of personal data protection equivalent to, those prescribed by the Act. Transfers are also allowed under other limited conditions, including the data subject's consent.

Malaysia has joined an agreement with binding commitments to open transfers of data across borders: the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11).

The Personal Data Protection Act provides a comprehensive regime of data protection in Malaysia.

Section 12a of the Personal Data Protection Act requires both data controllers and data processors to designate at least one data protection officer responsible for ensuring their respective compliance with the Act.

Section 116B of the Criminal Procedure Code provides that a police officer conducting a search under the Code must be given access to computerised data, whether stored in a computer or otherwise. For the purpose of this section, 'access' includes being provided with the necessary password, encryption code, decryption code, software or hardware and any other means required to enable comprehension of the computerised data. It is not clear whether a court order is needed to access the information.

Although no general limits are placed on foreign equity ownership in the telecommunications sector, a restriction applies in the case of a single government‑controlled company. It is reported that the national telecommunications company, Telekom Malaysia, is subject to a foreign ownership ceiling of 30%, with individual investors permitted to hold no more than 5%.

It is reported that more than 50% of the shares of Telekom Malaysia, Malaysia's incumbent telecommunications operator, are owned by sovereign wealth funds, boards and companies linked to the government or state-owned enterprises. As of 2025, the government also retains a minority shareholding in the telecommunications company Digital Nasional Berhad, amounting to a 41.67% stake.

It is reported that Malaysia does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there has been an obligation of accounting separation since 2016.