Malaysia has only partially appended the World Trade Organization (WTO) Telecom Reference Paper to its schedule of commitments.

According to the Malaysian Communications And Multimedia Commission Act 1998, the Malaysian Communications and Multimedia Commission, the executive authority for the supervision and administration of services in the telecommunications sector, is independent from the government in the decision-making process.

Section 4.1 of the National Cloud Computing Policy stipulates that confidential data must be stored exclusively within sovereign cloud zones located in Malaysia. This requirement encompasses classified governmental documents as well as data pertaining to national critical information infrastructure. The term national critical information infrastructure refers to any computer or computer system whose disruption or destruction would adversely affect the provision of services essential to Malaysia’s security, defence, foreign relations, economy, public health, public safety, or public order, or would impair the capacity of the Federal Government or any State Government to discharge its functions effectively.

Pursuant to Section 24 of the Sales Tax Act 2018 and Section 24 of the Service Tax Act 2018, every taxable person is obligated to maintain comprehensive records of all transactions that may affect their liability to sales or service tax, as applicable. Such records must include, but are not limited to, documentation relating to the sale, importation, and exportation of taxable goods, as well as the provision of taxable services. These records are required to be retained for a period of seven years from the latest date to which the records pertain, and must be kept within Malaysia, unless the Director General of Customs and Excise grants approval for an alternative arrangement.

Section 245.5 of the Companies Act stipulates that a company may maintain certain accounting and other operational records outside the country only provided that a copy of these records is accessible at a place within Malaysia for inspection by the directors at all times. The records must be kept for at least seven years after the completion of the transactions or operations to which they relate.

Section 82.8 of the Income Tax Act 1967 states that all records that relate to any business in Malaysia shall be kept and retained in Malaysia. 

Pursuant to Section 129 of the Personal Data Protection Act, a data controller is permitted to transfer personal data to a location outside Malaysia, provided that the receiving jurisdiction possesses legal provisions that are substantially similar to, or offer a level of personal data protection equivalent to, those prescribed by the Act. Transfers are also allowed under other limited conditions, including the data subject's consent.

Malaysia has joined an agreement with binding commitments to open transfers of data across borders: the Comprehensive and Progressive Agreement for Trans-Pacific Partnership (CPTPP, Art. 14.11).

The Personal Data Protection Act provides a comprehensive regime of data protection in Malaysia.

Section 12a of the Personal Data Protection Act requires both data controllers and data processors to designate at least one data protection officer responsible for ensuring their respective compliance with the Act.

Section 116B of the Criminal Procedure Code provides that a police officer conducting a search under the Code must be given access to computerised data, whether stored in a computer or otherwise. For the purpose of this section, 'access' includes being provided with the necessary password, encryption code, decryption code, software or hardware and any other means required to enable comprehension of the computerised data. It is not clear whether a court order is needed to access the information.

Although no general limits are placed on foreign equity ownership in the telecommunications sector, a restriction applies in the case of a single government‑controlled company. It is reported that the national telecommunications company, Telekom Malaysia, is subject to a foreign ownership ceiling of 30%, with individual investors permitted to hold no more than 5%.

It is reported that more than 50% of the shares of Telekom Malaysia, Malaysia's incumbent telecommunications operator, are owned by sovereign wealth funds, boards and companies linked to the government or state-owned enterprises. As of 2025, the government also retains a minority shareholding in the telecommunications company Digital Nasional Berhad, amounting to a 41.67% stake.

It is reported that Malaysia does not mandate functional separation for operators with significant market power (SMP) in the telecom market. However, there has been an obligation of accounting separation since 2016.

Applications for individual licenses are reportedly assessed on a case-by-case basis. The Minister may grant a license based on the recommendations of the Malaysian Communications and Multimedia Commission (MCMC) under the Communications and Multimedia Act (CMA), taking into account the specified documents outlined in Regulation 7 of the Communications and Multimedia (Licensing) Regulations 2000. Applicants must submit an application to the MCMC, provide supporting documentation, and pay an application fee of RM 10,000 (approx. 2,000 USD) per individual license. The MCMC then has 60 days to evaluate the application and make a recommendation to the Minister, who has 30 days to approve it.
It is reported that the acquisition of a licence in the telecommunications sector is subject to various restrictions, including a legally prescribed limit on the number of licences that may be issued, minimum capital requirements for applicants, and other regulatory conditions.