The Online Safety Act 2025: Navigating Malaysia’s New High-Stakes Regulatory Landscape

As of 1 January 2026, Malaysia has officially entered a new era of digital governance, where content moderation is subject to a stricter statutory regime. The implementation of the Online Safety Act 2025 (“ONSA”), together with its stringent response timelines, marks a fundamental shift in how communications and multimedia service providers must manage their operations.

For such service providers, the cost of delayed response is measured in penalties up to eight figures, as well as personal liability for executives, among the key changes introduced under the new ONSA regime.

Who Is Under the Watch?

The ONSA is designed to capture any provider or platform with a Malaysian footprint, regardless of its jurisdiction of incorporation or the location of its principal operations:

Global Reach In Action – The ONSA is a global compliance mandate for any multinational service provider with a Malaysian footprint. This borderless enforcement approach is already evident in the MCMC’s firm stance on emerging technologies. A recent example is the temporary ban imposed by the MCMC on Grok AI (owned by Elon Musk) in early January 2026, following allegations it had been misused to generate and disseminate explicit deepfakes classified as harmful content.

The MCMC made clear that any failure to comply with Malaysian laws would be addressed firmly in accordance with existing legal provisions. This reinforces the significance of section 3 of the ONSA, which establishes its extra-territorial reach and cross-border accountability.

Tiered Risk Framework – Harmful Content

ONSA moves away from voluntary moderation to a tiered risk system, providing detailed Schedule(s) that categorises harmful content into two tiers.

“Harmful Content” (First Schedule of ONSA) – Covering nine specific categories of content that impact public safety and decency, briefly:

• Cyberbullying & Harassment: Abusive words intended to cause fear or distress
• Incitement: Content promoting violence, terrorism, or public hostility
• Indecent/Obscene Material: Profane content or lewd portrayals

“Priority Harmful Content” (Second Schedule of ONSA) – Covering the two highest-urgency categories of content:

• Child sexual abuse materials: governed by the Sexual Offences against Children Act 2017.
• Financial fraud: content such as scams, phishing and fraudulent investment schemes

The Compliance Golden Hours

The Online Safety (Period) Regulations 2025 (“Period Regulations”) now turn content moderation into a high-speed operational race. ASP and CASP platforms are now subject to stringent statutory timelines and must proactively meet these statutory stopwatches:

• Acknowledgment of a user report: Within 1 hour of receipt of any user report of any harmful content.
• Assessment and user notification: Within 12 hours of acknowledgment of receipt of the report.

• For Priority Harmful Content:

  (i) Content must be immediately made inaccessible to all users for 24 hours pending assessment.

  (ii) Once confirmed as Priority Harmful Content, it must be permanently blocked or removed within 1 hour of that determination (or reinstated within the same time, if wrongly classified).

• For Harmful Content:

  (i) Content must be made inaccessible within 4 hours to all users for 24 hours pending assessment.

  (ii) Once confirmed as Harmful Content – must be permanently blocked or removed within 12 hours of that determination (or reinstated within 4 hours from determination, if wrongly classified).

Mandatory Governance Beyond “Takedowns”

ONSA further requires platforms to adopt proactive, system-wide risk management rather than merely reactive measures such as post-by-post deletions. ASPs and CASPs (“Providers”) must now fulfil expanded duties that shape how they govern and design their services:

• The Online Safety Plan: Providers must prepare and submit a formal Online Safety Plan to the MCMC detailing moderation measures, user-facing mechanisms, and compliance processes.
• Child Safety by Design: Providers must implement specific safeguards for minors. These include default settings for age-appropriate restrictions and features that limit inappropriate interactions and access.

The Boardroom Risk: Personal Liability

This represents a critical commercial consideration for C‑suite executives and directors. Beyond corporate penalties, the ONSA extends direct accountability to key officers: directors, compliance officers, partners, managers, secretaries, or other similar officers (“Executives”).

• Section 73 “Deemed Guilty”: If a company commits an offence, its Executives are automatically deemed guilty of the same offence under the ONSA.
• Possible Defences: The Executives are liable to the same punishments or penalties, unless they prove a lack of knowledge of the offence or that they exercised due diligence to prevent the offence.

High-Stakes Penalties & Enforcement

The penalty framework under ONSA is set at a severe level to ensure maximum corporate accountability. Prolonged failures can escalate into multi-million-ringgit liabilities due to compounding daily fines. Below are some key statutory penalties:

• Failure to comply with the MCMC’s written instructions to make Harmful Content inaccessible (Sections 23 & 25) – Fine up to RM1 million, with a further fine of up to RM100,000 per day.
• Failure to make permanently inaccessible any determined Priority Harmful or Harmful Content within their respective prescribed timeframe (Period Regulations) – Fine up to RM1 million.
• Failure to comply with Providers’ statutory duties (including but not limited to those discussed in Section 4 above) (Section 39) – Financial penalty up to RM10 million.
• Failure to disclose stored communications data for investigation purposes (Section 61) – Fine up to RM1 million, with a further fine of RM100,000 per day.
• Seizure powers: Authorised officers may access computerised data, request passwords and seize equipment with or without a warrant in urgent online safety cases. Any obstruction of these powers or interference with their execution constitutes an offence – punishable by a fine up to RM1 million.

Legal Recourse: The Online Safety Appeal Tribunal

The ONSA establishes the Online Safety Appeal Tribunal (“OSAT”) as a critical check on the MCMC’s regulatory powers, providing a formal, quasi-judicial forum for Providers to challenge MCMC enforcement actions or decisions they consider unjust.

Decisions made by the OSAT are final and binding and are not subject to further appeal. Crucially, these decisions can be enforced in the same manner as a judgment or order of the High Court.

Looking Ahead: Anticipated Developments for 2026

Ongoing Subsidiary Legislation

The MCMC is likely to issue additional regulations in due course to address areas that remain “yet to be prescribed” under the ONSA. These are in addition to the four sets of Regulations which have, as of the date of this article, been enacted:

• Online Safety (Fees) Regulations 2025;
• Online Safety (Form of Undertaking) Regulations 2025;
• Online Safety (Period) Regulations 2025; and
• Online Safety (Online Safety Appeal Tribunal) Regulations 2025.

New Mandatory Codes of Conduct

Child Protection & Risk Reduction Codes: Following a public consultation period ending in March 2026, the MCMC is expected to finalise these codes with an aim to enforce safer algorithms and more effective complaint mechanisms for platform Providers.

Mandatory Age Verification

With child safety being the central pillar of the ONSA, the MCMC is presently evaluating technological solutions including e-KYC and AI-driven biometric age estimation. A mandatory verification mechanism is expected to be finalised by Q2 of 2026.

Under this new mandate, platform Providers will soon bear the full legal obligation to ensure children aged 16 and below are subject to stricter restrictions in relation to digital content including social media access.

Commentary

The ONSA marks a decisive shift in Malaysian digital content regulation. Whether global or regional, the question for Providers is no longer whether to comply, but how quickly and effectively they can adapt.

Challenges & Strategic Considerations

While the ONSA introduces a clear framework for online safety and platform accountability, several practical challenges are likely to arise as enforcement begins.

• Age-Verification and Privacy Risks – Deploying verification systems without a robust privacy impact assessment may result in exposure under existing data protection laws. Poor implementation could result not only in regulatory scrutiny, but also reputational damage and user distrust. Providers should carefully assess their verification architecture and, where appropriate, engage early with regulators to ensure alignment before full enforcement deadlines take effect – such as leveraging the MCMC’s Regulatory Sandbox to ensure their verification tech is “regulator-approved” before the Q2 2026 deadline.
• “Borderless” Enforcement Reality – Multinational Providers serving Malaysian users must now align their global moderation standards with Malaysia’s statutory response timelines. Failure to localise compliance frameworks may result in immediate domestic enforcement action.
• Algorithmic and Content Moderation Complexity – Platforms may face real difficulty moderating harmful content across Malaysia’s diverse languages and cultural contexts. Automated tools and algorithms are not foolproof, meaning that harmful material may evade detection while legitimate expression risks being removed out of caution to avoid penalties. These challenges are compounded by the stringent statutory response timelines, which leave limited room for nuanced assessment and increase the risk of over or under moderation.

Practical Steps: Be ONSA-Ready

With fines reaching up to RM10 million, daily escalation penalties, and proactive enforcement already underway, compliance under the ONSA should be treated as a core operational priority. At a minimum, Providers serving Malaysian users should consider:

• Conducting a regulatory gap assessment – Review existing systems, policies, and processes against the statutory response timelines, prescribed duties, and content classification requirements under ONSA.
• Global-Local Alignment – For multinational Providers, coordinate global compliance teams and protocols to ensure Malaysian regulatory obligations (such as the 1-hour timeline applicable to Priority Harmful Content) are hard-coded into the international resilience framework.
• Strengthening executive oversight frameworks – Ensure due diligence structures are documented and actively implemented to mitigate personal liability exposure for Executives. This includes defined reporting lines and board-level visibility on compliance performance.
• Preparing and refining the mandatory Online Safety Plan – Begin developing the Plan as a functional governance document, not merely a regulatory submission. The Plan should articulate user reporting mechanisms, content response workflows, risk mitigation strategies, governance controls, and system-level safeguards.
• Enhancing documentation and reporting systems – Record-keeping may become critical evidence in regulatory investigations or enforcement proceedings. Pertinent documentation includes those relating to moderation decisions, user reports, classification assessments, algorithmic testing and internal escalations.

This article was authored by Suaran Singh Sidhu (Head), Joel Prashant (Senior Associate), Angela Leong (Associate) and Teeran Vharma (Pupil-in-Chambers).

---