Acceptable Use Policy (Malaysia)

An Acceptable Use Policy in Malaysia sets out the standards and procedures the organisation expects its people to follow.

Malaysia's digital conduct is regulated primarily by the Communications and Multimedia Act 1998 (CMA 1998, Act 588), which is administered by the Malaysian Communications and Multimedia Commission (MCMC). Section 211 of the CMA 1998 prohibits the provision of content which is indecent, obscene, false, menacing, or offensive with intent to annoy, abuse, threaten, or harass any person. Section 233 extends this prohibition to transmitting such content via any multimedia device. The Computer Crimes Act 1997 (Act 563) criminalises unauthorised access to computer systems (Section 3), unauthorised access with intent to commit or support the commission of further offences (Section 4), unauthorised modification of the contents of any computer (Section 5), and wrongful communication of access codes (Section 6).

For organisations operating under ISO/IEC 27001 Information Security Management Systems or the Malaysian Cybersecurity Act 2024, an AUP is a required policy document. The National Cyber Security Agency of Malaysia (NACSA) and CyberSecurity Malaysia, the national information security specialist agency under the Ministry of Digital Malaysia, recommend AUPs as a foundational information security control for all organisations.

An AUP should be incorporated by reference into the Terms of Service or employment contract of the relevant organisation. For internet service providers (ISPs) and cloud service providers regulated by MCMC under the CMA 1998, an AUP that prohibits illegal content and conduct is a regulatory expectation. For corporate networks and SaaS platforms, the AUP informs employees and users of the boundaries of permitted use and establishes the basis for disciplinary action in cases of violation.

An effective AUP must be specific about the prohibited categories of conduct, proportionate in its enforcement provisions, and regularly reviewed to reflect changes in Malaysian law and technology. The MCMC publishes the Content Code of the Communications and Multimedia Content Forum of Malaysia (CMCF Content Code), which sets out content standards that AUPs for content platforms should reflect.

The legal framework governing the Acceptable Use Policy (Malaysia) in Malaysia draws on several key statutes and regulatory bodies. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Parties executing a Acceptable Use Policy (Malaysia) in Malaysia should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies Act 2016 (Act 777) sets the foundational requirements.

An Acceptable Use Policy is required for any organisation that provides digital services, network access, or online platforms to users in Malaysia.

An Acceptable Use Policy is needed for any internet service provider (ISP), cloud hosting provider, or managed service provider regulated by the Malaysian Communications and Multimedia Commission (MCMC) under the Communications and Multimedia Act 1998, to document the prohibited uses of the provider's network infrastructure and content standards.

An Acceptable Use Policy is required for any SaaS platform or collaborative online tool serving Malaysian businesses and individuals, to define the boundary between permitted use and abuse of the platform's resources, and to establish the basis for account suspension or termination of violating users.

An Acceptable Use Policy is needed for any employer providing corporate network access, email systems, or internet access to employees in Malaysia, as part of the employer's obligations under ISO/IEC 27001 and the company's information security management system (ISMS). The AUP sets out what employees may and may not do on company systems.

An Acceptable Use Policy is required for any educational institution, university, or online learning platform in Malaysia providing network or platform access to students and staff, to regulate academic integrity, content sharing, and appropriate online conduct.

An Acceptable Use Policy is needed for any marketplace or content platform in Malaysia that allows users to post, share, or publish content, to establish the content standards that govern user submissions and the platform's right to moderate and remove non-compliant content under the CMA 1998.

Parties in Malaysia should prepare a Acceptable Use Policy (Malaysia) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A thorough Acceptable Use Policy for a Malaysian organisation must include the following essential elements.

Scope and Application: A statement of which users, systems, services, and activities are covered by the AUP, and how the AUP interacts with the Terms of Service, Privacy Policy, and employment contracts.

Permitted Uses: A clear statement of the purposes for which the service is intended to be used — for example, legitimate business communications, lawful e-commerce transactions, or accessing licensed software features. Defining permitted uses helps establish the baseline against which violations are measured.

Prohibited Conduct — Legal Violations: Specific prohibition on using the service to violate Malaysian law, including: sending or posting indecent, obscene, menacing, or offensive content contrary to Section 211 of the Communications and Multimedia Act 1998; unauthorised access to computer systems contrary to Section 3 of the Computer Crimes Act 1997; distributing content that infringes copyright under the Copyright Act 1987 (Act 332); transmitting content that incites racial or religious hatred contrary to the Sedition Act 1948 and the Penal Code; distributing spam contrary to Section 233 of the CMA 1998.

Prohibited Conduct — Platform Abuse: Prohibition on activities that harm the platform's technical infrastructure or other users — including distributed denial-of-service (DDoS) attacks, scraping, brute-force attacks, deploying malware or ransomware, and circumventing security controls.

Content Standards: For platforms accepting user-generated content, specific content standards — including prohibitions on defamatory content under the Defamation Act 1957, child sexual abuse material (CSAM) criminalized under the Sexual Offences Against Children Act 2017 (Act 792), and violence-inciting content.

Enforcement and Consequences: The actions the organisation may take in response to AUP violations — including content removal, account suspension, permanent termination, reporting to MCMC or the Royal Malaysia Police (PDRM), and civil claims for damages.

Reporting Mechanism: How users or employees can report suspected AUP violations, including a dedicated abuse reporting email or portal.

Additional compliance elements for a Acceptable Use Policy (Malaysia) used in Malaysia include: Under Malaysian law, the Contracts Act 1950 (Act 136) governs contractual obligations. The Companies Act 2016 (Act 777) regulates corporate entities through the Companies Commission of Malaysia (SSM). The Employment Act 1955 (Act 265) and the Department of Labour govern employment matters. The Personal Data Protection Act 2010 (Act 709) and the Personal Data Protection Department protect personal data. The Inland Revenue Board of Malaysia (LHDN) administers tax obligations. The Industrial Court adjudicates employment disputes under the Industrial Relations Act 1967 (Act 177). Forms-legal.com provides this template as a starting point for Malaysia-compliant documentation.