CyberInsight Asia

Southeast Asia

Malaysia

Last updated:

Status under re-verification · Last verified: 2026-10-05

CyberInsight Asia assessment Seed score

Risk score
~44
Country risk level
Medium
U.S. coercion and market-exclusion risk
Medium-low
Maturity
65CMM level: Level 4 Managed · Mature
Composite risk index
0.68Broadly balanced
Quadrant
Benchmark
Last verified

Scores and risk labels are our own assessment, based on public sources as of the date shown. They are opinions, not findings or statements of fact about any government, organisation or group.

Scores start from a seeded CyberInsight assessment and move as new evidence is recorded. A dimension with no new evidence keeps its last valid contribution.

These dimensions have no evidence yet and are held unchanged: Critical-infrastructure exposure, Regulatory enforcement capability (inverse), Enterprise practice, Geopolitics and great-power risk, Historical incident severity, International cooperation, Laws and regulations, Regulatory capability, Strategy, Threat activity

automated calibration: not run · See the Methodology page for how scores are produced

Trend

A trend needs at least two monthly points; there is only one so far.

Automated coverage

Limited automated coverage

  • Automated coverage is limited: some official sources cannot currently be read, so the content below may be incomplete.
  • Last run (2026-10-12): 3 of 6 tier-1 sources readable.
  • Register areas only partly verified: incident reporting
  • Register areas not yet verified: telecom security, cybercrime

This means some official sources cannot currently be read automatically, so this page may be incomplete. It does not mean the related laws or events do not exist.

Threat landscape

Threat items are not yet attributed to this jurisdiction.

Industry focus

Industry focus will be generated once sourced material exists.

Compliance points

cybersecurity

Verification state: Verified

  • Cyber Security Act 2024
    Cyber Security Act 2024 (Cyber Security Act 2024 [Act 854]): in force, As of 2026-10-12 · Source
  • Risk Management in Technology (RMiT)
    Risk Management in Technology (RMiT) (Risk Management in Technology (RMiT), BNM/RH/PD 028-98): Guidance, As of 2026-10-12 · Source

personal data

Verification state: Verified

  • Personal Data Protection Act 2010
    Personal Data Protection Act 2010 (Akta Perlindungan Data Peribadi 2010 [Akta 709]): in force, As of 2026-10-12 · Source
  • Personal Data Protection (Amendment) Act 2024
    Personal Data Protection (Amendment) Act 2024 (Akta Perlindungan Data Peribadi (Pindaan) 2024 [Akta A1727]): in force, As of 2026-10-12 · Source

critical infrastructure

Verification state: Verified

cross-border data

Verification state: Verified

  • Personal Data Protection Act 2010
    Personal Data Protection Act 2010 (Akta Perlindungan Data Peribadi 2010 [Akta 709]): in force, As of 2026-10-12 · Source
  • Guidelines on Cross-Border Personal Data Transfer (unofficial English translation of the name)
    Guidelines on Cross-Border Personal Data Transfer (unofficial English translation of the name) (Garis Panduan Perlindungan Data Peribadi Pemindahan Data Peribadi Rentas Sempadan (CBPDT)): Guidance, As of 2026-10-12 · Source

incident reporting

Verification state: Partly verified

  • Commissioner's Circular No. 2 of 2025 (Data Breach Notification) (unofficial English translation of the name)
    Commissioner's Circular No. 2 of 2025 (Data Breach Notification) (unofficial English translation of the name) (Pekeliling Pesuruhjaya Perlindungan Data Peribadi Bilangan 2 Tahun 2025 (Pemberitahuan Pelanggaran Data)): Guidance, As of 2026-10-12 · Source
  • Guidelines on Personal Data Breach Notification (unofficial English translation of the name)
    Guidelines on Personal Data Breach Notification (unofficial English translation of the name) (Garis Panduan Perlindungan Data Peribadi Pemberitahuan Pelanggaran Data): Guidance, As of 2026-10-12 · Source

finance sector rules

Verification state: Verified

  • Risk Management in Technology (RMiT)
    Risk Management in Technology (RMiT) (Risk Management in Technology (RMiT), BNM/RH/PD 028-98): Guidance, As of 2026-10-12 · Source

telecom sector rules

Verification state: Verified

  • Communications and Multimedia Act 1998
    Communications and Multimedia Act 1998 (Communications and Multimedia Act 1998 [Act 588]): in force, As of 2026-10-12 · Source

regulator

Verification state: Verified

No record can be shown from the Law Register yet.

Notes for ICT equipment suppliers

This section is based on publicly available sources only.

Suggested checks

  • cybersecurity

    Check what Cyber Security Act 2024 requires of ICT equipment suppliers and operators.

    Source
  • critical infrastructure

    Check what Cyber Security Act 2024 requires of ICT equipment suppliers and operators.

    Source
  • cross-border data

    Check what Personal Data Protection Act 2010 requires of ICT equipment suppliers and operators.

    Source
  • incident reporting

    Check what Commissioner's Circular No. 2 of 2025 (Data Breach Notification) (unofficial English translation of the name) requires of ICT equipment suppliers and operators.

    Source

Latest updates

No recent updates yet.