Cyber security compliance in Malaysia

Which cybersecurity laws apply in Malaysia?

For critical infrastructure, the Cyber Security Act 2024 (Act 854). It came into force on 26 August 2024. The 26 June 2024 date that is often quoted is the gazette date. Four regulations took effect on the same day: risk assessment at least yearly and audit at least every two years, incident notification, licensing, and compounding of offences.

Financial institutions add Bank Negara Malaysia's Risk Management in Technology policy, and capital market entities the Securities Commission's technology risk guidelines. Everyone processing personal data in commercial transactions is subject to the amended Personal Data Protection Act.

What must an NCII entity do under Act 854?

Complete a National Cyber Security Baseline self-assessment within two weeks of designation under NACSA's Chief Executive Directive No. 4, follow the code of practice for its sector, conduct a risk assessment at least yearly and an audit by a NACSA-approved auditor at least every two years.

Incident notification is tight: notify immediately, give further particulars within 6 hours and full details within 14 days, through NACSA's national cyber coordination centre. The licensing regulation covers only managed security operations centre monitoring and penetration testing services, not all security services as is sometimes claimed.

What changed in BNM's RMiT?

BNM issued a revised Risk Management in Technology policy effective 28 November 2025, and its policy page lists a further update dated 25 September 2026. References to the June 2023 version are out of date. BNM has enforced it: in January 2026 it penalised Bank Rakyat RM1 million for breaches of RMiT and of its customer information policy.

When did the PDPA amendments take effect?

In three stages, not all on 1 January 2025. Administrative provisions came first, on 1 January 2025. On 1 April 2025 came the change to data controller terminology, biometric data as sensitive data, processors bound by the Security Principle, the higher RM1 million penalty and removal of the transfer whitelist. On 1 June 2025 came the mandatory data protection officer, breach notification and data portability.

Breaches are notified to the Commissioner within 72 hours and to affected individuals within 7 days. A data protection officer is required above 20,000 data subjects, or 10,000 where sensitive or financial data is involved, or where processing involves systematic monitoring.

Which language do Malaysian regulations use?

Acts are issued in Malay and English, with the Malay text authoritative unless prescribed otherwise, and NACSA's directives are published in Malay only. BNM and Securities Commission documents are in English. GRCLens records obligations in English with references to the source text, so auditors can trace each control to the authoritative wording.

How GRCLens runs Malaysian frameworks together

NCSB, RMiT and PDPA obligations share one control model in GRCLens with ISO/IEC 27001 and NIST CSF, so a bank designated as NCII evidences each control once for NACSA and BNM. The NCSB maturity scale, RMiT gap analysis and incident clocks are tracked as their own indicators. The platform can be hosted in Malaysia or fully on-premises.

Official portals and publications

• NACSA legal instruments and directives
• BNM Risk Management in Technology