Guide · Malaysia
Outsourcing web development to India from Malaysia
You can work remotely with an Indian development team using shared project boards and calls. Before work starts, agree meeting times around the time difference and check how personal data will be transferred and protected. A Malaysian business buying taxable website development from outside Malaysia must account for service tax. Indian export treatment depends on conditions including the supplier’s and recipient’s locations, the place of supply and payment. Agree the payment schedule and contract terms with your supplier.
Checked against official sources on 5 November 2026. General information, not legal advice: confirm the rules that apply to your business with an adviser.
How can you arrange working hours with an Indian team?
IST is 2h30m behind Malaysia. Agree call times that suit both teams.
Most Malaysian states work Monday–Friday, while Kedah, Kelantan and Terengganu work Sunday–Thursday. Check your supplier’s availability when choosing shared working days.
Can you send personal data to a team in India?
Malaysia’s Personal Data Protection Act 2010 (Act 709) permits a data controller to transfer personal data outside Malaysia to a place with a substantially similar law or an adequate, at least equivalent, level of protection. The cross-border transfer guidelines also allow a transfer after reasonable precautions and due diligence, which can be shown through contractual clauses or a recognised certification.
The guidelines require the controller to inform data subjects of the transfer through a personal data protection notice or another written notice. The controller must also keep records of each receiver, including its name, destination country, type of personal data and purpose.
From 13 May 2027, India’s Digital Personal Data Protection (DPDP) Act, 2023 includes an exception for a person in India processing data of individuals outside India under a contract with a person outside India. Most Data Fiduciary obligations do not apply in that case, but responsibility for compliance and reasonable security safeguards against personal data breaches still apply.
What tax and invoicing rules apply when you buy from India?
A person carrying on business in Malaysia who obtains taxable IT services, including website, application or software development, from someone outside Malaysia must account for and pay service tax on them.
India treats an export of services as a zero-rated supply under the Integrated Goods and Services Tax (IGST) Act, 2017. A service qualifies as an export only if the supplier is in India, the recipient and place of supply are outside India, payment is received in convertible foreign exchange or in Indian rupees wherever permitted by the Reserve Bank of India, and the supplier and recipient are not merely establishments of a distinct person.
In India, a registered person can make zero-rated supplies without paying integrated tax under a bond or Letter of Undertaking and claim a refund of unutilised input tax credit.
How should you arrange payment to an Indian supplier?
Agree the currency and payment schedule with your supplier. Under India’s Foreign Exchange Management (Export and Import of Goods and Services) Regulations, 2026, in force from 1 October 2026, an Indian exporter must realise and repatriate the full value of exported services within nine months from the invoice date, or twelve months if the export is invoiced or settled in Indian rupees; its Authorised Dealer bank may allow more time on request.
What should the contract say about data and disputes?
Malaysia’s cross-border transfer guidelines require a controller to include clauses governing personal data processing, including security, in a contract with a third party or data processor.
Discuss dispute terms before signing. India applies the New York Convention on the Recognition and Enforcement of Foreign Arbitral Awards only to awards made in another contracting State and to differences considered commercial under its national law.
What should you check before outsourcing to India?
Malaysia’s Personal Data Protection Act 2010 (Act 709) applies to anyone who processes, or controls the processing of, personal data in respect of commercial transactions. Use these checks before work begins.
- Agree call times and shared working days with the supplier.
- Check the basis for any transfer of personal data to India.
- Tell data subjects about the transfer and record the receiver’s details.
- Include personal data processing and security clauses in the contract.
- Check your Malaysian service tax obligations for the purchased services.
- Agree the payment currency and schedule with the supplier.
- Discuss dispute terms before signing.
Questions
Does my business have to implement e-invoicing?
It depends on your annual revenue or sales. From 1 September 2026, businesses with annual revenue or sales below RM3 million are not required to implement e-invoicing.
Do I need to appoint a data protection officer?
You must appoint one if you are a data controller or processor that meets the Personal Data Protection Commissioner’s criteria. These include processing personal data of more than 20,000 data subjects, under section 12A of Act 709 from 1 June 2025.
What happens if there is a personal data breach?
A data controller in Malaysia must notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours. Where the breach is likely to cause affected data subjects significant harm, the controller must notify them within 7 days of that notification.
Can we use English when discussing the project?
Yes. Malaysian English is widely used in business and widely understood in the country’s urban areas.
What details must an Indian export invoice contain?
An Indian invoice for export of services must carry the applicable export endorsement and give the recipient’s name and address, the address of delivery and the country of destination. The endorsement differs according to whether the supply is under a bond or Letter of Undertaking without payment of integrated tax, or on payment of integrated tax.