Guide · Malaysia
Website legal requirements in Malaysia
Malaysia’s Personal Data Protection Act 2010 (Act 709) applies to personal data processing in commercial transactions. Some data controllers and processors must appoint a data protection officer, and data controllers must report personal data breaches to the commissioner. Service tax and e-invoicing rules can affect online sales. FPX and DuitNow QR are payment options, while MYNIC is the official .my domain registry. Check how the rules apply to your business when planning forms, checkout and invoicing.
Checked against official sources on 5 November 2026. General information, not legal advice: confirm the rules that apply to your business with an adviser.
What privacy rules apply to my website or app?
Malaysia’s Personal Data Protection Act 2010 (Act 709) applies to anyone who processes, or controls the processing of, personal data in respect of commercial transactions. The Personal Data Protection Commissioner oversees it. When planning forms and accounts, identify where your site or app will collect and process personal data.
How do tax and e-invoicing affect online sales?
Malaysia’s service tax is part of Sales and Service Tax (SST). It has been charged at 8% since 1 March 2024, except for food and beverage, parking, logistics and telecommunications services, which remain at 6%. Check which rules apply to what you sell when planning checkout and invoices.
Malaysia’s Inland Revenue Board (HASiL) phased in e-invoicing by annual turnover or revenue, from 1 August 2024 for taxpayers above RM100 million to 1 January 2026 for taxpayers with up to RM5 million. Check your position before deciding how your shop or app will handle invoices.
Since 1 January 2019, Malaysian service tax has also been charged on imported taxable services. Check this when planning purchases of services from outside Malaysia for your site or app.
Can my online shop accept bank payments?
FPX, operated by PayNet, lets online businesses accept payments that move directly from customers’ bank accounts through internet banking. You can consider it when planning your checkout.
What language should I use on my website?
Malay (Bahasa Melayu) is Malaysia’s national language under Article 152 of the Federal Constitution. The National Language Act 1963/67 provides for the use of English in certain official contexts. Consider the language of your pages and forms when planning their content.
Who manages the .my domain?
MYNIC is the official .my domain registry recognised by ICANN. It is an agency under Malaysia’s Ministry of Digital. Consider the domain when planning your website address.
What should my Malaysia website checklist include?
Use these checks to plan your site’s content and functionality, including language: Malaysian English is widely used in business and widely understood in the country’s urban areas.
- Identify where forms and accounts collect personal data.
- Check whether you must appoint a data protection officer.
- Plan how to report a personal data breach.
- Check the service tax rules for what you sell.
- Check your e-invoicing position before planning invoices.
- Consider FPX or DuitNow QR for checkout.
- Decide which language to use for pages and forms.
- Consider whether to use a .my website address.
Questions
Do I need a data protection officer for my website or app?
Yes, if you are a data controller or data processor that meets the Personal Data Protection Commissioner’s criteria. Following the Personal Data Protection (Amendment) Act 2024, section 12A of Act 709 requires an appointment from 1 June 2025. One criterion is processing personal data of more than 20,000 data subjects.
What must I do if my site has a personal data breach?
If you are a data controller in Malaysia, you must notify the Personal Data Protection Commissioner as soon as practicable and within 72 hours. Since 1 June 2025, you must also notify affected data subjects within 7 days of that notification where the breach is likely to cause them significant harm.
Does every online business have to implement e-invoicing?
No. From 1 September 2026, businesses with annual revenue or sales below RM3 million are not required to implement e-invoicing. The exemption threshold was raised from RM1 million.
Can I use consolidated e-invoices during the transition?
Yes, if you are a taxpayer in Malaysia’s fourth e-invoicing phase. That phase began on 1 January 2026 and has a 12-month transitional period to 31 December 2026, during which taxpayers may issue consolidated e-invoices for all transactions.
Can customers pay using a QR code?
Yes. DuitNow QR, operated by PayNet, lets a merchant accept payments from any participating bank or e-wallet through a single QR code.