Introduction
The Communications and Multimedia (Amendment) Act 2025 (“Amendment Act”), which provides amendments to the Communications and Multimedia Act 1998 (“CMA 1998”), was passed by the Malaysian Parliament in December 2024 and came into effect on 11 February 2025. However, Section 92 (Sending of unsolicited commercial electronic messages) and Section 112 (Preservation of communications data) of the Amendment Act will come into effect on a later date to be determined by the Minister of Communications (“the Minister”).
Key Amendments to the CMA 1998
There have been major amendments made to the CMA 1998 via the Amendment Act, covering various matters. However, for the purposes of this article, we will be focusing on some of the key amendments to the CMA 1998 relating to the enhancement of protection for individuals and the powers of the Malaysian Communications and Multimedia Commission (“MCMC”):
(a) Enhancement of the protection to individuals
| No. | Matter | Description |
| Consumer protection obligations on all service providers | The previous Section 187 of the CMA 1998, which provided an exemption for service providers1 who are non-individual or non-class licence holders from the offence under Section 188 of the CMA 1998, has been deleted2. As such, the requirements under Section 188(1) of the CMA 1998, i.e., to deal with consumers reasonably and to sufficiently address consumer complaints—now apply to all service providers without any exception and a service providers’ failure to comply with MCMC’s direction3 will result in a penalty not exceeding RM1 million4. | |
| Substitution of the word “offensive” and expansion of the offence under Section 233(1) of the CMA 1998, increase of penalty and higher penalty for offence committed against a minor | Section 233(1) of the CMA 1998 has been amended5, amongst others: to substitute the word “offensive” used in this section with the word “grossly offensive”; and to expand the offence under this section to also include the act of transmitting prohibited content with the intent to commit fraud or dishonesty against any person. The penalty for breaching Section 233(1) of the CMA 1998 has also been increased,6 with a penalty of up to RM500,000 (previously RM50,000) and/or imprisonment for up to 2 years (previously 1 year), with additional penalty of RM5,000 per day (previously RM1,000) if the offence continues after conviction. The Amendment Act also states that where the offence is committed against a minor (i.e., a child who is under the age of 18 years), the offender may be subject to imprisonment for up to five years7. | |
| Prohibition on sending unsolicited commercial electronic messages i.e. spam | The new Section 233A of the CMA 19988 prohibits the sending of unsolicited commercial electronic messages which contravene the provisions in the CMA 1998 or any regulations under the CMA 1998. The above specific provision relating to spam is intended to address the prevailing issues faced by individuals in Malaysia, which were previously dealt with using the general provision under Section 233(b) of the CMA 1998. | |
| Right of private action against the alleged offender | The new Section 236A of the CMA 19989 grants any person who suffers loss or damage due to: the contravention by another person of Section 235 of the CMA 1998 (Damage to network facilities, etc.); or the contravention by another person of Section 236 of the CMA 1998 (Fraud and related activity in connection with access devices, etc.), the right to bring legal action against the alleged offender in civil proceedings in a court. Such right is granted regardless of: whether or not the alleged offender has been charged with an offence in respect of the contravention; or whether or not a contravention by such alleged offender has been proved in a prosecution. |
(b) Enhancement of the MCMC’s powers
| No. | Matter | Description |
| MCMC’s power in respect of the conduct of an audit | The new Section 73A of the CMA 199810 gives MCMC the power to conduct an audit on a licensee or a service provider involved in communication systems on: any matter under the CMA 1998, its subsidiary legislation or any instrument issued under the CMA 1998; or any information which the licensee or other person furnishes to the MCMC. In addition, the new Section 73B of the CMA 199811 gives MCMC the power to require a licensee to appoint a third-party expert at the licensee’s own cost to conduct the said audit. | |
| MCMC’s power to suspend a content applications service provider’s service | The new Section 211A of the CMA 199812 grants MCMC the power to issue an instruction to a content applications service provider to suspend its services for a specified period stated in the instruction, if such service provider: has contravened any relevant provision of the CMA 1998; has breached licensing conditions (with regard to content) imposed on it; or has failed to comply with any instruments issued, made, or given by the Minister or MCMC relating to content. | |
| MCMC’s power with regard to network security | The new Section 230A of the CMA 199813 gives MCMC the power to register certifying agencies (including those based outside Malaysia) for the purpose of certifying compliance with the regulations or standards relating to network security under the CMA 1998. In addition, the new Section 230B of the CMA 199814 grants MCMC the authority to instruct any person to take measures or comply with necessary requirements to prevent, detect, or counter any network security risk. | |
| MCMC’s power in respect of gathering of information | The new Section 252A of the CMA 199815 gives power to police officers or an authorised officer to issue a notice to the person in control of a communication system to preserve the communication data (as prescribed in the notice) for a certain period (as prescribed in the notice) if they are satisfied that such communication data is reasonably required for an investigation and is at risk of being destroyed or rendered inaccessible. In addition, the new Section 252B of the CMA 199816 gives power to police officers or an authorised officer to issue a notice to the person in control of a communication system to disclose communication data (in the manner as prescribed in the notice) if they are satisfied that such communication data is reasonably required for an investigation into an offence under the CMA 1998 or its subsidiary legislation. |
Conclusion
The Amendment Act introduces significant revisions to the CMA 1998. It is important for those affected by these amendments—especially licensees and service providers—to carefully review the changes and take the necessary steps to ensure full compliance, in order to avoid potential liabilities that may impact their operations.
For further information, please contact:
Khairul Fazli Abdul Kadir, Partner, Azmi & Associates
khairul.fazli@azmilaw.com
- i.e. network facilities provider, network service provider, applications service provider or content applications service provider.
- Amendment Act, s 66.
- Under the new s 188(2) of the CMA 1998, incorporated pursuant to s67(a) of the Amendment Act.
- Under the new s 188(3) of the CMA 1998, incorporated pursuant to s 67(b) of the Amendment Act.
- Amendment Act, s 91(a).
- Amendment Act, s 91(b).
- Amendment Act, s 91(c).
- Amendment Act, s 92.
- Amendment Act, s 96.
- Amendment Act, s 20.
- Ibid.
- Amendment Act, s 81.
- Amendment Act, s 88.
- Ibid.
- Amendment Act, s 112.
- Ibid.
