Update on the regulation of cloud services by the Malaysian Communications and Multimedia Commission

Introduction

The Malaysian Communications and Multimedia Commission (“MCMC”) had on 16 October 2021 released an advisory notice titled “Cloud Service Regulation Introduced to Increase Accountability for User Data Security and Sustainability of Services” (“Advisory Notice”). On 17 December 2021, the MCMC had published an information paper titled “Information Paper on Regulating Cloud Services” (“Information Paper”) seeking to provide further clarification on the regulatory framework for cloud services under the light-touch regulations.

Definition of End Users

‘Cloud services’ is defined broadly as “any service made available to end-users on-demand via the Internet from a cloud computing provider’s server”. It is intended to be open and wide in order to cover any cloud service activity provided to end-users. However, there were some uncertainties as to who would be considered as the ‘end users’ within the ambit of the definition. The Information Paper has now provided further clarity. Based on the Information Paper, end-user would mean “any natural or artificial person the cloud services provided to”. Therefore, not only would it cover any type of cloud service activity provided but also a wide category of end-users. Examples of illustrations provided under the Information Paper are as follows –

• Cloud services are being provided to Bank XYZ. Bank XYZ is an end-user.
• Cloud services are being provided to Mr. H. Mr. H is an end-user.

Local Presence

Pursuant to the Advisory Notice, persons providing cloud services with a local presence or through a local data centre in Malaysia are required to be registered under the ASP (C) licence. MCMC has also provided illustrations of categories of persons who are required to apply for the ASP (C) licence. One of the illustrations shows that a company that does not have a local presence and does not provide any cloud service applications through a local data centre to end users are required to be registered under the ASP (C) licence. This seems to be rather contradictory as there is no nexus to any ‘local presence’ which is a key determining factor as to whether a person would be required to be registered under the ASP (C) licence. The Information Paper has now clarified that the person in such a scenario would not be required to be registered.

The Information Paper has further clarified that a company that is not a locally incorporated company but has a local branch is not required to be under the ASP (C) licence. MCMC’s rationale is that a local branch of a foreign person would not fall within this category on the basis that branches of a foreign person is still regarded as a part of the foreign person and would therefore be inconsistent with regulation 23 of the Communications and Multimedia (Licensing) Regulations 2000. In that regard, from the perspective of a foreign person, it would appear that the licensing requirement would not apply to a local branch of the foreign person but would apply to a locally incorporated subsidiary of a foreign person in Malaysia. 

Reselling Activities

The Information Paper has further clarified that the licensing requirement would not apply to persons providing software and solutions and to those that are reselling cloud service products provided by large cloud service providers. This is on the basis that these resellers are merely selling products of cloud service providers without having any control on the products. The illustrations were also provided for better clarification –

• Company F is providing software or solutions that is based on cloud service infrastructure and platform provided by Company G. Company F would not be required to be registered under the ASP (C) licence. Company G would be required to be registered under the ASP (C) licence if it has a local presence.

• Company H is an agent reselling cloud services of Company I. Company H would not be required to be registered under the ASP (C) licence. Company I however would be required to be registered under the ASP (C) licence if it has a local presence.

Implementation of Regulation

Pursuant to the Advisory Notice, it was announced that the requirement for registration under the ASP (C) License was to be in force beginning 1 January 2022. Pursuant to the Information Paper, a grace period from 1 January 2022 to 31 March 2022 is now allowed in order for the company to better manage its affairs. The regulation will be in force beginning 1 April 2022. MCMC would still accept voluntary registration during the period.

By Chang Hong Yun & Foong Sow Lynn, Tay & Partners, Malaysia, a Transatlantic Law International Affiliated Firm.

For further information or for any assistance please contact malaysia@transatlanticlaw.com

Disclaimer: Transatlantic Law International Limited is a UK registered limited liability company providing international business and legal solutions through its own resources and the expertise of over 105 affiliated independent law firms in over 95 countries worldwide. This article is for background information only and provided in the context of the applicable law when published and does not constitute legal advice and cannot be relied on as such for any matter. Legal advice may be provided subject to the retention of Transatlantic Law International Limited’s services and its governing terms and conditions of service. Transatlantic Law International Limited, based at 42 Brook Street, London W1K 5DB, United Kingdom, is registered with Companies House, Reg Nr. 361484, with its registered address at 83 Cambridge Street, London SW1V 4PS, United Kingdom