Malaysia bans highly classified public sector data from being stored in the cloud

Traders Union
All News
Regulators
Malaysia bans public sector data in the cloud

Highlights

Malaysia prohibits highly confidential public sector data from being stored in public or overseas clouds, allowing only domestic private or hybrid clouds.
Malaysian government AI contracts prohibit providers from using government data to train models and require data deletion after processing.
The Digital Ministry is drafting an AI Governance Bill to regulate the quality, transparency and accountability of technology providers throughout the AI system lifecycle.

This article was translated from the original. Read the original version by our correspondent here.

Cloud storage rules and security controls

As reported by The Edge Malaysia, Digital Minister Gobind Singh Deo said highly confidential public sector data is prohibited from being stored in cloud environments that allow data to be stored and accessed via the internet.

Under existing security directives, confidential and restricted government information may only be stored in domestic private or hybrid cloud environments, while only open and non-sensitive data may be stored in overseas cloud environments. He said the restrictions are intended to protect public sector data processed by cloud service providers and AI technology providers, including foreign companies.

Gobind stated that vendors appointed to provide services to the government must undergo security screening. Access to government systems is granted based on roles, requires multi-factor authentication, and is logged for audit purposes.

He added that government data must be encrypted both at rest and in transit, in line with the National Cryptography Policy. For classified systems and data, encryption keys are owned and controlled by the government to prevent foreign service providers from freely accessing the content, including in the event of requests from foreign authorities.

AI requirements and regulatory framework

In a written reply in Parliament on Tuesday to Ahmad Fadhli Shaari, Gobind said government AI procurement contracts prohibit providers from using government or public data to train their models and require data to be deleted after processing.

The Public Sector AI Usage Guidelines, GPAISA, also require government agencies to minimise the amount of data used and to mask or anonymise data before it is processed through AI systems. The measure adds a layer of protection as agencies expand the use of digital technology in daily operations.

To strengthen the regulatory framework, the ministry is drafting an AI Governance Bill to ensure technology providers remain accountable throughout the AI system lifecycle. Gobind said the bill covers aspects such as data quality, transparency and explainability, as Malaysia seeks to retain control over public and personal data in a digital ecosystem increasingly reliant on foreign providers.

In our previous coverage of the sovereign AI cloud initiative, we explained the government's efforts to develop a self-controlled cloud environment to protect official documents and sensitive information from public cloud security risks and exposure to foreign laws. The article also discussed the role of government agencies in implementing this initiative and its link to strengthening the country's digital infrastructure to support the digital economy and the safer adoption of technologies such as AI.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.