An Overview of Malaysia’s Data Sharing Act

Over the years, Malaysia has been making strides in promoting an open data ecosystem for the benefit of both the public and private sectors. Recognising that there are significant synergies that all parties can harness from publishing relevant data sets, the Department of Statistics Malaysia (DOSM) launched the OpenDOSM platform in 2023, publishing 645 public datasets to date. This progressive stance has been recognised worldwide, with Malaysia topping the Open Data Inventory (ODIN) Assessment from 2024-2025, which is an index that measures data openness and accessibility in a country. Last week, Malaysia took a step further by passing the Data Sharing Act 2025, which will have important consequences for multiple industries.

Briefly, the Data Sharing Act is one of the four legislative reforms that have been ongoing since 2024 to improve and standardise data management in Malaysia, complementing the Cybersecurity Act 2024 and the Personal Data Protection Act (PDPA) Amendment 2024. Intending to end the siloed approach to government data, the Act’s scope covers data sharing between government agencies and between the public and private sectors. Focusing on consent and security, the Act’s approach is to reinforce the need for consent, anonymisation and robust safeguards through the establishment of a governance structure and certification scheme for Data Sharing Entities (Data intermediaries). The implementation of the Act will be under a yet-to-be-designated central authority, with a key provision of the Act being that the private sector can participate initially on an opt-in basis, although encouragement for wider adoption through incentives will be done as well.

The passing of the Act will have different implications for the parties targeted by the implementation:

1. Government agencies now have clearer legal pathways to share datasets in a structured, secure and interoperable manner, achieving the goal of ending the siloed nature of government data.
2. Large businesses, especially in regulated industries such as healthcare, banking and telecommunications, can access anonymised public datasets to inform product development and customer targeting. However, they must first register under a Data Sharing Framework and may be subject to periodic compliance checks
3. Startups and Data Intermediaries can become certified Data Sharing Entities, through which they can aggregate and monetise open data legally and ethically, build APIs or analytics layers for sectors and participate in creating “data commons” that spur innovation across sectors
4. Civil Society will have to play a role in understanding how this Act intersects with PDPA to ensure a balance between the protection of civil liberties and the push for openness, while promoting inclusive data sharing to ensure all parties can benefit
5. Academia and research institutions stand to benefit by having access to public datasets for various fields, while having the chance to contribute back via open-access data publications. Eventually, this may lead to the creation of a national data repository for analysis.
6. International parties and investors can be assured by the adoption of a structured and transparent data-sharing regime that facilitates a clearer legal environment for cross-sector and cross-border data flows, compliant with OECD recommendations and the Digital Economy Partnership Agreement (DEPA)

Once the Act is gazetted, there will be both opportunities to be utilised and challenges to be confronted that require a whole-of-nation approach to ensure that the objectives of the Act can be achieved. Regarding opportunities, the potential for innovation through open data ecosystems offers a glimpse into how all parties can benefit from this Act. The public and private sector, academia and other parties should collaborate in areas such as AI/ML model training, smart city planning and fintech growth, owing to the high quality and availability of public data. Meanwhile, the Act also positions Malaysia well in terms of its competitiveness in ASEAN digital trade, with the potential of data hosting in Malaysia being boosted by both this Act and the rising number of data centres and cloud regions in the country

However, the Data Sharing Act’s passing also created challenges that must be overcome. The overarching concern over this Act centres around how it protects privacy risks while pursuing its goals of creating a facilitative open data ecosystem. Given this,  the security standards and transparency guidelines put in place are crucial to allay any fears that the government is compromising privacy rights for better efficiency. Additionally, clear interoperability and metadata standards are also important to ensure that a seamless data exchange is possible within the confines of the Act. Lastly, managing private sector hesitation to register as a Data Sharing Entity due to unclear incentives or fear of regulatory exposure is also key, as their participation is key to realising the full benefits of an open data ecosystem.

At this stage, the Data Sharing Act is a pivotal step in creating a digital-based and open Malaysian economy by creating a value proposition for the public and private sector to share data securely and transparently. The success of the Act in reaching its objectives depends on a multitude of factors, namely effective implementation, industry buy-in and continuous alignment with global best practices. All stakeholders should take the opportunity to start their preparations to engage government bodies involved in the passing of this Act, such as DOSM, to understand how they can fit and benefit from the open data ecosystem envisioned by the government. Proactive engagement is key for businesses to position themselves adequately in light of this new development.

Sources

1. Announcement from Digital Ministry on Data Sharing Act 2025
2. Data Sharing Act 2025 Overview and Key Provisions
3. Data Sharing Act 2025: What Malaysian businesses need to know