Update on the regulation of cloud services by the Malaysian Communications and Multimedia Commission
LegalTAPS March 2022
Download PDF File
The Malaysian Communications and Multimedia Commission (“MCMC”) had on 16 October 2021 released an advisory notice titled “Cloud Service Regulation Introduced to Increase Accountability for User Data Security and Sustainability of Services” (“Advisory Notice”). On 17 December 2021, the MCMC had published an information paper titled “Information Paper on Regulating Cloud Services” (“Information Paper”) seeking to provide further clarification on the regulatory framework for cloud services under the light touch regulations. We had previously provided a summary of the Advisory Notice and the article can be found here (https://taypartners.com.my/cloud-service-providers-licensed-1-january-2022)
Definition of End Users
‘Cloud services’ is defined broadly as “any service made available to end users on demand via the Internet from a cloud computing provider’s server”. It is intended to be open and wide in order to cover any cloud service activity provided to end users. However, there were some uncertainties as to who would be considered as the ‘end users’ within the ambit of the definition. The Information Paper has now provided further clarity. Based on the Information Paper, end user would mean “any natural or artificial person the cloud services provided to”. Therefore, not only would it cover any type of cloud service activity provided but also a wide category of end users. Examples of illustrations provided under the Information Paper are as follows –
- Cloud services are being provided to Bank XYZ. Bank XYZ is an end user.
- Cloud services are being provided to Mr. H. Mr. H is an end user.
Pursuant to the Advisory Notice, persons providing cloud services with local presence or through local data centre in Malaysia are required to be registered under the ASP (C) licence. MCMC has also provided illustrations of categories of persons who are required to apply for the ASP (C) licence. One of the illustrations shows that a company which does not have local presence and does not provide any cloud service applications through local data centre to end users is required to be registered under the ASP (C) licence. This seems to be rather contradictory as there is no nexus to any ‘local presence’ which is a key determining factor as to whether a person would be required to be registered under the ASP (C) licence. The Information Paper has now clarified that the person in such a scenario would not be required to be registered.
The Information Paper has further clarified that a company which is not a locally incorporated company but has a local branch is not required to be under the ASP (C) licence. MCMC’s rationale is that a local branch of a foreign person would not fall within this category on the basis that branches of a foreign person is still regarded as a part of the foreign person and would therefore be inconsistent with regulation 23 of the Communications and Multimedia (Licensing) Regulations 2000. In that regard, from the perspective of a foreign person, it would appear that the licensing requirement would not apply to a local branch of the foreign person but would apply to a locally incorporated subsidiary of a foreign person in Malaysia.
The Information Paper has further clarified that the licensing requirement would not apply to person providing software and solutions and to those that are reselling cloud service products provided by large cloud service providers. This is on the basis that these resellers are merely selling product of cloud service providers without having any control on the products. The illustrations were also provided for better clarification –
- Company F is providing software or solutions that is based on cloud service infrastructure and platform provided by Company G. Company F would not be required to be registered under the ASP (C) licence. Company G would be required to be registered under the ASP (C) licence if it has local presence.
- Company H is an agent reselling cloud services of Company I. Company H would not be required to be registered under the ASP (C) licence. Company I however would be required to be registered under the ASP (C) licence if it has local presence.
Implementation of Regulation
Pursuant to the Advisory Notice, it was announced that the requirement for registration under the ASP (C) License was to be in force beginning 1 January 2022. Pursuant to the Information Paper, a grace period from 1 January 2022 to 31 March 2022 is now allowed in order for company to better manage its affairs. The regulation will be in force beginning 1 April 2022. MCMC would still accept voluntary registration during the period.
Chang Hong Yun
Foong Sow Lynn
T: +603 2050 1969