On 16 October 2021, the Malaysian Communications and Multimedia Commission (“MCMC”) published an Advisory Notice on cloud service regulation (“Advisory”) which contains a set of Frequently Asked Questions regarding the proposed regulation of cloud services by MCMC. The regulation is due to take effect on 1 January 2022 and the Advisory is available here.
 
Introduction
 
MCMC’s intention to regulate cloud services stems from concerns regarding data safety and trust as well as the potential regulatory loopholes and the lack of protection for data stored in the cloud. MCMC intends that, by adopting a licensing requirement as the approach to regulate cloud services, MCMC will have the flexibility to issue technical standards and co-develop such standards with the industry, and ensure cloud service providers will maintain a high level of data security, privacy and protection, and provide legal protection for consumers and public agencies.
 
MCMC intends to adopt a light touch approach in regulating cloud services by licensing cloud services under the Applications Service Provider Class licence (“ASP (C)”) category.
 
Scope of the licence requirement
 
For the purposes of regulating cloud services, MCMC has defined “cloud services” as:
 
“any service made available to end users on demand via the Internet from a cloud computing provider’s server”
 
The Advisory states that persons that provide cloud services and possess local presence are required to register under the ASP (C) licence, as are providers of cloud service applications that do not have a local presence but provide such services through a local data centre. The Advisory also states that a cloud service application provider is not required to register under the ASP (C) licence if it has no local presence and does not provide such services through a local data centre.¹ However, the provision of web hosting and client server activities is said to remain exempted from the ASP (C) licensing requirement.
 
Licence application and licensee obligations
 
Applicants will have to submit the ASP (C) licence application to MCMC together with the necessary supporting documents and registration fee, as well as comply with the licensee obligations under the ASP (C) licence once the licence is issued. At present, there are no foreign shareholding restrictions applicable for the ASP (C) licence and specifically for cloud service, licensees will not be required to contribute to the USP fund, which is a fund aimed at promoting widespread availability and usage of network services and/or applications services throughout Malaysia. 
 
The Advisory also makes it clear that persons who provide licensable activities prior to obtaining the requisite licence are committing an offence under the Communications and Multimedia Act 1998.
 
It will be interesting to see how this new licensing regime will be rolled out in the light of the wide definition of cloud services. Cloud service providers are strongly encouraged to examine, without delay, whether their activities may require an ASP (C) licence, in light of the fast-approaching date upon which the cloud service regulation will take effect.
 
*  This alert has been issued in place of our earlier Alert dated 22 October 2021 as a result of amendments made by the MCMC to the Advisory issued on 15 October 2021.
 
Please contact Charmayne Ong (co@skrine.com), Jillian Chia (jc@skrine.com) or Natalie Lim (natalie.lim@skrine.com) if you have any questions on the Advisory.

---