AKTA PERKONGSIAN DATA 2025

Data Sharing 1 Act 864 Laws of Malaysia 2 Act 864 Date of Royal Assent ... ... 5 February 2025 Date of publication in the ... ... 20 February 2025 Gazette Publisher’s Copyright C PERCETAKAN NASIONAL MALAYSIA BERHAD All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means electronic, mechanical, photocopying, recording and/or otherwise without the prior permission of Percetakan Nasional Malaysia Berhad (Appointed Printer to the Government of Malaysia). Data Sharing 3 Act 864 ARRANGEMENT OF SECTIONS

Part I

PRELIMINARY Section

1. Short title and commencement

2. This Act binds Federal Government

3. Interpretation

4. Pillars of data sharing

Part II

NATIONAL DATA SHARING COMMITTEE

5. Establishment of Committee

6. Functions of Committee

7. Temporary exercise of functions of Chairman

8. Meetings of Committee

9. Committee may invite others to attend meetings

10. Committee may establish subcommittees

Part III

DUTIES AND POWERS OF DIRECTOR GENERAL

11. Duties and powers of Director General Laws of Malaysia 4 Act 864

Part IV

DATA SHARING Section

12. Request for data sharing

13. Purpose for which data may be shared

14. Evaluation and response by public sector agency receiving request for data sharing

15. Refusal to share data requested

16. Duty relating to data sharing

17. Duty of third party to protect shared data

18. Restriction on further use and disclosure of shared data

19. Imposition of fees under other written law

20. Sharing of open data

21. Duty to report particulars relating to data sharing

Part V

GENERAL

22. Powers of enforcement, inspection and investigation

23. Obligation of secrecy

24. Protection against suit and legal proceedings

25. Prosecution

26. Liability of director, etc., of statutory body

27. Power to exempt

28. Power to give directions

29. Power to amend Schedule

Schedule Data Sharing 5 An Act to provide for the sharing of data within the control of a public sector agency with other public sector agency, establishment of the National Data Sharing Committee, functions and powers of the Director General of the National Digital Department in relation to data sharing and other related matters. [ ] ENACTED by the Parliament of Malaysia as follows: Part I PRELIMINARY Short title and commencement 1. (1) This Act may be cited as the Data Sharing Act 2025. (2) This Act comes into operation on a date to be appointed by the Minister by notification in the Gazette. This Act binds Federal Government 2. This Act shall bind the Federal Government. Act 864 Laws of Malaysia 6 Act 864 Interpretation 3. In this Act, unless the context otherwise requires— “public sector agency” means— (a) the agency in charge of the public services referred to in Clause (1) of Article 132 of the Federal Constitution, except the services referred to in paragraphs (f) and (g); and (b) any statutory authority exercising powers vested in it by a federal law; “data” means any facts, statistics, instructions, concepts or other information in a form that is capable of being communicated, analyzed or processed, whether by an individual or a computer or other means; “document” has the same meaning assigned to it under the Evidence Act 1950 [Act 56]; “data integration” means the process of combination of data; “Committee” means the National Data Sharing Committee established under section 5; “data analytics work” means the examination and analysis of data for the purpose of drawing conclusions as a result of that examination and analysis; “Director General” means the Director General of the National Digital Department; “Minister” means the Minister charged with the responsibility for digital related matters; “data provider” means the public sector agency that shares data to a data recipient under Part IV; “data recipient” means the public sector agency to which data is shared under Part IV. Data Sharing 7 Pillars of data sharing 4. (1) This Act shall be read together with the provisions of other written laws which allow for data sharing to be made, subject to the conditions provided under such laws, and the provisions of this Act shall be in addition to, and not in derogation of, the provisions of the relevant written laws. (2) Any person who shares data under this Act is deemed to have made such disclosure pursuant to the provisions specified in column (3) under the laws specified in column (2) of the Schedule. (3) Any data of the public sector agency shall be dealt with in accordance with the Official Secrets Act 1972 [Act 88] and any directives relating to the security of official document issued by the Government. Part II NATIONAL DATA SHARING COMMITTEE Establishment of Committee 5. (1) A committee by the name of “National Data Sharing Committee” is established and shall be responsible to the Cabinet. (2) The Committee shall consist of the following members: (a) the Secretary General of the ministry charged with the responsibility for digital, who shall be the Chairman; (b) a representative from each of the ministries; (c) a representative of the Prime Minister’s Department; (d) the Chief Government Security Officer; (e) a representative of the National Cyber Security Agency; and (f) a representative of the Personal Data Protection Department. Laws of Malaysia 8 Act 864 (3) Members of the Committee referred to in paragraphs (2)(b) to (f) shall be appointed by the Minister and the Minister may, in respect of each of the member, appoint an alternate member to attend meetings of the Committee when the member is for any reason unable to attend. (4) The Chairman shall appoint from among the members of the Committee a Deputy Chairman. (5) The Director General shall be the secretary to the Committee. Functions of Committee 6. (1) The Committee shall have the following functions: (a) to formulate policies and strategies relating to data sharing under this Act; (b) to oversee the effective implementation of this Act; (c) to take or recommend appropriate steps or administrative actions to resolve the difficulties or administrative issues which arise during the implementation of the Act; (d) to formulate policies relating to database for the purposes of data sharing under this Act; and (e) to do such other things arising out of or consequential to the functions of the Committee under this Act consistent with the purposes of this Act. (2) The policies dan strategies referred to in subsection (1) may include— (a) the procedures to preserve the privacy and confidentiality of data; (b) the safeguards relating to data handling and storage; (c) the method for data sharing under this Act; and (d) the risk assessment frameworks for data handling and storage. Data Sharing 9 (3) The Committee shall have all such powers as may be necessary for, or in connection with, or reasonably incidental to, the performance of its functions under this Act. Temporary exercise of functions of Chairman 7. (1) The Deputy Chairman shall act as the Chairman for the period when— (a) the office of the Chairman is vacant; or (b) the Chairman is, for any reason, unable to carry out his functions. (2) The Deputy Chairman shall, during the period in which he carries out the functions of the Chairman under this section, be deemed to be the Chairman. Meetings of Committee 8. (1) The Committee shall convene its meeting as the Chairman may determine and the meeting shall be held at the time, place and in the manner as the Chairman may determine. (2) The Chairman shall preside at all meetings of the Committee. (3) Where the Chairman is absent from any meeting of the Committee, he may direct the Deputy Chairman to replace him as the chairman of the meeting. (4) Fifteen members, including the Chairman, shall form the quorum of the meeting of the Committee. (5) The Committee may determine its own procedure. Committee may invite others to attend meetings 9. The Committee may invite any person to attend meetings of the Committee to advise the Committee on any matter under discussion. Laws of Malaysia 10 Act 864 Committee may establish subcommittees 10. (1) The Committee may establish any subcommittee as the Committee considers necessary or expedient to assist the Committee in the performance of its functions. (2) The Committee may appoint any person to be a member of any subcommittee established under subsection (1). (3) The Committee may appoint any of its members to be the chairman of the subcommittee established under subsection (1). (4) The subcommittee shall be subject to and act in accordance with any direction given by the Committee. (5) The subcommittee shall meet at the time, place and in the manner as the chairman of the subcommittee may determine. (6) The subcommittee may invite any person to attend meetings of the subcommittee to advise the subcommittee on any matter under discussion. (7) The subcommittee may determine its own procedure. Part III DUTIES AND POWERS OF DIRECTOR GENERAL Duties and powers of Director General 11. (1) The Director General shall have the following duties and powers: (a) to implement the policies and strategies relating to data sharing formulated by the Committee; (b) to coordinate and facilitate data sharing under this Act; (c) to advise and make recommendations to the Committee on matters relating to data sharing under this Act; Data Sharing 11 (d) to require any person to submit any relevant information or document for the purpose of performing his duties and powers under this Act; (e) to issue circulars or guidelines for the purposes of this Act; and (f) to carry out any other duties as directed by the Committee. (2) The Director General shall have all such powers as may be necessary for, or in connection with, or reasonably incidental to, the carrying out of his duties and powers under this Act. Part IV DATA SHARING Request for data sharing 12. (1) Any public sector agency may, in such manner as the Director General may determine, request to another public sector agency for the sharing of data under the control of such other public sector agency. (2) The request referred to in subsection (1) shall specify— (a) the data requested; (b) the purpose for which the data is requested; (c) the public service agencies intended to be the data recipient and the data provider; and (d) the manner of handling the data requested. (3) For the purposes of subsection (1), a public sector agency is taken to have control of data if the data is within the possession or custody of the public sector agency. Laws of Malaysia 12 Act 864 Purpose for which data may be shared 13. A request for sharing of data may be made and granted for the following purposes: (a) to enhance the efficiency or effectiveness of policies, programme management or service planning and delivery by the public sector agencies; (b) to reduce or prevent threat to the life, health or safety of a person, or threat to public health or safety; (c) to respond to a public emergency; (d) in the public interest; or (e) such other purposes as the Committee may determine. Evaluation and response by public sector agency receiving request for data sharing 14. (1) The public sector agency to whom a request is made for data sharing under section 13 shall, after receiving the request, make the following evaluation: (a) whether the purpose for which the data is requested warrants the sharing of the data; (b) whether the sharing of the data is against the public interest; and (c) whether the public sector agency requesting the data has appropriate security and technical safeguards in place to ensure that the shared data is not subject to unauthorized access or use. (2) After making the evaluation under subsection (1), the public sector agency to whom the request for data sharing is made shall, within fourteen days from the date of receiving the request respond as to whether the data requested may be provided, with or without conditions, or is refused under section 15. Data Sharing 13 (3) Where the response referred to in subsection (2) is not possible to be provided within the period specified, the public sector agency to whom the request for data sharing is made shall inform the public sector agency making the request— (a) the reason as to why the response cannot be provided within the period specified; and (b) the period within which such response will be provided. (4) The response and information referred to in this section shall be provided in such manner as the Director General may determine. Refusal to share data requested 15. The public sector agency to whom a request for sharing of data is made under section 12 may refuse to share some or all of the data requested based on the following reasons: (a) the data requested could reasonably be expected to disclose, or enable a person to ascertain, the identity of a confidential source of information relating to the enforcement or administration of law; (b) the data requested could reasonably be expected to disclose the existence or identity of a person included in a witness protection programme; (c) the data requested could reasonably be expected to disclose investigative measures or procedures, including intelligence gathering methodologies, investigative techniques or technologies, covert practices or information sharing arrangements between law enforcement agencies; (d) the sharing of the data requested will constitute a breach of one or more of the following: (i) the solicitor-client privilege or legal professional privilege; (ii) an agreement or a contract; (iii) an equitable obligation of confidence; or (iv) an order of a court or tribunal; Laws of Malaysia 14 Act 864 (e) the data requested involves one or more of the following: (i) national security or defence; (ii) the investigation of a breach, or possible breach, of any written law; (iii) an inquest or inquiry into death; or (iv) a proceeding before a court or tribunal; (f) the public sector agency believes on reasonable grounds that the sharing of the data requested would be likely to endanger the health, safety or welfare of one or more individuals; (g) the data requested is inconsistent with the purpose specified under section 13 and does not warrant the data to be shared; (h) the public sector agency requesting the data does not possess appropriate security and technical safeguards to ensure that the data to be shared is not subject to unauthorized access or use; or (i) any other reason as the Committee may determine. Duty relating to data sharing 16. A data provider and data recipient shall— (a) ensure that the shared data is managed and maintained in compliance with any legal requirements concerning its custody and control that are applicable to such data; (b) take necessary measures to ensure the security and privacy of the data including— (i) the protection of data from any loss, misuse, unauthorized or accidental modification, access or disclosure, alteration or destruction; and Data Sharing 15 (ii) the preservation of rights of individuals relating to personal data protection; (c) keep record of all particulars relating to the shared data; (d) report any unauthorized sharing of data to the Director General; and (e) comply with such other requirements as the Committee may determine. Duty of third party to protect shared data 17. (1) Where a data recipient arranges for any third party to conduct any data migration, data integration or data analytics work using the shared data under this Act, the data recipient shall ensure that the consent of the data provider is obtained before the data is handled by such third party. (2) The third party referred to in subsection (1) shall handle the data in compliance with this Act and the requirements relating to the security of the data applicable in respect of the shared data. (3) Any third party who contravenes subsection (2) commits an offence and shall, upon conviction, be liable to a fine not exceeding one million ringgit or imprisonment for a term not exceeding five years or to both. Restriction on further use and disclosure of shared data 18. (1) Any officer or servant of a data recipient shall not use or disclose the shared data under this Act other than for the purpose for which the data is shared. (2) Any officer or servant of a data recipient who contravenes subsection (1) commits an offence and shall, upon conviction, be liable to a fine not exceeding one million ringgit or to imprisonment for a term not exceeding five years or to both. Laws of Malaysia 16 Act 864 Imposition of fees under other written law 19. The sharing of data under this Act may, where applicable, be subject to the payment of fees as may be imposed by the data provider under any other written law. Sharing of open data 20. For the purpose of sharing of open data, any open data that is available freely by any public sector agency may be accessible and shared regardless whether a request is made under section 12 or not. Duty to report particulars relating to data sharing 21. (1) A public sector agency shall provide a report in writing to the Director General on the following matters: (a) the particulars of requests for data sharing made by the public sector agency; (b) the response given relating to the request for data sharing; (c) where the data requested is refused, the reason for such refusal; and (d) any other information within the control of the public sector agency as the Director General may require. (2) The report referred to in subsection (1) shall be furnished from time to time as the Director General may require. Part V GENERAL Powers of enforcement, inspection and investigation 22. For the purposes of this Act, a police officer not below the rank of sergeant shall have all the powers of a police officer of whatever rank as provided for in the Criminal Procedure Data Sharing 17 Code [Act 593] relating to enforcement, inspection and investigation of any offence under this Act. Obligation of secrecy 23. (1) Except for any of the purposes of this Act or for the purposes of any civil or criminal proceedings under any written law, any officer or servant of a public sector agency, whether during or after his tenure of office or employment, shall not disclose any information obtained by him in the course of his duties. (2) Any person who contravenes subsection (1) commits an offence and shall, upon conviction, be liable to a fine not exceeding one million ringgit or to imprisonment for a term not exceeding five years or to both. Protection against suit and legal proceedings 24. No action, suit, prosecution or other proceedings shall be brought, instituted or maintained in any court against the Minister, any member of the Committee, the Director General or any officer or servant of a public sector agency on account of or in respect of any act, neglect or default done or omitted by him in the course of carrying out his duties under this Act unless it can be proven that the act, neglect or default was done or omitted in bad faith and without reasonable cause. Prosecution 25. No prosecution for an offence under this Act shall be instituted except by or with the written consent of the Public Prosecutor. Liability of director, etc., of statutory body 26. Where any person who commits an offence under this Act is a statutory body, a person who at the time of the commission of the offence was a director, compliance officer, manager, secretary or other similar officer of the statutory body or Laws of Malaysia 18 Act 864 was purporting to act in the capacity or was in any manner or to any extent responsible for the management of any of the affairs of the statutory body or was assisting in its management— (a) may be charged severally or jointly in the same proceedings with the statutory body; and (b) if the statutory body is found guilty of the offence, shall be deemed to be guilty of the offence and shall be liable to the same punishment or penalty as an individual unless, having regard to the nature of his functions in that capacity and to all circumstances, he proves— (i) that the offence was committed without his knowledge; or (ii) that the offence was committed without his consent or connivance and that he had taken all reasonable precautions and exercised due diligence to prevent the commission of the offence. Power to exempt 27. The Minister may, by order published in the Gazette, subject to such conditions or restrictions as he may consider necessary or expedient to impose, exempt any person or class of persons from any or all of the provisions of this Act. Power to give directions 28. The Minister may give directions to the Director General consistent with the provisions of this Act and the Director General shall give effect to those directions. Power to amend Schedule 29. The Minister may, after consultation with the Minister in charge with the responsibility for the relevant written laws, by order published in the Gazette, amend the Schedule. Data Sharing 19

Schedule [Subsection 4(2)] WRITTEN LAWS (1) (2) Written Laws (3) Description 1. Census Act 1960 [Act 16] Subsection 16(2) 2. Audit Act 1957 [Act 62] Subsection 8(3) 3. Kemubu Agricultural Development Authority Act 1972 [Act 69] Section 31 4. Muda Agricultural Development Authority Act 1972 [Act 70] Section 31 5. Lembaga Kemajuan Terengganu Tengah Act 1973 [Act 104] Section 31 6. Malaysian Timber Industry Board (Incorporation) Act 1973 [Act 105] Section 29 7. Farmers’ Organization Authority Act 1973 [Act 110] Subsection 33(1) 8. Federal Agricultural Marketing Authority Act 1965 [Act 141] Section 13 9. Pesticides Act 1974 [Act 149] Section 55 10. Universiti Teknologi MARA Act 1976 [Act 173] Subsection 33(1) 11. Lembaga Kemajuan Kelantan Selatan Act 1978 [Act 203] Subsection 31(1) 12. Malaysian Handicraft Development Corporation Act 1979 [Act 222] Subsection 34(1) 13. Highway Authority Malaysia (Incorporation) Act 1980 [Act 231] Section 27 14. Lembaga Kemajuan Wilayah Pulau Pinang Act 1983 [Act 282] Subsection 32(1) 15. Atomic Energy Licensing Act 1984 [Act 304] Section 41 16. Copyright Act 1987 [Act 332] Section 52 17. Malaysia Industrial Development Authority (Incorporation) Act 1965 [Act 397] Subsection 13(2) Laws of Malaysia 20 Act 864 (1) (2) Written Laws (3) Description 18. National Productivity Corporation (Incorporation) Act 1966 [Act 408] Subsection 17(2) 19. Lembaga Pembangunan Langkawi Act 1990 [Act 423] Subsection 30(1) 20. Co-operative College (Incorporation) Act 1968 [Act 437] Subsection 12c(1) 21. Malaysia Tourism Promotion Board Act 1992 [Act 481] Subsection 23(1) 22. Tourism Industry Act 1992 [Act 482] Subsection 35(1) 23. Majlis Amanah Rakyat Act 1966 [Act 489] Section 32 24. Malaysian Construction Industry Development Board Act 1994 [Act 520] Subsection 36(1) 25. Control of Paddy and Rice Act 1994 [Act 522] Subsection 30(1) 26. Inland Revenue Board of Malaysia Act 1995 [Act 533] Subsection 31(1) 27. Perbadanan Putrajaya Act 1995 [Act 536] Subsection 32(1) 28. Perbadanan Tabung Pendidikan Tinggi Nasional Act 1997 [Act 566] Subsection 54(1) 29. Malaysia Palm Oil Board Act 1998 [Act 582] Subsection 66(1) 30. Labuan Corporation Act 2001 [Act 609] Subsection 26(1) 31. Pembangunan Sumber Manusia Berhad Act 2001 [Act 612] Subsection 51(1) 32. Companies Commission of Malaysia Act 2001 [Act 614] Subsection 38(1) 33. Intellectual Property Corporation of Malaysia Act 2002 [Act 617] Subsection 39(1) 34. Skills Development Fund Act 2004 [Act 640] Subsection 91(1) 35. National Skills Development Act 2006 [Act 652] Subsection 71(1) 36. Akademi Seni Budaya dan Warisan Kebangsaan Act 2006 [Act 653] Subsection 38(1) 37. Malaysian Pepper Board Act 2006 [Act 656] Subsection 60(1) 38. Iskandar Regional Development Authority Act 2007 [Act 664] Subsection 49(1) Data Sharing 21 (1) (2) Written Laws (3) Description 39. Malaysian Qualifications Agency Act 2007 [Act 679] Subsection 112(1) 40. North Corridor Implementation Authority Act 2008 [Act 687] Subsection 45(1) 41. East Coast Economic Region Development Council Act 2008 [Act 688] Subsection 43(1) 42. National Kenaf and Tobacco Board Act 2009 [Act 692] Subsection 81(1) 43. Feed Act 2009 [Act 698] Subsection 50(1) 44. Perbadanan Stadium Malaysia Act 2010 [Act 717] Subsection 34(1) 45. National Sports Institute Act 2011 [Act 729] Subsection 43(1)