DATA SHARING ACT 2025

Data Sharing LAWS OF MALAYSIA Act 864 DATA SHARING ACT 2025 1 2 Laws of Malaysia Act 864 Date of Royal Assent ... ... 5 February 2025 Date of publication in the Gazette ... ... 20 February 2025 Publisher’s Copyright C PERCETAKAN NASIONAL MALAYSIA BERHAD All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted in any form or by any means electronic, mechanical, photocopying, recording and/or otherwise without the prior permission of Percetakan Nasional Malaysia Berhad (Appointed Printer to the Government of Malaysia). Data Sharing LAWS OF MALAYSIA Act 864 DATA SHARING ACT 2025 ARRANGEMENT OF SECTIONS Part I PRELIMINARY Section 1. Short title and commencement 2. This Act binds Federal Government 3. Interpretation 4. Pillars of data sharing Part II NATIONAL DATA SHARING COMMITTEE 5. Establishment of Committee 6. Functions of Committee 7. Temporary exercise of functions of Chairman 8. Meetings of Committee 9. Committee may invite others to attend meetings 10. Committee may establish subcommittees Part III DUTIES AND POWERS OF DIRECTOR GENERAL 11. Duties and powers of Director General 3 4 Laws of Malaysia Act 864 Part IV DATA SHARING Section 12. Request for data sharing 13. Purpose for which data may be shared 14. Evaluation and response by public sector agency receiving request for data sharing 15. Refusal to share data requested 16. Duty relating to data sharing 17. Duty of third party to protect shared data 18. Restriction on further use and disclosure of shared data 19. Imposition of fees under other written law 20. Sharing of open data 21. Duty to report particulars relating to data sharing Part V GENERAL 22. Powers of enforcement, inspection and investigation 23. Obligation of secrecy 24. Protection against suit and legal proceedings 25. Prosecution 26. Liability of director, etc., of statutory body 27. Power to exempt 28. Power to give directions 29. Power to amend Schedule Schedule 5 Data Sharing LAWS OF MALAYSIA Act 864 DATA SHARING ACT 2025 An Act to provide for the sharing of data within the control of a public sector agency with other public sector agency, establishment of the National Data Sharing Committee, functions and powers of the Director General of the National Digital Department in relation to data sharing and other related matters. [ ] ENACTED by the Parliament of Malaysia as follows: Part I PRELIMINARY Short title and commencement 1. (1) This Act may be cited as the Data Sharing Act 2025. (2) This Act comes into operation on a date to be appointed by the Minister by notification in the Gazette. This Act binds Federal Government 2. This Act shall bind the Federal Government. 6 Laws of Malaysia Act 864 Interpretation 3. In this Act, unless the context otherwise requires— “public sector agency” means— (a) the agency in charge of the public services referred to in Clause (1) of Article 132 of the Federal Constitution, except the services referred to in paragraphs (f) and (g); and (b) any statutory authority exercising powers vested in it by a federal law; “data” means any facts, statistics, instructions, concepts or other information in a form that is capable of being communicated, analyzed or processed, whether by an individual or a computer or other means; “document” has the same meaning assigned to it under the Evidence Act 1950 [Act 56]; “data integration” means the process of combination of data; “Committee” means the National Data Sharing Committee established under section 5; “data analytics work” means the examination and analysis of data for the purpose of drawing conclusions as a result of that examination and analysis; “Director General” means the Director General of the National Digital Department; “Minister” means the Minister charged with the responsibility for digital related matters; “data provider” means the public sector agency that shares data to a data recipient under Part IV; “data recipient” means the public sector agency to which data is shared under Part IV. Data Sharing 7 Pillars of data sharing 4. (1) This Act shall be read together with the provisions of other written laws which allow for data sharing to be made, subject to the conditions provided under such laws, and the provisions of this Act shall be in addition to, and not in derogation of, the provisions of the relevant written laws. (2) Any person who shares data under this Act is deemed to have made such disclosure pursuant to the provisions specified in column (3) under the laws specified in column (2) of the Schedule. (3) Any data of the public sector agency shall be dealt with in accordance with the Official Secrets Act 1972 [Act 88] and any directives relating to the security of official document issued by the Government. Part II NATIONAL DATA SHARING COMMITTEE Establishment of Committee 5. (1) A committee by the name of “National Data Sharing Committee” is established and shall be responsible to the Cabinet. (2) The Committee shall consist of the following members: (a) the Secretary General of the ministry charged with the responsibility for digital, who shall be the Chairman; (b) a representative from each of the ministries; (c) a representative of the Prime Minister’s Department; (d) the Chief Government Security Officer; (e) a representative of the National Cyber Security Agency; and (f) a representative of the Personal Data Protection Department. 8 Laws of Malaysia Act 864 (3) Members of the Committee referred to in paragraphs (2)(b) to (f) shall be appointed by the Minister and the Minister may, in respect of each of the member, appoint an alternate member to attend meetings of the Committee when the member is for any reason unable to attend. (4) The Chairman shall appoint from among the members of the Committee a Deputy Chairman. (5) The Director General shall be the secretary to the Committee. Functions of Committee 6. (1) The Committee shall have the following functions: (a) to formulate policies and strategies relating to data sharing under this Act; (b) to oversee the effective implementation of this Act; (c) to take or recommend appropriate steps or administrative actions to resolve the difficulties or administrative issues which arise during the implementation of the Act; (d) to formulate policies relating to database for the purposes of data sharing under this Act; and (e) to do such other things arising out of or consequential to the functions of the Committee under this Act consistent with the purposes of this Act. (2) The policies dan strategies referred to in subsection (1) may include— (a) the procedures to preserve the privacy and confidentiality of data; (b) the safeguards relating to data handling and storage; (c) the method for data sharing under this Act; and (d) the risk assessment frameworks for data handling and storage. Data Sharing 9 (3) The Committee shall have all such powers as may be necessary for, or in connection with, or reasonably incidental to, the performance of its functions under this Act. Temporary exercise of functions of Chairman 7. (1) The Deputy Chairman shall act as the Chairman for the period when— (a) the office of the Chairman is vacant; or (b) the Chairman is, for any reason, unable to carry out his functions. (2) The Deputy Chairman shall, during the period in which he carries out the functions of the Chairman under this section, be deemed to be the Chairman. Meetings of Committee 8. (1) The Committee shall convene its meeting as the Chairman may determine and the meeting shall be held at the time, place and in the manner as the Chairman may determine. (2) The Chairman shall preside at all meetings of the Committee. (3) Where the Chairman is absent from any meeting of the Committee, he may direct the Deputy Chairman to replace him as the chairman of the meeting. (4) Fifteen members, including the Chairman, shall form the quorum of the meeting of the Committee. (5) The Committee may determine its own procedure. Committee may invite others to attend meetings 9. The Committee may invite any person to attend meetings of the Committee to advise the Committee on any matter under discussion. 10 Laws of Malaysia Act 864 Committee may establish subcommittees 10. (1) The Committee may establish any subcommittee as the Committee considers necessary or expedient to assist the Committee in the performance of its functions. (2) The Committee may appoint any person to be a member of any subcommittee established under subsection (1). (3) The Committee may appoint any of its members to be the chairman of the subcommittee established under subsection (1). (4) The subcommittee shall be subject to and act in accordance with any direction given by the Committee. (5) The subcommittee shall meet at the time, place and in the manner as the chairman of the subcommittee may determine. (6) The subcommittee may invite any person to attend meetings of the subcommittee to advise the subcommittee on any matter under discussion. (7) The subcommittee may determine its own procedure. Part III DUTIES AND POWERS OF DIRECTOR GENERAL Duties and powers of Director General 11. (1) The Director General shall have the following duties and powers: (a) to implement the policies and strategies relating to data sharing formulated by the Committee; (b) to coordinate and facilitate data sharing under this Act; (c) to advise and make recommendations to the Committee on matters relating to data sharing under this Act; Data Sharing 11 (d) to require any person to submit any relevant information or document for the purpose of performing his duties and powers under this Act; (e) to issue circulars or guidelines for the purposes of this Act; and (f) to carry out any other duties as directed by the Committee. (2) The Director General shall have all such powers as may be necessary for, or in connection with, or reasonably incidental to, the carrying out of his duties and powers under this Act. Part IV DATA SHARING Request for data sharing 12. (1) Any public sector agency may, in such manner as the Director General may determine, request to another public sector agency for the sharing of data under the control of such other public sector agency. (2) The request referred to in subsection (1) shall specify— (a) the data requested; (b) the purpose for which the data is requested; (c) the public service agencies intended to be the data recipient and the data provider; and (d) the manner of handling the data requested. (3) For the purposes of subsection (1), a public sector agency is taken to have control of data if the data is within the possession or custody of the public sector agency. 12 Laws of Malaysia Act 864 Purpose for which data may be shared 13. A request for sharing of data may be made and granted for the following purposes: (a) to enhance the efficiency or effectiveness of policies, programme management or service planning and delivery by the public sector agencies; (b) to reduce or prevent threat to the life, health or safety of a person, or threat to public health or safety; (c) to respond to a public emergency; (d) in the public interest; or (e) such other purposes as the Committee may determine. Evaluation and response by public sector agency receiving request for data sharing 14. (1) The public sector agency to whom a request is made for data sharing under section 13 shall, after receiving the request, make the following evaluation: (a) whether the purpose for which the data is requested warrants the sharing of the data; (b) whether the sharing of the data is against the public interest; and (c) whether the public sector agency requesting the data has appropriate security and technical safeguards in place to ensure that the shared data is not subject to unauthorized access or use. (2) After making the evaluation under subsection (1), the public sector agency to whom the request