Establishment of a Data Center in Malaysia from the Legal Perspective

1. Conditions and Restrictions stipulated on Land Title

One of the key aspects of the establishment of a data center in Malaysia is land. It is important to peruse the particulars and conditions stipulated on the land title, which sets out, amongst others, particulars about the registered proprietor, nature of ownership (e.g. freehold or leasehold), express conditions governing the use of the property, and restriction-in-interest which are restrictions governing the dealings of properties. For example, one common form of restriction-in-interest is that certain properties cannot be transferred, leased or charged without the prior written consent of the state authority. In such case, the transferor will need to apply for the state authority’s consent prior to the transfer and non-compliance with the restriction-in-interest will result in non-registration of the transfer.

As stated above, the proposed establishment of a data center must be aligned with the express conditions stipulated on the land title as a breach of an express condition may result in a fine being imposed or the property being liable to forfeiture to the state authority under Section 127 of the Malaysian National Land Code (Revised 2020) (the “MNLC”).

Further, it is prudent to check with the relevant local state authority on the applicable zoning and industrial use requirements in respect of the proposed establishment of a data center. For instance, the Johor Bahru City Council has published its Industrial Guideline which sets out the minimum standards to be complied by a data center established within its jurisdiction, including that the data center must be located in an industrial area and comply with a maximum built-up area of 60% of the land.

2. Foreign Equity Restrictions in respect of Acquisition and Lease of Land

Pursuant to Section 433B of the MNLC, acquisition or lease of land by a foreign company (including a company incorporated in Malaysia with at least 50% voting rights held by a foreign company) requires the prior approval of the relevant state authority. Failure to obtain the state authority’s prior approval will result in the acquisition or lease being null and void.※1

The approval of the Economic Planning Unit may be required under the Guideline on the Acquisition of Properties (“EPU Guideline”) if, amongst others, the property value is RM20 million or more and such acquisition results in a dilution of Bumiputera※2 ownership of property. In addition, an indirect acquisition of property with a value exceeding RM20 million, through acquisition of shares which results in a change of control of a company owned by Bumiputera, may also require the approval of the Economic Planning Unit under the EPU Guideline. Where the Economic Planning Unit’s approval above is required under the EPU Guideline, such approval may be granted subject to the applicant’s satisfaction of a minimum 30% Bumiputera equity condition.

However, the EPU Guideline also sets out a list of exceptions to the requirement of obtaining the approval of the Economic Planning Unit contemplated under the EPU Guideline. One of the exceptions is if the purchaser of the property is a holder of status of Malaysia Digital (MD) which intends to acquire the property for its own operational use, and that property is situated in the area of Multimedia Super Corridor (MSC). A company which undertakes MD activities (including artificial intelligence, data center and cloud services) may be eligible to apply for the MD status and various incentives from the Malaysian Government.

3. Key Regulatory Approval in respect of Operation of Data Center

Foreign data center developers are generally allowed to own up to 100% equity participation in the Malaysian entity(ies) incorporated to undertake development of data centers in Malaysia. However, the services offered by the data centers will need to be considered in detail and depending on the type of services provided by the data centers, the data center developer may be required to obtain specific regulatory approvals, and some approvals are subject to foreign equity restrictions.

In general, a data center may require a class licence pursuant to the Malaysian Communications and Multimedia Act 1998 as an applications service provider to provide “cloud services”. “Cloud service” is defined to mean “any service made available to end users on demand via the Internet from a cloud computing provider’s server”※3 and the class licence to provide cloud service only requires registration with the Malaysian Communication and Multimedia Commission (the “MCMC”) and there is no shareholding restriction imposed under the said class licence.

4. Processing of Personal Data

Following the passing of the Personal Data Protection (Amendment) Bill 2024 by the Malaysian Parliament in July 2024 and upon the amendments coming into force, there will be new obligations on data processors under the amended Personal Data Protection Act 2010 (the “Amended PDPA 2010”). Amongst the new obligations, a data processor which processes personal data on behalf of a data controller must comply with the security principle as set out in Section 9 of the Amended PDPA 2010, which requires the data processor to take practical steps to protect the personal data from any loss, misuse, modification, unauthorized or accidental access or disclosure, alteration or destruction.

Further, a data processor is required to appoint one or more data protection officers who must be accountable to the data processor for compliance with the Amended PDPA 2010. Based on the public consultation paper※4 issued by the Malaysian Department of Personal Data Protection, the Personal Data Protection Commissioner intends to introduce specific regulations and guideline with regard to the appointment of data protection officer. It was suggested in the consultation paper that only data processors that carry out data processing activities of a large scale by considering specific prescribed factors, will be required to appoint a data protection officer. The consultation paper also suggested that the data protection officer should be ordinarily resident in Malaysia in order to ensure accessibility and responsiveness to the Personal Data Protection Commissioner and set out examples of responsibilities of the data protection officer such as to monitor the data processor’s personal data compliance and to carry out data protection impact assessments.

5. Guidelines on the Sustainability of Data Center

Earlier in 2024, the MCMC revised the voluntary technical code “Specification for Green Data Centres” which provides a framework for data centers to optimize their energy practices to align with global standards for energy efficiency and sustainability. Data center operators in Malaysia may consider the best practices stipulated in the voluntary technical code to improve their energy efficiency and reduce their carbon footprint.

In addition, it was earlier reported that the Malaysian Government intends to issue Guidelines for Data Center Power Usage Effectiveness and Water Usage Effectiveness in 2024 and other local state authorities such as the Johor Town and Country Planning Department and the Johor State Government also intend to issue guidelines which aim to coordinate and monitor data center development planning in the state. As at the date of this article, such guidelines have not been published, but data center operators in Malaysia ought to be mindful of the applicable guidelines when the same are published by the Malaysian authorities.

Conclusion

There is no general overarching foreign investment restriction in Malaysia and subject to the applicable sectoral restrictions and land ownership restrictions, foreign data center developers are generally allowed to own up to 100% equity participation in the Malaysian entity(ies) incorporated to undertake development of data centers in Malaysia. However, it would be prudent for data center developers and operators to consider the relevant regulations and guideline above that are applicable to their data centers in Malaysia.