Scope assessment
Whether and how the Act applies to each service.
Governance / Online Safety
Online Safety Act Compliance (Act 866)
The Online Safety Act 2025 has been in force since 1 January 2026. We help licensed platforms and the businesses that build for them understand their duties, draft the Online Safety Plan, and set up reporting and response processes that meet the prescribed timelines.
Overview
Online Safety Act Compliance
What it is
A compliance service for the Online Safety Act 2025: confirming scope, mapping the prescribed duties to your product, drafting the Online Safety Plan and designing the processes behind it.
Why organisations need it
The Act imposes duties on licensed application and content application service providers, including reducing exposure to harmful content, user guidelines, reporting and assistance mechanisms, protecting child users, acting on priority harmful content and preparing an Online Safety Plan. Failing a prescribed duty can cost up to RM10 million. Codes under the Act are still being developed, so the plan must be built to the Act and regulations in force and updated as codes arrive.
Key features
What the engagement covers
Duty mapping
Each prescribed duty mapped to product and process.
Online Safety Plan
Drafted, owned and evidenced.
Reporting and response
Processes built to the prescribed periods.
Child safety
Age assurance, defaults and protections balanced with the PDPA.
Monitoring
Updates as MCMC codes are issued.
Business value
What the business gets out of it
Clear scope
Know whether you are in.
A plan that evidences controls
Not just intentions.
Timelines met
Processes sized to the periods.
PDPA aligned
Child safety without over-collecting data.
Kept current
Updated as codes arrive.
How it works
How the engagement runs
01
Scoping
Services and user base.
02
Mapping
Duties to controls.
03
Drafting
Online Safety Plan and processes.
04
Testing
Walkthrough of reporting scenarios.
05
Maintenance
Updates for codes and changes.
Deliverables
What you receive
Scope assessment
Applicability per service.
Duty-to-control map
Every prescribed duty.
Online Safety Plan
Drafted and evidenced.
Process playbooks
Reporting, response and escalation.
Update schedule
Tracking codes and changes.
Who it is for
Who this is built for
Industries
Company sizes
Departments
Why Orbix
Why organisations choose Orbix
A governance approach, not a tool sale
We do not resell products, so nothing here is shaped by a vendor margin. The recommendation is whatever your risk and your budget actually justify, including telling you that you do not need the engagement yet.
Recommendations you can actually implement
Findings come with a sequence, an owner and a realistic effort estimate, sized to the team you have rather than the team a framework assumes. A report that cannot be acted on is an expense, not a control.
Consultants who have sat on your side of the table
Our people have carried the obligation internally, not only audited it. That shows up in what we consider proportionate, and in how much documentation we think you genuinely need.
Built for the Malaysian operating context
Work is grounded in Malaysian law and regulator expectation, from the PDPA and the Cyber Security Act 2024 to Bursa, BNM and SC requirements, rather than translated from a European or American template.
HRD Corp expertise where it applies
Where an engagement includes training, the training component is structured to be HRD Corp SBL-Khas claimable, which changes what the programme costs you in practice.
Questions
Questions we get asked
Does the Act apply to us?
It binds licensed application and content application service providers, and platforms with at least eight million Malaysian users are deemed registered. We assess each service.
Are the codes final?
Not yet. The plan is built to the Act and regulations in force and updated when MCMC issues codes.
What is an Online Safety Plan?
The document that records how a provider meets its duties, with owners, controls and evidence.
Can you help small platforms?
Yes. Many small platforms are not directly bound but want to meet expectations of licensed partners.
Does child safety conflict with the PDPA?
It can if age assurance collects too much data. We balance both.
Get started
Meet the Online Safety Act with evidence
Tell us your services and user base. We will assess scope and quote.