Scope assessment
Whether and how the Act applies to each service.
Online Safety Act Compliance (Act 866)
Online Safety Act compliance is meeting the duties the Online Safety Act 2025 (Act 866) places on licensed application and content application service providers. The Online Safety Act 2025 has been in force since 1 January 2026. We help licensed platforms and the businesses that build for them understand their duties, draft the Online Safety Plan, and set up reporting and response processes that meet the prescribed timelines.
Online Safety Act Compliance
What it is
A compliance service for the Online Safety Act 2025: confirming scope, mapping the prescribed duties to your product, drafting the Online Safety Plan and designing the processes behind it.
Why organisations need it
The Act imposes duties on licensed application and content application service providers, including reducing exposure to harmful content, user guidelines, reporting and assistance mechanisms, protecting child users, acting on priority harmful content and preparing an Online Safety Plan. Failing a prescribed duty can cost up to RM10 million. Codes under the Act are still being developed, so the plan must be built to the Act and regulations in force and updated as codes arrive.
What the engagement covers
Duty mapping
Each prescribed duty mapped to product and process.
Online Safety Plan
Drafted, owned and evidenced.
Reporting and response
Processes built to the prescribed periods.
Child safety
Age assurance, defaults and protections balanced with the PDPA.
Monitoring
Updates as MCMC codes are issued.
What the business gets out of it
Clear scope
Know whether you are in.
A plan that evidences controls
Not just intentions.
Timelines met
Processes sized to the periods.
PDPA aligned
Child safety without over-collecting data.
Kept current
Updated as codes arrive.
How it works
How the engagement runs
01
Scoping
Services and user base.
02
Mapping
Duties to controls.
03
Drafting
Online Safety Plan and processes.
04
Testing
Walkthrough of reporting scenarios.
05
Maintenance
Updates for codes and changes.
Deliverables
What you receive
Scope assessment
Applicability per service.
Duty-to-control map
Every prescribed duty.
Online Safety Plan
Drafted and evidenced.
Process playbooks
Reporting, response and escalation.
Update schedule
Tracking codes and changes.
Who it is for
Who this is built for
Industries
Company sizes
Departments
FAQ
FAQ
It binds licensed application service providers and content application service providers, and platforms with at least eight million Malaysian users are deemed registered. Many businesses that build for those platforms are not directly bound. We assess each service against the Act to confirm where you stand.
Not yet. Codes under the Act are still being developed by MCMC, so the Online Safety Plan is built to the Act and the regulations in force since 1 January 2026, and updated when codes are issued. Waiting for the codes is not an option, because the duties already apply.
It is the document that records how a provider meets its duties under the Act, with an owner, controls and evidence for each: reducing exposure to harmful content, user guidelines, reporting and assistance mechanisms, protection of child users and action on priority harmful content.
Yes. Many small platforms are not directly bound but want to meet the expectations of licensed partners, app stores or advertisers. For them we scale the work down to the processes that matter most, such as user reporting and response, without building a full plan.
It can. Age assurance and child protection measures can collect more personal data than necessary, which raises PDPA issues of its own. We design the measures so they protect child users while collecting only what the purpose needs.