Online Safety Act Compliance for Digital Platforms (Act 866)
The Online Safety Act 2025 came into force on 1 January 2026, together with four sets of regulations covering fees, undertakings, response periods and the Online Safety Appeal Tribunal. It places duties on application service providers and content application service providers licensed under the Communications and Multimedia Act 1998, and social media and messaging services with at least eight million users in Malaysia are deemed to be registered licensees. Those providers must reduce users' exposure to harmful content, publish user guidelines, give users safety tools, provide reporting and assistance mechanisms, protect child users, act on priority harmful content such as child sexual abuse material and financial fraud, and document it all in an Online Safety Plan. Response timelines are measured in hours, and failing a prescribed duty can cost up to RM10 million.
This two-day course is for trust and safety, legal, compliance, product and operations teams at licensed platforms and at the Malaysian businesses that build for them: app developers, agencies, marketplaces and community operators. It is clear about who is in scope. The Act binds service providers, not individual users, so a small seller on a marketplace is not a licensee, although the platform's enforcement will reach it. Codes under the Act are still being developed by MCMC, so the course teaches to the Act and the regulations already in force and flags where the codes are expected to add detail. Platforms that also run automated moderation or recommendation should pair it with Automated Decision-Making and Profiling.
HRD Corp SBL-Khas Claimable
Programme Agenda
Day 1, 9:00 AM - 9:15 AM
Welcome and Programme Overview
Introduction to the session, objectives, and housekeeping.
Day 1, 9:15 AM - 10:15 AM
Why the Act Exists and How It Fits
The policy background, the relationship with the Communications and Multimedia Act 1998 and MCMC's licensing regime, and the four regulations in force from 1 January 2026: fees, form of undertaking, periods, and the Online Safety Appeal Tribunal.
Day 1, 10:15 AM - 10:30 AM
Break
Day 1, 10:30 AM - 11:30 AM
Scope: Who Carries the Duties
Application service providers, content application service providers and network service providers, the eight million user threshold and deemed registration, how private communications are treated, and why the Act binds providers rather than individual users. Exercise: participants map their own services and client services against the scope tests.
Day 1, 11:30 AM - 12:30 PM
Harmful Content and Priority Harmful Content
The categories of harmful content in the Act, from child sexual abuse material and financial fraud, which are priority harmful content, to content that incites violence, induces a child to self-harm or promotes dangerous drugs. Why classification decisions need written criteria and consistent reviewers.
Day 1, 12:30 PM - 1:30 PM
Lunch
Day 1, 1:30 PM - 3:15 PM
Risk Mitigation and User Guidelines
The duty to implement measures that mitigate the risk of exposure to harmful content, assessing where that risk arises in your product, and writing user guidelines people will read. Linking community rules to enforcement actions.
Day 1, 3:15 PM - 3:30 PM
Break
Day 1, 3:30 PM - 4:45 PM
Reporting, User Assistance and Response Timelines
Designing reporting and user assistance mechanisms, the acknowledgement, assessment and takedown periods set by the Online Safety (Period) Regulations 2025, staffing and escalation to meet them, and keeping the records that prove you did.
Day 1, 4:45 PM - 5:00 PM
Day 1 Close
Recap and what to review before day two.
Day 2, 9:00 AM - 9:15 AM
Day 1 Review
Recap of day one and the questions it left open.
Day 2, 9:15 AM - 10:15 AM
Protecting Child Users
The duty to protect the online safety of child users: age assurance options, safer defaults, limiting contact from unknown adults, recommendation and advertising settings, and parental tools. Balancing protection with the PDPA when collecting age data.
Day 2, 10:15 AM - 10:30 AM
Break
Day 2, 10:30 AM - 11:30 AM
Priority Harmful Content and Financial Fraud
Making child sexual abuse material and financial fraud inaccessible quickly, scam advertising and impersonation, working with MCMC, banks and law enforcement, and preserving evidence.
Day 2, 11:30 AM - 12:30 PM
The Online Safety Plan
What the plan must cover, who owns it, how to evidence that measures work, review cadence and board reporting. Common weaknesses: plans that describe intentions rather than controls, and metrics that count reports but not outcomes.
Day 2, 12:30 PM - 1:30 PM
Lunch
Day 2, 1:30 PM - 3:15 PM
Enforcement, Undertakings and the Appeal Tribunal
MCMC's supervisory and enforcement powers, undertakings, penalties of up to RM10 million for failing a prescribed duty and up to RM1 million for timeline breaches, and appeals to the Online Safety Appeal Tribunal.
Day 2, 3:15 PM - 3:30 PM
Break
Day 2, 3:30 PM - 4:45 PM
Workshop: Drafting and Stress-Testing an Online Safety Plan
Teams draft the core of an Online Safety Plan for a case platform, then test it against three incidents: a viral scam advertisement, a child grooming report and a mass report campaign.
Day 2, 4:45 PM - 5:00 PM
Wrap-Up and Q&A
Key takeaways, next steps, and close.
Key Outcomes
- Determine whether a service falls within the Online Safety Act and which duties apply
- Classify harmful and priority harmful content consistently
- Design reporting and user assistance processes that meet the prescribed response periods
- Apply child protection measures without breaching PDPA obligations
- Draft an Online Safety Plan that evidences controls rather than intentions
- Explain MCMC enforcement, undertakings, penalties and the appeal route
Training Mode Physical / Online / Hybrid / e-learning
HRD Corp SBL-Khas Claimable
Level Intermediate. For trust and safety, legal, compliance, product and operations teams at digital platforms and app providers, and agencies and developers building services for them.
Duration 2 Days (16 Hours) | 9:00 AM to 5:00 PM daily
Venue In-house at the client's premises, or delivered via the client's preferred platform (Microsoft Teams, Zoom, or equivalent)
Assessment A draft Online Safety Plan for a case platform, tested against three incident scenarios, plus a written knowledge check
Certificate Certificate of Completion issued to all participants upon full attendance