Malaysia is working towards bringing a proposed data-centre law before Parliament in 2027, with the Digital Ministry saying the legislation is in its final stages of drafting.
The Digital Infrastructure (Data Centre) Bill is intended to create a clearer framework for protecting data centres and keeping them operating through disruption. The ministry said it would still need to complete policy and legal coordination, and the timetable for parliamentary consideration depends on government approval.
The update was given in a written reply dated 12 November to Syahredzan Johan, the member of Parliament for Bangi, who asked about plans and timing for legislation to strengthen digital infrastructure. The proposal has not been presented as an enacted law, and the 2027 date is a target rather than a guaranteed start date for new rules.
Protecting services from disruption
Data centres house the computing equipment that stores information and supports services delivered over networks. The ministry regards them as critical national digital infrastructure because public services and economic activity depend on reliable systems. Cloud computing, online commerce and artificial intelligence are among the activities supported by such infrastructure.
The government wants the proposed framework to address several kinds of risk rather than focusing only on cyber security. Digital Minister Gobind Singh Deo described an approach covering cyber threats, system failures, operational disruption, natural disasters, physical risks and vulnerabilities in supply chains.
Preparedness, disaster recovery and business continuity are also part of the stated approach. In practical terms, resilience concerns how well services can withstand an interruption and recover afterwards. The ministry’s description sets out the aims of the planned framework; it does not establish the detailed obligations that operators will eventually face.
After a bill is finalised, it would need government approval before the planned parliamentary consideration. If it is passed and brought into force, the ministry says it would coordinate implementation of the framework, including compliance with standards on security, resilience and continuity. Those steps have not yet taken place.
Building on an earlier proposal
The government had already announced plans for a data-centre bill in October. Following a National Economic Action Council meeting on 19 October, the Economy Ministry said the proposed legislation was expected to be presented to the Cabinet in 2027. The earlier announcement linked the industry’s growth to the availability of electricity and water, environmental effects and benefits for the domestic economy.
The latest parliamentary reply adds the Digital Ministry’s assessment that drafting has reached its final stages and identifies a target for consideration and debate in the Dewan Rakyat, Malaysia’s lower house, in 2027. It also describes the intended focus on the security and continuity of data-centre operations. Cabinet consideration and parliamentary debate are different stages; the earlier Cabinet plan should not be mistaken for a law already approved by legislators.
Pressure on utilities
The sector’s demand for power and water is a separate part of the policy challenge. Servers require electricity to operate, while cooling equipment can use water to manage the heat they produce. The government’s earlier plan sought to align data-centre expansion with available utility capacity.
In a separate parliamentary reply, the Digital Ministry said 11 data-centre projects had been approved in Kuala Lumpur as of October. Nine were operating and two were under construction. Those figures concern the capital and should not be read as a count of projects across Malaysia.
The ministry said applications for data-centre development require approval from the Data Centre Task Force, whose assessment includes whether electricity and water supplies are available and adequate. The existing assessment process is distinct from the new legislation being drafted.
Existing water-supply guidelines for data-centre developments also include efficiency measures, consideration of alternative water sources, disruption-risk assessments and storage requirements. The proposed bill’s precise relationship with existing requirements will depend on its final text and any later implementation measures.
The immediate change is therefore a clearer account of the government’s intended legislative route, not a new operating standard already in force. The eventual effect on operators and the services that rely on them will depend on what ministers finalise, what Parliament considers and which measures are adopted afterwards.
