This downloadable resource accompanies our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business?, and consists of a free, adaptable playbook for handling harmful content reports under Malaysia’s Online Safety Act 2025, covering roles, triage tiers, timelines, review rights and record-keeping.

A fraudulent advertisement appears on your platform on a Friday evening. By Monday, users have lost money, a journalist has called, and a licensed partner is asking to see your takedown procedure.

What separates a manageable weekend from a costly one is rarely how sophisticated your content policy is. It is whether someone knew, without having to ask, that the decision was theirs to make and what timeline applied.

Why the clock now matters

For licensed applications service providers and content applications service providers, the Online Safety Act 2025 (“ONSA“) and the Online Safety (Period) Regulations 2025 put that clock into law:

• A report must be acknowledged within one hour of reaching the official reporting channel. The user must be told its status within 12 hours of that acknowledgement.
• Content the provider considers to be priority harmful content must be made inaccessible immediately. This covers child sexual abuse material and content on financial fraud. Once the provider confirms the content is priority harmful content, it has one hour to make it permanently inaccessible.
• Other harmful content confirmed as such must be made permanently inaccessible within 12 hours.
• Missing either of the last two deadlines is an offence carrying a fine of up to RM1 million.

If your business is not licensed, you are not bound by these timelines. They are, however, quickly becoming the benchmark that platform partners, investors and regulators use to judge whether a takedown process is adequate. Increasingly, they also appear in the contracts you sign.

The questions you will be asked

When something goes wrong, the questions are almost always the same:

• Who assessed the report?
• What standard did they apply?
• How quickly did the content come down?
• Is there a record?

A simple test: could your team answer those questions today, without preparation? If the answer involves a pause, that is the work to be done.

What the playbook covers

The Harmful Content Escalation & Takedown Playbook is a short operating procedure. It is designed to be proportionate for a business that is not a large licensed platform, and short enough that the people who must follow it will actually read it. It sets out:

• Five defined roles with clear decision rights, from First Responder to Review Officer. Each must be held by a named individual with a named alternate, including out-of-hours cover.
• Four triage tiers, Critical, Serious, Standard and Dismissible, with immediate actions and target decision times you can adjust to your capacity. The statutory periods are set out alongside for comparison.
• A nine-step workflow, from receipt through to closing the case and learning from it.
• A seven-question assessment standard, so that two assessors looking at the same report reach the same outcome and can show why. It includes the statutory exemptions for awareness, educational, scientific and medical content, which helps avoid over-removal.
• Notification and review rules, including the requirement that a review is carried out by someone other than the original decision-maker.
• An incident log specification, setting out the record you will be asked to produce in a partner negotiation, an investor’s diligence or after an incident.
• External escalation triggers, covering when to involve the police, MCMC, partners or counsel.
• An adoption checklist for board sign-off.

Three mistakes the playbook is designed to prevent

1. Treating triage as a decision on the merits. Triage is about speed. If in doubt, assign the higher tier.
2. Mishandling suspected child sexual abuse material. Preserving evidence is usually right, but not here. Downloading, copying, screenshotting or forwarding such material can itself be an offence. The playbook sets out a separate protocol: restrict access in place, record identifiers only, and report to the police.
3. Leaving an over-removal in place. Restoring legitimate content promptly is part of a defensible process, not an afterthought.

Download the Harmful Content Escalation & Takedown Playbook

Enter your details below and we’ll email you a copy of the playbook.

Making it yours

A template only goes so far. The tiers, timelines and decision rights need to fit your service and your headcount. They also need to fit what your platform and payment partner contracts already require of you, which is often the real constraint. JOC can adapt the playbook to your business, check it against your terms of use and partner agreements, and produce a version your board can approve and you can hand to an investor or regulator.

Related reading: our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business? | in this series: ↗ Duties of Licensed Service Providers under the Online Safety Act 2025 | ↗ What “Harmful Content” and “Priority Harmful Content” mean under the Online Safety Act 2025 | ↗ Reporting and Takedown of Harmful Content under Malaysia’s Online Safety Act 2025 | ↗ Risk Mitigation Code and Child Protection Code.

Related resources (downloads): ↗ ONSA Applicability Self-Assessment.