This note forms part of our series on Malaysia’s Online Safety Act 2025. It accompanies our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business?, and sets out the procedure that applies once harmful content is reported.

This is the part that tends to matter in practice. A fraudulent advertisement appears on a Friday evening; by Monday the questions are who assessed the report, what standard they applied, and how quickly the content came down. The Online Safety Act 2025 (“ONSA”) answers those questions for licensed providers with prescribed timelines, mandatory acknowledgements and review rights. Unlicensed businesses are not bound by the procedure, but it is likely to become the reference point against which platform partners, investors and regulators judge whether a takedown process is adequate.

Part IV of the ONSA, read with the Online Safety (Period) Regulations 2025 (“Period Regulations”), which set the deadlines, provides for the reporting of harmful content. It sets out how users can report harmful online content, what licensed applications service providers (“Licensed ASPs”) or licensed content applications service providers (“Licensed CASPs”) must do with those reports, and the role of the Malaysian Communications and Multimedia Commission (“MCMC”).

Part A: Reporting Harmful Content to Licensed ASPs and Licensed CASPs

A user may report any content that the user believes to be harmful, and which is available on the service of a Licensed ASP or Licensed CASP. Upon receiving the report, the Licensed ASP or Licensed CASP must acknowledge it within one hour of receiving it through its official reporting channel, then assess the report and notify the user in writing of its status within 12 hours of that acknowledgement (ONSA section 21(2); Period Regulations 2025, Schedule items 2–3).

1. Dismissal of a Report
   
   • A report will be dismissed if the Licensed ASP or Licensed CASP considers it to be frivolous, vexatious, not made in good faith or trivial, or if the subject matter is or has already been the subject of another report made to the provider.
   • If the report is dismissed, the user must be notified in writing. The user has 15 days from receiving that notice to inquire into the dismissal, giving reasons why the report should not have been dismissed.
   • The Licensed ASP or Licensed CASP may then review its decision and determine whether the dismissal should be maintained or further action taken. It must notify the outcome in writing within seven days of receiving the inquiry (ONSA section 21(4)–(7); Period Regulations, Schedule items 4–5).
     
2. Where the Report Concerns Priority Harmful Content
   
   • If the Licensed ASP or Licensed CASP considers the reported material to be priority harmful content, it must immediately make the content inaccessible to all users for 24 hours while it determines whether the content falls within that category.
   • If the content is confirmed to be priority harmful content, it must be made permanently inaccessible within one hour of that determination. If it is found not to be priority harmful content, the provider may make it accessible again, within one hour.
   • Both the user who made the report and the user who posted the content must be informed of the action taken. An aggrieved user may inquire into the action within 15 days of being notified of it; the provider must notify its decision within five days (ONSA section 22(5)–(7); Period Regulations, Schedule items 8–9).
   • Missing the one-hour deadline to make confirmed priority harmful content permanently inaccessible is an offence carrying a fine of up to RM1 million (Period Regulations, regulation 3).
     
3. Where the Report Concerns Harmful Content
   
   • Once it decides not to dismiss the report, a provider that considers the content harmful may make it inaccessible to all users; if it does, it must do so within four hours, for 24 hours, while it completes its assessment.
   • If the content is determined to be harmful, it must be made permanently inaccessible within 12 hours of the determination. If it is determined not to be harmful, access to the content must be restored within four hours.
   • An aggrieved user may inquire into the action within 15 days of being notified of it; the provider must notify its decision within seven days (ONSA section 23(5)–(7); Period Regulations, Schedule items 14–15).
   • If the provider decides content is harmful but does not make it inaccessible, MCMC may, in the public interest, instruct it in writing to make the content permanently inaccessible within a specified period. Failure to comply with such an instruction is an offence punishable by a fine of up to RM1 million, with a further fine of up to RM100,000 for every day or part of a day the offence continues after conviction.
   • Missing the 12-hour deadline to make confirmed harmful content permanently inaccessible is an offence carrying a fine of up to RM1 million (Period Regulations, regulation 3).

Part B: Reporting Harmful Content Directly to MCMC

A user may also report suspected harmful content directly to MCMC, even if they have already reported the same content to the Licensed ASP or Licensed CASP. A report may also relate to harmful content available elsewhere online and not only content hosted on the service of a Licensed ASP or Licensed CASP. MCMC must acknowledge a report within one hour of receiving it through its official channel, then assess it and notify the user of its status within 24 hours (ONSA section 24(2); Period Regulations, Schedule items 16–17).

1. Dismissal of a Report
   
   MCMC will dismiss a report if it considers the report to be frivolous, vexatious, not made in good faith or trivial, or if the same subject matter is or has already been the subject of another report to MCMC. A user who is dissatisfied with the dismissal may inquire into the dismissal within 15 days, giving reasons; MCMC must notify its decision within seven days (ONSA section 24(5)–(7); Period Regulations, Schedule items 18–19).
   
2. Make the Content Inaccessible
   
   If MCMC determines on reasonable grounds that the reported content is harmful content, including priority harmful content, it must issue a written instruction requiring the relevant Licensed ASP or Licensed CASP to make the content permanently inaccessible. Where the content is hosted elsewhere online, MCMC must instead instruct the relevant licensed network service provider to restrict the relevant part of its network so that the content becomes inaccessible. Failure to comply with MCMC’s written instruction is an offence punishable by a fine of up to RM1 million, with a further fine of up to RM100,000 for every day or part of a day the offence continues after conviction. If MCMC determines that the content is not harmful, it must notify the user who made the report.

Part C: Other Powers Relating to Harmful Content

1. Licensed ASPs and Licensed CASPs May Act Without a Report
   
   If a Licensed ASP or Licensed CASP has reasonable grounds to believe that content is priority harmful content, it may make that content inaccessible on its own initiative. The person who posted the content must be notified, and an aggrieved user may inquire into the action within 15 days; the provider must notify its decision within five days (ONSA section 26(2)–(5); Period Regulations, Schedule items 20–21).
   
2. MCMC May Order Content to be Restored
   
   If a Licensed ASP or Licensed CASP has made content inaccessible, MCMC may, for public interest, issue a written instruction requiring the provider to make the content accessible again.
   
3. MCMC’s Decision Prevails Where There is a Conflict
   
   The same content may be reported to both a Licensed ASP or Licensed CASP and MCMC. If there is an inconsistency between the action taken by the provider and MCMC’s written instruction or determination, MCMC’s decision will prevail.
   
4. Reports to Enforcement Agencies
   
   Where a licensed provider reports content to an enforcement agency in connection with a user’s report, it must not disclose anything about that report to the user who made it (ONSA section 29). The Risk Mitigation Code also requires clear internal procedures for such reports (para 4.2.5(e)).

Part D: Appeals

A person aggrieved by certain MCMC decisions may appeal to the Online Safety Appeal Tribunal. These are: written instructions to take content down or restore it (ONSA sections 23(8), 25(1) and 27); a determination that reported content is not harmful (ONSA section 25(5)); directions (ONSA section 30); and decisions on review of a notice of non-compliance (ONSA section 38). The Tribunal’s decisions are final and binding (ONSA section 46(2)). Judicial review is available only once the remedies under the ONSA are exhausted (ONSA section 70(2)).

Next step

A useful test is whether your team could explain, without preparation, what happens when harmful content is reported, who makes the decision, and how long it takes. If the answer is a pause, that is the work to be done. We help businesses document a harmful content escalation and takedown process that is proportionate to their size and defensible to a platform partner or regulator. Our ↗ Harmful Content Escalation & Takedown Playbook is a good starting point.

Related reading: our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business? | in this series: ↗ Duties of Licensed Service Providers under the Online Safety Act 2025 | ↗ What “Harmful Content” and “Priority Harmful Content” mean under the Online Safety Act 2025 | ↗ Risk Mitigation Code and Child Protection Code.

Free resources (downloads): ↗ ONSA Applicability Self-Assessment | ↗ Harmful Content Escalation & Takedown Playbook.