This note forms part of our series on Malaysia’s Online Safety Act 2025. It accompanies our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business?, and sets out how the ONSA defines the content it regulates.

Whether material is “harmful content” or “priority harmful content” determines how quickly it must be made inaccessible, whether a provider may act on its own initiative, and how much room there is to assess before acting. The categories are also broader than most businesses expect: content on financial fraud sits in the priority tier, which means an ordinary scam advertisement or fake investment listing — the kind that appears on marketplaces, e-wallets and community platforms every week — attracts the strictest treatment under the ONSA when it appears on a licensed service: once the provider considers reported content to be priority harmful content, it must make it inaccessible immediately, and once it determines that the content is priority harmful content, it has one hour to make it permanently inaccessible — missing that deadline is an offence (Online Safety (Period) Regulations 2025, regulation 3).

The First and Second Schedules of the Online Safety Act 2025 (“ONSA”) provide a list of what is defined as “harmful content” and “priority harmful content” (quoted as enacted):

“Harmful content” refers to:

1. Content on child sexual abuse material as provided for under section 4 of the Sexual Offences against Children Act 2017 [Act 792]
   
2. Content on financial fraud
   
   Note: a content that promotes awareness or education relating to financial fraud is not a content on financial fraud
   
3. Obscene content including content that may give rise to a feeling of disgust due to lewd portrayal which may offend a person’s manner on decency and modesty
   
4. Indecent content including content which is profane in nature, improper and against generally accepted behaviour or culture
   
   Note: for the purposes of paragraphs 3 and 4, a content that portrays private parts for education, scientific or medical purposes is not an obscene or indecent content
   
5. Content that may cause harassment, distress, fear or alarm by way of threatening, abusive or insulting words or communication or act
   
6. Content that may incite violence or terrorism
   
7. Content that may induce a child to cause harm to himself
   
8. Content that may promote feelings of ill-will or hostility amongst the public at large or may disturb public tranquillity
   
9. Content that promotes the use or sale of dangerous drugs
   
   Note: a content that promotes awareness or education relating to drug abuse is not a content that promotes the use or sale of dangerous drugs

“Priority harmful content” means the contents referred to in paragraphs 1 and 2 above.

Next step

Businesses should already moderate content against an internal policy written for commercial reasons if not for statutory ones. The useful exercise is mapping that policy against the First and Second Schedules to see where the two diverge, particularly around financial fraud, harassment and content affecting users under 18.

Related reading: our main article, ↗ “We Are Not a Social Media Platform” – But Does Malaysia’s Online Safety Act 2025 Still Apply to Your Business? | in this series: ↗ Duties of Licensed Service Providers under the Online Safety Act 2025 | ↗ Reporting and Takedown of Harmful Content under Malaysia’s Online Safety Act 2025 | ↗ Risk Mitigation Code and Child Protection Code.

Free resources (downloads): ↗ ONSA Applicability Self-Assessment | ↗ Harmful Content Escalation & Takedown Playbook.