Navigating the New Era: A Guide to Setting Up Data Centres in Malaysia
Introduction
Malaysia is rapidly emerging as a premier data centre hub in the Asia Pacific region, driven by strategic government policies and a surge in global investment totaling RM144 billion between 2021 and mid 2025.1 As of 2025, Malaysia hosts 125 operational data centres, primarily concentrated in Kuala Lumpur and Johor with further developments currently under construction.2 The country’s strategic location, stable infrastructure, and proactive government support continue to strengthen its position as a preferred destination for global data centre investments.3
However, beneath this opportunity lies a complex and multi-layered legal and regulatory framework. Accordingly, this article outlines the key legal considerations and regulatory requirements involved in establishing data centres in Malaysia.
What is a Data Centre
A data centre is a dedicated facility that stores, manages, processes, and distributes data, serving as the central hub for an organisation’s Information and Communication Technology (“ICT”) operations.4 Data centres can be broadly categorised into the following:
i. By power capacity
ii. By operational model
Regulatory Approval Requirements
The Malaysian Investment Development Authority has been designated as the single approval authority and the sole focal point for evaluating and sanctioning new data centre projects and expansions.8 Strategic oversight is provided by the Data Centre Task Force (“DCTF”), established in February 2025 and co-chaired by the Ministry of Investment, Trade and Industry (“MITI”) and the Ministry of Digital. The DCTF adopts a whole-of-value-chain approach to ensure that the growth of the data centre industry is aligned with national priorities, including the strengthening of local supply chain participation, the integration of renewable energy sources, and the advancement of Malaysia’s domestic artificial intelligence (“AI”) ecosystem. The Ministry of Housing and Local Government has also issued a Planning Guideline for Data Centres (“Planning Guideline”), which outlines planning and development requirements.
A. Land and Location Approvals
State Authority
Securing suitable land is often the primary legal hurdle in the data centre development. Under the National Land Code (“NLC”), data centres must be developed on land designated for “Building” or “Industrial” use. Where the proposed use does not align with existing title conditions, developers must first obtain land conversion approval under Section 124 of the NLC.9
Additionally, the Planning Guideline further emphasises the importance of site suitability, particularly access to the key infrastructure, stable electricity, and water supply as well as adequate setback and buffer zones to minimise the environmental impacts on surrounding areas.
B. Electricity and Water Requirements
Given the scale of utility demand, early engagement with utility providers is critical for project feasibility.
Electricity Supply Requirements (Tenaga Nasional Berhad (“TNB”))
Data centres must secure electricity supply from TNB to ensure reliable access to high-capacity power from the national grid. To prevent underutilisation and stranded assets, MITI requires data centres to utilise at least eighty-five percent (85%) of their declared electricity demand during the first four (4) years of operation, failing which a monthly penalty of RM8.50 per kilowatt of shortfall will be imposed through the electricity bill.10
Developers are encouraged to locate facilities near existing high-voltage transmission lines or Main Distribution Substations (“SSUs”) to minimise infrastructure costs. Data centres must also be equipped with backup systems, including Uninterruptible Power Supply (“UPS”) systems and backup generators, to ensure operational resilience.
Water Supply Requirements (SPAN/State Water Authority)
Developers must also secure approval from the relevant state water supplier and the National Water Services Commission (“SPAN”) to ensure continuous and sufficient water supply for cooling. SPAN advises early evaluation of water sufficiency and increasingly requires water efficiency measures aligned with Water Usage Effectiveness (“WUE”) standards.
Sustainable Data Centres
To promote sustainable data centre development, MITI has introduced the Guideline for Sustainable Development of Data Centre (“Sustainable Development Guideline”), which emphasises renewable energy integration and resource efficiency based on the category and size of the facility.11
The Guideline requires compliance with minimum Power Usage Effectiveness, Carbon Usage Effectiveness and WUE standards.12 Further, all new data centres in Peninsular Malaysia, irrespective of category, must be located with a water stress index below 0.8, reinforcing the Government’s commitment to responsible water resource management.
C. Operational and Safety Approvals
Local Authority (“LA”) Approvals
Data centre developments require planning permission and construction approval from the relevant LA. Applications are submitted through the One-Stop Centre 3.0 Plus system, with the approval process varying according to the project’s scale, location and nature.
Department of Occupational Safety and Health (“DOSH”)
DOSH requires the registration of certain machinery used within the data centre. A Certificate of Fitness is specifically mandated for high-risk equipment integral to operations, such as lifts and escalators ensuring they are safe for use.
Malaysian Communications and Multimedia Commission (“MCMC”) Licensing
Generally, operating a data centre does not, in itself, require an MCMC licence. However, operators providing licensable services under the Communications and Multimedia Act 1998 (“CMA”) must first obtain the relevant licences, as operating without a valid licence constitutes an offence under the CMA.13
Data Protection Compliance
Data centre operators processing personal data as defined under the Personal Data Protection Act 2010 (“PDPA”) must comply with the PDPA principles and are required to register with the Personal Data Protection Commissioner.
Agreements involved in setting up a Data Centre
Throughout the development of setting up a data centre, from the initial land acquisition to the operational phases — an intricate stack of agreements governs the project. Thus, a clear understanding of this contractual framework is essential for effective risk management and long-term operational stability.
Conclusion
As Malaysia strengthens its position as a regional data centre hub, developers should prioritise compliance with regulatory requirements and establish robust contractual frameworks to mitigate risks and ensure sustainable, long-term operations. Early legal and regulatory planning will be key to the successful execution of data centre projects.
1. InvestKL, ‘Malaysia’s Tech Sector Rides AI, Data Centre Wave This Year and into 2026’ (9 December 2025) https://www.investkl.gov.my/insights/content-library/relevant-news/malaysias-tech-sector-rides-ai-data-centre-wave-this-year-and-into-2026 accessed 9 June 2026.
2. Data Center Asia, ‘How Many Data Centers Are There in Malaysia?’ https://www.datacenter-asia.com/blog/how-many-data-centers-are-there-in-malaysia/ accessed 9 June 2026.
3. Jabatan Perancangan Bandar dan Desa (PLANMalaysia), ‘Planning Guideline for Data Centre (GPP Pusat Data)’ (8 October 2024) https://jpbd.penang.gov.my/images/faris/pdf/2025/GARIS%20PANDUAN/GPP%20PUSAT%20DATA%20-%20ENG.pdf accessed 9 June 2026.
4. Malaysian Rating Corporation Berhad (MARC), ‘Data Centers’ (February 2025) https://www.marc.com.my/wp-content/uploads/2025/02/Data-Centers-202502.pdf accessed 9 June 2026.
5. Telecommunications Industry Association (TIA), ‘Bank Negara Malaysia, Data Centre Cyberjaya (DCC)’ https://tiaonline.org/942-datacenter/bank-negara-malaysia-data-centre-cyberjaya-dcc/ accessed 9 June 2026.
6. my, ‘AIMS Cyberjaya Data Centre Facility Begins Construction’ (11 August 2020) https://www.edgeprop.my/content/1706485/aims-cyberjaya-data-centre-facility-begins-construction accessed 9 June 2026.
7. Data Center Dynamics, ‘Google to Invest $2bn in Malaysia for Cloud Region’ (30 May 2024) https://www.datacenterdynamics.com/en/news/google-to-invest-2bn-in-malaysia-for-cloud-region/ accessed 9 June 2026.
8. Business Today, ‘MIDA Appointed Lead Agency for All Data Centre Project Approval’ (22 July 2025) https://www.businesstoday.com.my/2025/07/22/mida-appointed-lead-agency-for-all-data-centre-project-approval/ accessed 9 June 2026.
9. (n 3).
10. Ibid.
11. Malaysian Investment Development Authority (MIDA), ‘Guideline for Sustainable Development of Data Centre’ (December 2024) https://www.mida.gov.my/wp-content/uploads/2024/12/Guideline-for-Sustainable-Development-of-Data-Centre.pdf accessed 9 June 2026.
12. Ibid.
13. Section 126 of the Communications and Multimedia Act (CMA) 1998; and Ministry of Communications Malaysia, ‘Light Touch Regulation on Cloud Services to Enhance Data Protection – MCMC’ https://www.komunikasi.gov.my/en/public/news/20492-light-touch-regulation-on-cloud-services-to-enhance-data-protection-mcmc-2 accessed 9 June 2026.
14. Malaysian Communications and Multimedia Commission Licensing Guidebook.
Written by:
M Inamul Hassan Shah (Partner) hassanshah@azmilaw.com
Lavannya A/P Vesunathan & Nur Qistina Zainal Ariffin general@azmilaw.com
Corporate Communications, Azmi & Associates – 19 August 2026
