Malaysia’s government bars AI service providers from using government or public data to train their models under a clause in all its AI procurement contracts, digital minister Gobind Singh Deo said in a written parliamentary reply on 20 October 2026, Free Malaysia Today reported. Providers are also barred from retaining Malaysians’ data after processing, he said. The reply addressed a question from Ahmad Fadhli Shaari, the MP for Pasir Mas, about Malaysian control of data handled by cloud and AI firms.
Key points
- Government AI contracts prohibit providers from using government or public data for model training and require deletion after processing.
- Public agencies must minimise, conceal or anonymise data before using AI systems under the Public Sector AI Adoption Guidelines.
- Government rules assign different cloud-storage locations to open, restricted and highly classified data.
- The digital ministry is drafting an AI Governance Bill addressing accountability across the AI system life cycle.
AI procurement contracts restrict training and retention
The training prohibition operates through the government’s contracts with AI providers. Gobind described the restriction as a clause in every government AI procurement contract, rather than as a provision of the bill his ministry is drafting. He also said providers cannot store Malaysians’ data once they have processed it. Both conditions apply to the provider’s handling of data obtained through government AI work: one limits its use for training, and the other limits its retention after the contracted processing.
The contracts require providers to delete data after processing and prohibit the use of government or public data to train models, The Edge Malaysia reported from the same parliamentary reply. The deletion requirement concerns what happens to data after a provider has used it to perform the service. The training clause concerns a separate use that could otherwise follow from a provider having access to that data.
Gobind gave the reply to Ahmad Fadhli’s question about data processed by foreign cloud and AI providers. The minister also set out conditions on where government data can be stored and who can access it. Those conditions govern the data handled by public bodies and their vendors alongside the procurement terms imposed on AI providers.
GPAISA places duties on government agencies
The Public Sector AI Adoption Guidelines, known as GPAISA, require government agencies to reduce the amount of data used and to conceal or anonymise it before processing it with AI systems. That duty falls on the public body preparing the data, while the procurement conditions govern what its chosen provider may do with it. An agency therefore has obligations before data enters an AI system, as well as contractual restrictions to impose on the firm providing the service.
Gobind said vendors appointed to serve the government must undergo security screening. Access to government systems is assigned by role, protected by multi-factor authentication and logged for audit, The Edge Malaysia reported. These controls concern the people and firms allowed into government systems. They sit alongside the rules on preparing data for AI processing and the contractual requirements governing its use afterwards.
Government data must also be encrypted while stored and while being transferred, in accordance with the National Cryptography Policy. For classified systems and data, the government owns and controls the encryption keys. Gobind said that arrangement is intended to prevent foreign service providers from accessing the contents on their own, including when faced with a request from another country’s authorities.
Malaysia assigns cloud locations by data classification
The government’s cloud rules distinguish among data classifications. Gobind said secret and top-secret government data may be stored only in government data centres. Confidential and restricted information may be held only in private or hybrid cloud environments based in Malaysia. Foreign-based clouds are limited to open, non-sensitive data. Each category determines which storage environment a public body can use when it engages a cloud provider.
The storage conditions accompany a broader government interest in domestic AI infrastructure. In its Budget 2027 announcement, Malaysia set out plans for a sovereign AI cloud, as AI Affairs reported. Gobind’s parliamentary reply dealt with the handling of government data by existing cloud and AI providers, including foreign firms: where different classes of data may reside, how access is controlled and what providers may do with data used in government AI work.
Section 129 governs private-sector transfers
Gobind separately addressed personal data transferred abroad by private-sector organisations. Section 129 of the Personal Data Protection Act, as amended in 2024, regulates those cross-border transfers. Among its requirements, data subjects must consent and the receiving jurisdiction must have a law comparable to Malaysia’s Act. That provision concerns private-sector transfers, whereas the cloud classifications and AI procurement clauses in his reply concern government data and government contracts.
The digital ministry is drafting an AI Governance Bill intended to make technology providers accountable across the AI system life cycle, Gobind said. He identified data quality, transparency and explainability among the areas it would address. For now, the training and deletion conditions he described are terms of government procurement contracts, and agencies’ preparations for AI processing are governed by GPAISA.
.jpg){kind=link}