perfectdesign.

Websites · Checklist

Website Compliance Checklist for Malaysian Businesses

A Malaysian business website usually has to meet five sets of rules: the SSM rule to show your registered name and number, the Personal Data Protection Act for any form, account or identifiable tracking, the online-selling regulations if you take orders, LHDN e-invoicing if your revenue is above the exemption threshold, and card-payment security if you accept cards. This checklist turns each rule into something you can check on your own site, with the evidence that shows it is done. It explains the rules in plain terms and is not legal advice.

Written forOwners and managers of Malaysian businesses launching or reviewing a website, online shop or customer system, and anyone checking a supplier's work.

On this page7 sections
  1. 01Which rules apply to your website
  2. 02Your registered name and number
  3. 03Personal data: the notice, consent and security
  4. 04Selling online
  5. 05E-invoicing and card payments
  6. 06Cookies and accessibility
  7. 07The checklist

Which rules apply to your website

Start with what the site does, because that decides which rules reach it. A site with no forms and no tracking has little personal data to handle. Add an enquiry form and the Personal Data Protection Act (PDPA) applies. Take orders and the online-selling regulations apply too. Every registered company and business, whatever the site does, must show its registered name and number.

What each kind of site has to check

  • Information only, no forms

    SSM name and number
    Yes
    PDPA notice and consent
    Only if it tracks identifiable visitors
    Online-selling rules
    No
    E-invoicing
    No
    Card security
    No

  • Enquiry or booking forms

    SSM name and number
    Yes
    PDPA notice and consent
    Yes
    Online-selling rules
    No
    E-invoicing
    No
    Card security
    No

  • Online shop or paid bookings

    SSM name and number
    Yes
    PDPA notice and consent
    Yes
    Online-selling rules
    Yes
    E-invoicing
    If revenue is above the threshold
    Card security
    If it accepts cards

  • Customer, member or staff system

    SSM name and number
    Yes
    PDPA notice and consent
    Yes, often with more data
    Online-selling rules
    If it sells
    E-invoicing
    If it issues invoices above the threshold
    Card security
    If it accepts cards
Step-by-step diagram: What the site does decides which rules reach it

What the site does decides which rules reach it

Primary-source guidance. Each step adds its rules to the ones before it; nothing drops away as a site grows.

Source: MAICSA: SSM notice on names and numbers on websites. Reviewed .

Also: JPDP: Frequently asked questions.

Also: HASiL: e-invoice exemption threshold, 30 August 2026.

Read the graphic as text
  • Any business site. Registered name and number on every page
  • Forms or tracking. A PDPA notice in Malay and English
  • Taking orders. Seller details, corrections, order receipts
  • Over RM 3 million. E-invoices through MyInvois
  • Accepting cards. Card numbers kept off your site
Download this infographic (SVG)

Your registered name and number

SSM reminded businesses in November 2023 that section 30(2)(b) of the Companies Act 2016 requires every company to display its name and registration number prominently on its website and social media, with a penalty of up to RM 50,000, three years' imprisonment or both. Businesses registered under the Registration of Businesses Act have had a similar duty since the 2020 amendment to the Business Registration Rules. The simplest way to be prominent is the footer of every page, which is where we put it.

Personal data: the notice, consent and security

JPDP's own guidance counts collecting data through a website form as processing personal data, so most business websites fall under the PDPA. Section 7 requires a written notice that tells people what is collected and why, where it came from, how to ask for access or correction, who it may be shared with, what choices they have, and whether supplying it is obligatory. The notice must be in the national language and in English.

The 2024 amendments, in force since 1 June 2025 for these duties, add two things a website owner needs to plan for. A data protection officer must be appointed and registered if you process data on more than 20,000 people, sensitive data including financial information on more than 10,000, or carry out regular and systematic monitoring, which JPDP's FAQ illustrates with online behaviour tracking. And a personal data breach must be notified to the Commissioner within 72 hours of becoming aware of it, with affected people told as well when the breach is likely to cause them significant harm.

Key figures: Four PDPA numbers a website owner should know

Four PDPA numbers a website owner should know

Primary-source guidance. Regular, systematic monitoring such as behaviour tracking can require a DPO below these numbers.

Source: JPDP: Frequently asked questions. Reviewed .

Also: JPDP: Data breach notification form.

Read the graphic as text
  • Breach notice: 72 hrs. To tell the Commissioner, after becoming aware
  • DPO threshold: 20,000. People whose personal data you process
  • Sensitive data: 10,000. Including financial information
  • Notice languages: 2. The national language and English
Download this infographic (SVG)

Selling online

The Consumer Protection (Electronic Trade Transaction) Regulations 2024 replaced the 2012 regulations from 25 December 2024. An online seller must show who it is and how to reach it, describe what it sells, state the full price including delivery and taxes, the payment methods, the terms and the delivery time. Buyers must be able to correct mistakes in an order, and the seller must acknowledge each order without undue delay, which in practice means an automatic confirmation by email or on screen.

The regulations also require those disclosures in Bahasa Malaysia, with other languages allowed alongside. Enforcement of the language requirement for listings was put on hold for review in June 2025, and we found no announced date for it to resume as of October 2026. Check the current position with KPDN before relying on that, and build the disclosures so a Bahasa Malaysia version can be switched on without redesigning the shop.

E-invoicing and card payments

From 1 September 2026, businesses with annual revenue below RM 3 million are not required to issue e-invoices, according to HASiL's announcement; the conditions in HASiL's FAQ decide whether your business qualifies. Above the threshold, an e-invoice is a structured file submitted to LHDN through the free MyInvois portal or its API, not a PDF. Sales made through an e-commerce platform are invoiced by the platform; your own checkout is your responsibility. More on e-invoicing from your own system.

If you accept cards, using a payment gateway reduces the work but does not remove your responsibility, as the PCI Security Standards Council puts it. The safest design keeps card numbers off your site entirely, with a hosted payment page or the gateway's own payment fields.

Cookies and accessibility

Malaysia has no rule that every website must show a cookie banner. The PDPA still applies where analytics or advertising tags process data that identifies a person, so say in your notice what you track and why. Accessibility to a WCAG level is not a general legal requirement for private businesses; the public-sector portal circular PPPA 1/2025 encourages agencies to follow WCAG, and it is worth doing anyway because it makes the site easier for everyone.

The checklist

Each item names the evidence that shows it is done. We run this list before every website and system we launch.

0 of 14 checked · saved on this device

  • Registered name and registration number shown prominently on the website

    Evidence: The footer of every page, for example "Perfect Design (202403330300 (KT0581891-V))"

  • The same name and number on your social media profiles

    Evidence: Each profile's about section

  • A privacy notice written for your own forms, systems and suppliers

    Evidence: The notice lists each form and system, the purposes and the classes of third parties

  • The notice published in Bahasa Malaysia and English

    Evidence: Both versions live and linked from every form

  • Consent recorded where a purpose needs it, such as marketing

    Evidence: Each record stores the choice, the time and the notice version; no pre-ticked boxes

  • A way to request access to or correction of personal data

    Evidence: A named contact and address in the notice

  • Only the data you need, kept only as long as you need it

    Evidence: A list of fields per form and a deletion schedule

  • A decision on whether you need a data protection officer

    Evidence: A note of your volumes and tracking against the JPDP thresholds; the DPO registered if any apply

  • A breach procedure and a named person

    Evidence: Who assesses a breach, and how the Commissioner is told within 72 hours of becoming aware

  • Online shops: seller details, full prices, payment methods, terms and delivery times

    Evidence: Shown before the order is placed; a Bahasa Malaysia version ready

  • Online shops: buyers can correct an order, and every order is acknowledged

    Evidence: An editable cart and review step, and an automatic confirmation

  • E-invoicing checked against the RM 3 million threshold

    Evidence: Your revenue position recorded; MyInvois set up if you are above it

  • Card numbers never stored or handled by your site

    Evidence: A hosted payment page or the gateway's own payment fields

  • Tracking described in the privacy notice

    Evidence: The analytics and advertising tags listed with their purpose

Does a website without a form need a privacy notice?

If it collects no personal data at all, with no forms, no accounts and no tracking that identifies people, the PDPA notice duty may not be triggered. The SSM display rule still applies. Most business sites have at least an enquiry form or a chat button that collects details, so most need a notice.

Do I need a cookie banner in Malaysia?

There is no Malaysian rule that requires one. If your tags process data that identifies people, the PDPA applies, so describe them in your notice and get consent where a purpose needs it.

Is this legal advice?

No. It explains published rules as they stood on 16 October 2026 and what they usually mean for a website. For a decision about your own business, ask a lawyer or the regulator.

Where to go next

Rather have this handled?

Talk to us about business & corporate websites for your business, starting with the questions this guide helped you identify.

Discuss your project

Sources and further reading