KUALA LUMPUR: The government is examining two Acts as it moves to establish a national data commission with powers to enforce rules governing personal data, artificial intelligence and other sensitive information.
Digital Minister Gobind Singh Deo said work was already under way to incorporate a new body with the authority to advise the government on data-related measures.
“We are looking at legislation. So we are looking at two different Acts.
“We are already looking at incorporating a new body that has the powers and the authority to advise the government on data and measures around it moving ahead,” he said.
Gobind said this to The Star when met after his keynote address at the CloudTech & DataCentre Conference 2026 here on Thursday (Aug 13).
However, the Damansara MP said the proposed commission was still at the planning stage and did not specify which Acts were being examined or when the body would be established.
He said the commission should not merely formulate rules but must also possess the authority to enforce them.
“It’s not just about thinking about how things are done, but it’s also about thinking about building structures to ensure that, if rules and regulations are created so that the space that we live in is safe, then there is that organisation that has the power to enforce those rules and regulations,” he said.
Gobind said data needed to be managed according to its sensitivity, as different types of information required different levels of protection.
He cited the difference between data on the quantity of medication purchased by a hospital and patients’ medical records, which would require significantly stronger safeguards.
“We would want to start looking at ensuring that the levels of security, in terms of how the data is digitalised and how it’s stored and even shared, is properly looked into,” he said.
Gobind said the commission should bring together specialists in data protection, governance, enforcement and laboratory work.
It would require experts capable of analysing products, investigating complaints and providing expert evidence in court when necessary, he added.
“A well-rounded commission with experts from all of the relevant fields,” he said.
Gobind said Malaysia already had laws covering different layers of data protection and security, including the Cyber Security Act 2024 and the Personal Data Protection Act, which was strengthened in 2025.
However, he said data should be viewed from two broad perspectives - personal data and all other forms of data - with some information also involving national security considerations.
He said personal data used in connection with AI would also have to be managed.
“There are many different areas that need to be dealt with. And ultimately, it comes back to personal data being used when it comes to AI. I think that also has to be managed,” he said.
Gobind said he had consistently advocated for a data commission because of the wide range of data and the varying levels of security required.
“The experts will then decide on how much of it has to be digitalised in a particular way,” he said, adding that the National Security Council could provide input on information involving national security.
