Highly classified government data barred from cloud storage
Government AI contracts also prohibit providers from training models with government or public data, Digital Minister Gobind Singh Deo said.
Malaysia does not permit highly classified public-sector data to be held in cloud environments, Digital Minister Gobind Singh Deo said in a written parliamentary reply on Oct 20. Other government information faces storage restrictions based on its sensitivity.
Gobind said existing security directives limit confidential and restricted information to private or hybrid clouds located domestically. Overseas cloud storage is permitted only for data that is open and non-sensitive.
He was answering Ahmad Fadhli Shaari (PN-Pasir Mas), who asked about Malaysian control over public and personal data handled by foreign cloud and artificial intelligence (AI) providers.
Vendors serving the government must pass security screening, Gobind said. Their access to government systems is role-based, requires multi-factor authentication and must be logged for auditing. The National Cryptography Policy requires encryption of government data during storage and transmission.
For classified data and systems, the government retains ownership and control of encryption keys. Gobind said this prevents foreign providers from accessing the contents independently, including when foreign authorities request access.
Government AI contracts bar providers from training their models on government or public data and require deletion once processing is complete, he added. The Public Sector AI Adoption Guidelines (GPAISA) require agencies to minimise data use and conceal or anonymise information before AI processing.
Gobind said the ministry is drafting an AI Governance Bill covering provider accountability across the AI system life cycle, with provisions addressing data quality, transparency and explainability.
