Gobind: Classified Public-Sector Data Not Allowed In Overseas Cloud Environments

Digital Minister Gobind Singh Deo has clarified that highly classified public-sector data is prohibited from being stored in cloud environments located overseas. Responding to inquiries about how the Malaysian government ensures control over public and personal data processed by foreign cloud and AI providers, Deo emphasized that confidential and restricted government data should only be stored in domestic private or hybrid cloud environments. Open and non-sensitive data may be stored in overseas cloud environments.

To further protect government data, all information must be encrypted both at rest and during transmission, according to the National Cryptography Policy. The encryption keys are owned and controlled by the government, preventing foreign service providers from accessing the data independently, even if foreign authorities request it.

Deo also informed that government AI procurement contracts explicitly prohibit providers from using government or public data for training AI models. These models must delete the data after processing. As part of the government's AI use guidelines in the public sector, agencies are required to minimize, conceal or anonymize data before processing it with AI systems. The ministry is currently drafting an AI governance bill to ensure accountability in the use of AI systems, according to The Edge and FMT.