Malaysia officially launches its public sector data policy, 8-years after MyGDX pilot

• PPDSA framework formalizes governance for data sharing with 81 agencies connected
• MyGDX connects 81 govt agencies across 49 integrated systems, processed over 65 million API transactions since May 2018

The Malaysian government yesterday officially launched the Public Sector Data Digitalization Policy (or PPDSA based on its acronym in Malay language) to govern its data-sharing platform MyGDX (Malaysian Government Central Data Exchange) – eight years after the platform’s soft launch in 2018.

Gobind Singh Deo, Digital Minister, officiated and positioned the policy as groundwork for eventually deploying agentic artificial intelligence across public services. MyGDX now connects 81 government agencies across 49 integrated systems, and has processed over 65 million API transactions since May 26, 2018.

“We need a policy that ensures data held by ministries, departments, and agencies can be maintained in digital form,” Gobind said. “Once we’ve designed this policy, we also need to look at processes that allow digitalized data to be stored securely, shared securely, and used for problem-solving with new technology.”

The minister’s emphasis on security and interoperability addresses what the ministry describes as longstanding inconsistencies in how government data has been managed. PPDSA establishes standards for infrastructure, data authenticity and reliability, and long-term system sustainability – targeting risks that have undermined data integrity and critical decision-making.

The framework categorizes data sharing into five tiers: Top Secret, Secret, Confidential, Restricted, and Open. However, FAQ documents distributed at the event mentioned only two categories: Official Secret Data and Official Data. It is not clear which category Official Data falls under with Jabatan Digital Negars (JDN) yet to revert to a request for clarification.

Private sector access, but few details

Gobind said the government is exploring opening MyGDX data to the private sector, though he provided no details on approval processes, pricing models, or timelines.

“We are in discussions with industry about what they need and what needs to be done to facilitate access,” he said, adding that decisions would be guided by the Data Sharing Committee established under the Data Sharing Act 2025 (Act 864), gazetted in April last year.

The ministry’s Public Sector Open Data Portal currently provides 280 datasets and has recorded 28 million visitors since September 2023, though visitor numbers don’t indicate actual utilization for commercial or research purposes.

Agentic AI ambitions vs readiness

Gobind framed PPDSA as creating the foundation for agentic AI deployment, stating the policy’s success “paves the way for utilization of Agentic AI, which will be supported by a workforce of competent and digitally skilled civil servants.”

Yet one of the event’s sessions was titled “Agentic AI: Are we ready?” a topic that suggests uncertainty about Malaysia’s preparedness for autonomous AI systems accessing government data.

The minister did not specify what agentic AI use cases the government is planning, what safeguards would prevent AI agents from accessing data beyond authorized scope, or whether AI-specific governance protocols have been established.

Once-Only Principle, but when?

Gobind emphasized the platform’s role in implementing the “Once-Only Principle” – where citizens would no longer need to repeatedly submit physical documents to different agencies as data would be accessible across the system.

MyGDX currently facilitates sharing of civil servant profiles, higher education student information, passport verification, persons with disabilities status verification, and vehicle registration and licensing information. The platform uses Estonia’s Unified eXchange Platform technology with Public Key Infrastructure security controls. Ministry of Digital has not reverted to DNA’s question on the cost of using the Estonia platform.

No concrete timeline was stated for when citizens would actually experience the Once-Only benefit or which government services would implement it first.

Implementation questions

According to policy documents, agencies must conduct Digital Data Readiness Studies and submit Data Digitalization Action Plans. However, the ministry has not specified deadlines for compliance, enforcement mechanisms, or consequences for agencies that fail to meet requirements.

The event gathered approximately 250 participants, including Secretaries General of ministries, department heads, Chief Digital Officers, and ICT managers, suggesting the government is prioritizing compliance at the leadership level.

Budget allocation also remains unaddressed. In an August 2025 conversation with Digital News Asia, Gobind spoke of plans for a Data Commission but acknowledged it remained in planning stages with no confirmed funding despite Prime Minister Anwar Ibrahim’s recognition in the 13th Malaysia Plan that substantial resources would be required. The minister did not address budget questions when asked yesterday.

MyGDX’s journey from MAMPU’s (Malaysian Administrative Modernisation and Management Planning Unit) soft launch in 2018 with 10 agencies to today’s 81-agency network has taken eight years to receive formal policy governance with MAMPU renamed as Jabatan Digital Negara or in English, National Digital Department, in Dec 2023.  Whether PPDSA proves sufficient to support the government’s AI ambitions while protecting citizen data and ensuring agency compliance will become clear as implementation unfolds.