Who to check with

This site drafts. It does not decide. Where a workflow touches a rule, an authority decides that rule, and this is the list of them.

Links go to each authority’s homepage, and every entry also names the document to open once you are there. That split is deliberate: government portals reorganise constantly — of eighteen deep links tested for this page, twelve were already dead — but the name of a document survives a rebuild and a version bump, so it is the more reliable instruction of the two.

LHDN

Name: Lembaga Hasil Dalam Negeri (Inland Revenue Board)
Website: www.hasil.gov.my
Description: Malaysia's tax authority. It collects income tax and runs MyInvois, the national e-Invoice system.
Why it matters: e-Invoice arrived in phases set by turnover. LHDN's published timeline puts Phase 4 at businesses up to RM5 million from 1 January 2026, and exempts those under RM1,000,000 a year. Check which phase you are in before you change how you invoice. Read from LHDN in August 2026; confirm it is still current.
What to open: the e-Invoice implementation timeline
Relevant to: Accounting Admin & e-Invoice Readiness, E-commerce Operations, Finance & Cash Flow, Retail & POS

RMCD

Name: Royal Malaysian Customs Department (MySST)
Website: mysst.customs.gov.my
Description: Collects Sales and Service Tax, and handles duties on goods entering or leaving Malaysia.
Why it matters: Cross the registration threshold and you must charge SST and file returns on time. Whether a service is taxable or exempt is decided here, and getting it wrong is expensive to unwind later.
What to open: the SST registration threshold and taxable services list — search that on their site; the URL moves, the document does not.
Relevant to: Accounting Admin & e-Invoice Readiness, E-commerce Operations, Export & Cross-Border Growth, Finance & Cash Flow, Logistics & Delivery, Pricing & Profitability, Procurement & Supplier Management, Retail & POS

EPF

Name: Employees Provident Fund (KWSP)
Website: www.kwsp.gov.my
Description: The national retirement fund. Employers deduct from wages and contribute on top, every month.
Why it matters: Contributions are compulsory for employees, and the rates are reviewed. Calling someone a contractor does not remove the duty if the working relationship says otherwise.
What to open: the employer contribution rate schedule — search that on their site; the URL moves, the document does not.
Relevant to: HR & People Operations

SOCSO

Name: Social Security Organisation (PERKESO)
Website: www.perkeso.gov.my
Description: Provides employment injury and invalidity cover for workers in Malaysia.
Why it matters: Registration starts with your first employee, foreign workers included. Workplace accidents carry reporting deadlines that are easy to miss.
What to open: employer registration and the accident reporting deadline — search that on their site; the URL moves, the document does not.
Relevant to: HR & People Operations, Recruitment & Hiring

HRD Corp

Name: Human Resource Development Corporation
Website: hrdcorp.gov.my
Description: Runs the training levy and the grant scheme you claim back from it.
Why it matters: If you are registered you pay the levy whether or not you use it. Unclaimed balance does not sit there forever, so check what you have before year end.
What to open: the levy schedule and claimable course list — search that on their site; the URL moves, the document does not.
Relevant to: Training & Employee Upskilling

JTKSM

Name: Department of Labour Peninsular Malaysia
Website: jtksm.mohr.gov.my
Description: Enforces the Employment Act and handles labour disputes.
Why it matters: Working hours, leave, notice periods and termination are set by law. A clause in your contract does not override them.
What to open: the Employment Act and its current amendments — search that on their site; the URL moves, the document does not.
Relevant to: HR & People Operations, Recruitment & Hiring

JPDP

Name: Personal Data Protection Department
Website: www.pdp.gov.my
Description: Enforces the Personal Data Protection Act 2010, which covers how businesses handle personal information.
Why it matters: Pasting customer or staff records into an AI tool is a transfer of personal data. Consent, notice, retention and cross-border rules still apply when the tool is not yours.
What to open: the Personal Data Protection Act 2010
Relevant to: Accounting Admin & e-Invoice Readiness, Compliance, Policies & Documentation, CRM & Pipeline Management, Customer Retention & Loyalty, Customer Service & Help Desk, Data Analysis & Reporting, E-commerce Operations, Education & Training Centres, Finance & Cash Flow, Healthcare & Clinics, HR & People Operations, IT Help Desk & Cyber Hygiene, Professional Services, Real Estate & Property Services, Recruitment & Hiring, Retail & POS, Sales & Lead Generation, Training & Employee Upskilling, WhatsApp & Conversational Commerce

SSM

Name: Companies Commission of Malaysia
Website: www.ssm.com.my
Description: Registers businesses and companies, and holds the statutory filings behind them.
Why it matters: Annual returns, director changes and business detail updates all have deadlines. Late filing carries penalties, and the compound lands on the company.
What to open: the annual return filing deadline for your entity type — search that on their site; the URL moves, the document does not.
Relevant to: Compliance, Policies & Documentation, Proposals, Quotations & Tenders

MCMC

Name: Malaysian Communications and Multimedia Commission
Website: www.mcmc.gov.my
Description: Regulates communications, network services and online content in Malaysia.
Why it matters: Bulk and unsolicited commercial messaging is regulated. WhatsApp's own business policy applies on top, and it is the one that gets your number blocked.
What to open: the general consumer code on unsolicited commercial messaging — search that on their site; the URL moves, the document does not.
Relevant to: WhatsApp & Conversational Commerce

MATRADE

Name: Malaysia External Trade Development Corporation
Website: www.matrade.gov.my
Description: The national export promotion agency, sitting under the trade ministry.
Why it matters: Destination market requirements, buyer verification and export grants run through here. Worth checking before you quote an overseas buyer.
What to open: the exporter directory and market reports — search that on their site; the URL moves, the document does not.
Relevant to: Export & Cross-Border Growth

JAKIM

Name: Halal Malaysia (JAKIM)
Website: www.halal.gov.my
Description: Runs halal certification and the register of certified premises and products.
Why it matters: Halal status depends on the whole supply chain, not just the recipe. Changing a supplier can affect it, and logo use is controlled.
What to open: the Malaysian halal certification procedure manual — search that on their site; the URL moves, the document does not.
Relevant to: Export & Cross-Border Growth, F&B Operations, Manufacturing & Quality

CIDB

Name: Construction Industry Development Board Malaysia
Website: www.cidb.gov.my
Description: Registers contractors and construction personnel, and sets the grades that decide which jobs you may take.
Why it matters: Your registration grade caps the project value you can tender for, and it has to be current when you bid rather than when you finish. Site personnel carry their own cards.
What to open: the contractor registration grades and their project value limits — search that on their site; the URL moves, the document does not.
Relevant to: Construction & Project Delivery, Proposals, Quotations & Tenders

DOSH

Name: Department of Occupational Safety and Health (JKKP)
Website: dosh.gov.my
Description: Enforces occupational safety and health law across workplaces, plant and machinery.
Why it matters: Workplace incidents carry reporting duties with deadlines, and some plant needs a certificate of fitness before it runs. A safety document generated by AI is a draft for your safety officer, never the record itself.
What to open: the accident reporting requirement and the plant needing a certificate of fitness — search that on their site; the URL moves, the document does not.
Relevant to: Automotive, Workshops & Field Service, Construction & Project Delivery, Manufacturing & Quality

SIRIM

Name: SIRIM Berhad
Website: www.sirim.my
Description: Malaysia's national standards and industrial research body, and a certification and testing house.
Why it matters: Some products need certification or a registered mark before they may be sold here. Whether yours does is decided by product category, so check before you print the packaging.
What to open: which product categories require certification before sale — search that on their site; the URL moves, the document does not.
Relevant to: Manufacturing & Quality

JPJ

Name: Road Transport Department (Jabatan Pengangkutan Jalan)
Website: www.jpj.gov.my
Description: Registers and licenses vehicles and drivers, and sets the rules for commercial vehicle use.
Why it matters: Using a vehicle commercially is not the same registration as using it privately, and inspection duties differ. Get the class wrong and your insurance follows the registration, not your intention.
What to open: commercial vehicle registration classes — search that on their site; the URL moves, the document does not.
Relevant to: Automotive, Workshops & Field Service, Logistics & Delivery

APAD

Name: Land Public Transport Agency
Website: www.apad.gov.my
Description: Licenses commercial land transport operators — goods vehicles, buses and hired vehicles — in Peninsular Malaysia.
Why it matters: Carrying goods or passengers for payment needs an operator licence, and it is tied to specific vehicles and routes. Sabah and Sarawak have their own bodies.
What to open: operator licence classes for goods and passenger vehicles — search that on their site; the URL moves, the document does not.
Relevant to: Logistics & Delivery

NACSA

Name: National Cyber Security Agency
Website: www.nacsa.gov.my
Description: The national authority on cyber security, and the body behind Malaysia's critical sector obligations.
Why it matters: Incident handling and reporting expectations are set nationally, not by your IT vendor. Worth knowing who you would have to tell, and how quickly, before the day you need to.
What to open: the national incident reporting requirements — search that on their site; the URL moves, the document does not.
Relevant to: IT Help Desk & Cyber Hygiene

CyberSecurity Malaysia

Name: CyberSecurity Malaysia
Website: www.cybersecurity.my
Description: The national technical agency for cyber security, running Cyber999 for incident reporting and response.
Why it matters: This is where a Malaysian business actually reports an incident and gets help. If customer data is involved, JPDP matters too, and the two are separate reports.
What to open: Cyber999, the incident reporting channel — search that on their site; the URL moves, the document does not.
Relevant to: IT Help Desk & Cyber Hygiene

KPDN

Name: Ministry of Domestic Trade and Cost of Living
Website: www.kpdn.gov.my
Description: Oversees trade practices, price display and controlled goods, and enforces consumer protection law.
Why it matters: How you display a price, run a discount and word a promotion is regulated, and a claim about savings has to be true. AI writes persuasive promotional copy very easily — this is the body that decides whether it was misleading.
What to open: the price display and promotional claim rules — search that on their site; the URL moves, the document does not.
Relevant to: Digital Advertising, Inventory & Stock Management, Pricing & Profitability, Retail & POS

Pointing is not verifying

Naming an authority means they decide, not that anyone has checked your situation against them. Nothing on this site is marked verified, and that is deliberate — it could only ever have been true of a handful of pages, and a badge on a handful reads as a promise about all of them.

So the instruction is the same on every page and it is the one that matters: confirm the current requirements with the authority before you act on anything a prompt produced. Phases move, thresholds move, rates are reviewed. The workflow logic does not go stale; the numbers around it do.

Nothing on this site states a rate or a deadline as fact. See the disclaimer.