KUALA LUMPUR (Oct 20): Digital Minister Gobind Singh Deo said highly classified public-sector data is prohibited from being stored in cloud environments, which allow data to be kept and accessed over the internet.

Under existing security directives, confidential and restricted government information may only be stored in domestic private or hybrid cloud environments, while only open and non-sensitive data may be stored in overseas cloud environments.

The restrictions are intended to safeguard public-sector data processed by cloud service providers and artificial intelligence (AI) technology providers, including foreign companies, he said in a written parliamentary reply on Tuesday.

He was responding to Ahmad Fadhli Shaari (PN-Pasir Mas), who asked how the government ensures that public and personal data processed by foreign cloud and AI providers remain under Malaysian control.

Gobind said vendors appointed to provide services to the government must undergo security screening. Access to government systems is granted according to their roles, requires multi-factor authentication and is recorded for audit purposes.

Government data must be encrypted both at rest and in transit, in accordance with the National Cryptography Policy, he added.

For classified systems and data, encryption keys are owned and controlled by the government to prevent foreign service providers from independently accessing the contents, including in response to requests from foreign authorities.

Gobind added that government AI procurement contracts prohibit providers from using government or public data to train their AI models and require them to delete the data after processing.

The Public Sector AI Adoption Guidelines (GPAISA) also require government agencies to minimise the amount of data used and conceal or anonymise data before processing it through AI systems.

To strengthen the regulatory framework, Gobind said the ministry is drafting an AI Governance Bill to ensure technology providers are accountable throughout the AI system life cycle, including in areas such as data quality, transparency and explainability.

For more Parliament stories, click here.