Public data barred from training AI models in government contracts, says Gobind

Companies that supply artificial intelligence (AI) services to the government may not use government or public data to train their AI models. Digital Minister Gobind Singh Deo said the ban is a clause in all government AI procurement contracts, according to Free Malaysia Today (FMT). Here is what to know about public data and AI model training, and what the reports leave unanswered.

What Gobind said

Gobind gave a written reply in the Dewan Rakyat to Ahmad Fadhli Shaari (PN-Pasir Mas), who asked how the government ensures public data processed by cloud and AI companies stays under Malaysian control.

According to FMT and Lowyat.NET, the reply made three main points:

• AI providers are barred from using government or public data to train their models.
• Providers may not keep the data after processing and must delete it.
• Under the public-sector AI guidelines, every government agency must minimise, conceal or anonymise data before processing it with AI systems.

Where data can be stored

The same reply set out where government data may be kept, by classification, as reported by FMT and Lowyat.NET:

• Open, non-sensitive data: may be stored in clouds based overseas.
• Confidential and restricted data: only in private or hybrid clouds based in Malaysia.
• Secret and top-secret data: only in government data centres.

Government data must also be encrypted so foreign providers cannot access it on their own, even if foreign authorities ask. Lowyat.NET reported that the government owns and controls the encryption keys, in line with the National Cryptography Policy.

What about your personal data

For the private sector, FMT reported that the reply points to Section 129 of the Personal Data Protection Act (PDPA), as amended in 2024. It governs transfers of personal data to clouds overseas and requires the receiving country to have a data protection law comparable to the PDPA.

The Digital Ministry is also drafting an AI governance bill to make AI systems accountable. On 5 October, Gobind told the Dewan Rakyat the bill takes a risk-based approach and is expected to be tabled in early 2027, according to The Star.

What it means for you

The ban applies to government AI procurement contracts. The FMT and Lowyat.NET reports do not say whether it covers what you type into everyday AI tools such as chatbots, which fall under each company's terms of use and the PDPA.

For citizens, it means data held by agencies, such as records processed by a government department, should not become training material for a company's models. What remains unclear is how the clause is monitored and what happens if it is breached, because the reported reply does not address either.

Watch for the AI governance bill early next year, and whether it sets similar rules for private companies. The government has already signalled this direction in AI in Budget 2027, sovereign AI cloud, RM30 million via MDEC and a scam-checking app, and the power supply behind this infrastructure is covered in Data centre electricity demand to peak at 8.39 GW by 2030, and a data centre bill goes to Cabinet in 2027.

Sources

• Free Malaysia Today, Tech firms barred from using public's data to train AI models, says govt, 20 October 2026
• Lowyat.NET, Gobind: Classified Public-Sector Data Not Allowed In Overseas Cloud Environments, 21 October 2026
• Luminews, Syarikat teknologi dilarang guna data awam latih model AI, kata kerajaan
• The Star, Gobind: High-risk AI systems to face stricter safeguards under new Bill, 5 October 2026