Master Services Agreement in Malaysia: Template, Key Clauses and Local Law (2026)

A master services agreement (MSA) is the umbrella contract that sets the legal terms for an ongoing services relationship, so that individual projects can be ordered quickly through statements of work (SOWs) without renegotiating everything each time. In Malaysia the MSA is governed by the Contracts Act 1950, with the Personal Data Protection Act 2010, competition rules and the service tax position shaping specific clauses. This guide sets out what belongs in an MSA and the local law behind it. It is written for buyers, suppliers and their legal teams. It is general guidance, not legal advice, and you should confirm the current position with a qualified Malaysian lawyer. ## What an MSA is and why it is used An MSA separates the legal framework from the project detail. The MSA is signed once and covers the terms that rarely change: payment, liability, intellectual property, confidentiality, data protection and dispute resolution. Each piece of work then gets its own SOW, which plugs into the MSA and carries the scope, timeline and price. The benefit is speed and consistency. Once the MSA is agreed, new projects need only a short SOW, and the legal position is already settled. ## The law that applies in Malaysia - Contracts Act 1950 (Act 136). This is the main statute governing contracts in Malaysia. It sets out formation, free consent (section 10 and section 14), performance and remedies for breach. So the familiar building blocks of a valid contract are codified here.

• Personal Data Protection Act 2010 (PDPA). If the services involve personal data in commercial transactions, the PDPA applies. The Personal Data Protection (Amendment) Act 2024 brought significant changes, phased through 2025: the term "data user" was replaced with "data controller", data processors were given direct security obligations from 1 April 2025, and mandatory breach notification, data protection officer appointment and data portability followed from 1 June 2025. The maximum fine for breaching the data protection principles rose to RM1,000,000.
• Competition Act 2010. Restrictive terms, such as exclusivity, should be checked against this Act, which the Malaysia Competition Commission (MyCC) enforces.
• Copyright Act 1987. Deliverables such as software, designs and reports are protected by copyright, so ownership of created intellectual property must be clear.
• Service tax. Malaysia applies service tax to digital services at 8% (raised from 6% on 1 March 2024). Foreign providers of digital services to Malaysian customers must register once they pass the RM500,000 threshold and account for the tax, so pricing and tax responsibility should be spelled out. ## Key clauses to include ### Structure and statements of work State that the MSA is the framework and that services are ordered through SOWs. Include an order-of-precedence clause saying which document wins if the MSA and an SOW conflict. ### Services and standards Set the general standard of service, such as reasonable skill and care, and let each SOW define the specific work. ### Fees and invoicing Cover how fees are set in SOWs, invoicing, payment terms, service tax and any withholding tax. ### Intellectual property Say who owns deliverables and pre-existing materials, and grant any licences needed to use them, in line with the Copyright Act 1987. ### Confidentiality Protect each side's confidential information and set how long the duty lasts. ### Data protection If personal data is processed, include or attach data protection terms meeting the amended PDPA, remembering that data processors now carry direct obligations and that breach notification is mandatory. ### Warranties, indemnities and liability Include service warranties, indemnities for key risks, and a clear limitation of liability with a cap and exclusions of indirect loss. ### Term, termination and insurance State the term, renewal, termination rights and notice, what happens to open SOWs on termination, and any insurance the supplier must carry. ### Governing law and disputes Malaysian-facing deals usually choose Malaysian law and either the courts or arbitration under the Arbitration Act 2005. ## A simple structure to follow 1. Parties and definitions

2. Structure: MSA and SOWs, order of precedence
3. Services and standards
4. Fees, invoicing, service tax and withholding tax
5. Intellectual property
6. Confidentiality
7. Data protection
8. Warranties, indemnities and limitation of liability
9. Term, termination and insurance
10. Governing law and dispute resolution ## Common mistakes to avoid - No order-of-precedence clause, so an SOW and the MSA conflict with no tie-breaker.

• Putting project detail in the MSA, which defeats the point of a framework.
• Using outdated "data user" language and missing the new processor and breach-notification duties under the amended PDPA.
• An uncapped or silent liability position.
• Not saying what happens to live SOWs when the MSA ends. ## Keeping the agreement in one place An MSA is a living framework. It spawns SOWs, renewal dates, liability caps and data obligations that all need tracking, and the current version has to be the one people rely on. This gets hard when the MSA, its SOWs and the obligations inside them live in different tools. The idea behind a single AI contract workspace is to hold the MSA and its SOWs together: draft and review each document, link SOWs to the master agreement, and track renewal dates and obligations in one place rather than across email and spreadsheets. Adira is one such workspace. It is built around Indian corporate law first, and support for other jurisdictions, including Malaysia, is on its roadmap, so treat the local-law points above as a starting position to confirm with a qualified Malaysian lawyer.