Safeguarding international schools in Malaysia: a DSL guide

The Private Education Division of the Ministry of Education (MOE) sets the rules for opening an international school. Its guideline defines one as a school that offers a foreign curriculum in English and admits Malaysian and non-Malaysian pupils.

Section 79 of the Education Act 1996 says every educational institution must register, and applications go to the Registrar General. Section 15 leaves international schools outside the National Education System.

The guideline, updated on 4 February 2021, lists approved curricula: British, American, Australian, Canadian and the International Baccalaureate (IB) Diploma Programme. A school must gain accreditation from an international body within five years of operating.

The UK's British Schools Overseas (BSO) list included four Malaysian schools when it was updated on 5 October 2026. Your own accreditor, if you have one, sets standards beside the Ministry's.

The main law is the Child Act 2001 (Act 611). It defines a child as anyone under 18. The reprint as at 1 July 2023 is the text read for this guide on 19 October 2026.

Section 31 makes it an offence for a person with the care of a child to abuse, neglect, abandon, expose or sexually abuse that child. The penalty is a fine of up to RM50,000, up to 20 years in prison, or both. The reprint does not define who has the care of a child, so ask your lawyer.

The Sexual Offences Against Children Act 2017 (Act 792) covers child sexual abuse material, grooming and sexual assault. Section 16 adds punishment for an offender in a relationship of trust. Its list names teachers, wardens and coaches.

Section 23 can make a director or manager guilty of an offence committed by a company. They escape it only by proving it happened without their knowledge, consent or connivance, and that they used all due diligence to prevent it. Ask your lawyer how this applies to your school leaders.

The Child Act names three groups. Section 27 covers medical officers and registered medical practitioners, section 28 covers family members, and section 29 covers child care providers.

Each must tell a Social Welfare Officer at once. The duty starts when they believe, on reasonable grounds, that a child is injured by ill-treatment, neglect, abandonment or exposure, or is sexually abused. Failing to do so can bring a fine of up to RM5,000, up to two years in prison, or both.

Teachers are not named in those sections. Section 29A lets anyone else give the information to a Social Welfare Officer, without requiring it. Ask your lawyer whether a school or its staff count as child care providers, defined as people who look after children for payment.

Sexual offences carry a wider duty. Section 19 of Act 792 applies to any person. It is an offence to fail to give the nearest police station information about a child sexual offence, or about a plan to commit one.

Your school policy has to cover what the law leaves out. Staff tell the designated safeguarding lead (DSL) the same day, and the DSL decides on any outside report. Read more on mandatory reporting laws for international schools.

If a child is in immediate danger, call 999 first. Then follow your school's child protection procedure and tell your DSL the same day.

• 999: the emergency line, now called NG MERS 999. It connects the Royal Malaysia Police and other agencies.
• 15999: Talian Kasih, open 24 hours and run by the Department of Social Welfare. It covers abuse, child neglect and sexual harassment. WhatsApp: 019-261 5999.
• A Social Welfare Officer: the person the Child Act says to inform, in the department for welfare services.
• The nearest police station: where section 19 of Act 792 says to give information about a child sexual offence.
• Your DSL: tell them the same day, every time.

Keeping children safe in education (KCSIE) is guidance for schools in England. It has no legal force in Malaysia, so say so in your policy. Many international schools still model their policy on it, and this guide shows which parts travel abroad.

The International Task Force on Child Protection (ITFCP) publishes expectations for school communities, written for accrediting and inspection bodies to use. The Ministry expects international accreditation within five years, so your accreditor's standards will sit beside Malaysian law.

The two rulebooks use different words. The Child Act speaks of reasonable grounds to believe a child is injured or abused. Your staff rule can be simpler: report the first concern, and the DSL works out which legal label fits.

Section 19 of Act 792 speaks of any person and names the police. It does not mention a report to a school lead. Ask your lawyer how your procedure should handle that, and write the answer down.

• Any adult tells the DSL the same day, on the first concern.
• The DSL decides whether to inform a Social Welfare Officer under the Child Act.
• For a child sexual offence, the DSL follows the police route your lawyer confirms.
• The DSL records the concern, the decision and the reason.

The Personal Data Protection Act 2010 (Act 709) applies to personal data processed in commercial transactions. The Personal Data Protection Department lists private schools registered under the Education Act among 13 classes of data controller that must register. Ask your lawyer whether your school has.

Act A1727 amended the law in 2024 and renamed the data user as the data controller. A gazette notice phased it in on 1 January, 1 April and 1 June 2025. It also made biometric data sensitive, and the Ministry's guideline lists a biometric attendance system among required facilities.

Health details and alleged offences are sensitive personal data, and safeguarding files hold both. Section 40 allows processing with explicit consent or on listed grounds, such as a function given by written law. Section 39 allows disclosure without consent where it is needed to prevent or detect a crime, or where the law requires or allows it.

Section 12B says a breach must be reported to the Commissioner as soon as practicable. The Commissioner's circular, in Malay, asks for details within 72 hours and treats a breach of sensitive data as likely to cause significant harm. The Department's FAQ, in Malay, says when a data protection officer is needed.

Section 129 lets a controller send data abroad if the place has a similar law or adequate protection, or on listed grounds such as consent. Nothing in the sections read requires data to stay in Malaysia. Ask every supplier where your records sit, and read sharing safeguarding information.

The End Corporal Punishment report on Malaysia, updated in August 2024, says corporal punishment of boys is lawful in schools. It names the Education Regulations (Student Discipline) 2006 as the rules. Ask your lawyer whether they reach your school.

Your policy can set a stricter rule than the law. Write it down, and train staff and families on it.

The Ministry guideline names English as the language of teaching, and requires Malaysian pupils to study Bahasa Melayu, Islamic or Moral Studies and Malaysian History. Some drivers, guards, cleaners and parents may use other languages. Give them the reporting route in those languages.

The guideline says governors, the principal and teachers must pass a Royal Malaysia Police (PDRM) security check, and that teachers need a teaching permit. Ask the Ministry how your school requests the check.

A Certificate of Good Conduct is for use abroad only, says the MyGovernment page. The Ministry of Foreign Affairs issues it for RM20 in 30 to 60 working days, to anyone who lived in Malaysia for at least six months. Ask staff who are leaving to apply early, and see safer recruitment for international schools.

This guide is general information, not legal advice. Confirm current law with local counsel and the relevant authority.

Then work through this list in your first weeks.

• Find your registration papers, and check which Ministry guideline applies to your school.
• Post 999 and 15999 where staff and students can read them.
• Ask your lawyer who must report under the Child Act and section 19 of Act 792, and write the answer into your policy.
• Write one procedure that covers Malaysian law, ITFCP and your accreditor.
• Check whether your school is registered as a data controller, and who handles breach notices.
• Find where health, offence and biometric records are stored, and who can read them.
• Set a written rule on physical punishment, and give the reporting route in your staff's languages.