LMS in Malaysia: a guide for companies and training providers

What companies and training providers in Malaysia need from an LMS

Training in Malaysia runs on a levy. Employers pay into HRD Corp (Pembangunan Sumber Manusia Berhad), then apply for grants that pay for approved training. HRD Corp says it approved more than RM2.6 billion in financial assistance in 2025, for more than 2.8 million training places. Manufacturing had the most, with more than 795,000.

So a Malaysian buyer usually asks three things of an LMS: will its costs and courses fit HRD Corp’s rules, will it keep the evidence a claim needs, and does it handle personal data under the amended PDPA. Corporate buyers mostly work in English; learners on the shop floor may prefer Bahasa Malaysia, Chinese or Tamil.

The HRD Corp levy, and when LMS costs can be claimed

Under the Pembangunan Sumber Manusia Berhad Act 2001 (Act 612), as widened from 1 March 2021, employers in all sectors with at least 10 Malaysian employees must register and pay a levy of 1% of monthly wages. Employers with 5 to 9 may join at 0.5%. Federal and state governments, local councils, statutory bodies and social welfare NGOs are not covered.

Employer’s Circular No. 3/2024 added three items to the Computer Based Training (CBT) scheme: training software and the development of an LMS, an LMS subscription used for training only and not for other HR functions, and subscriptions to e-learning content platforms. To develop software, HRD Corp says to apply before development starts; for software you buy, the employer claims directly in e-TRiS. A CBT grant application goes in at least one month before training starts, and a claim for an e-learning subscription can go in once you have the payment receipt.

Read that carefully before you sign. Other HR functions are excluded, so price any payroll or HR modules separately. Allowable rates sit in HRD Corp’s Allowable Cost Matrix, and its circulars change often, so check the current versions with HRD Corp. No LMS is “claimable” by name, Classbase included: the employer claims, under the rules of the scheme it uses.

Running and reporting HRD Corp Claimable Courses

Courses are a separate route. Under the HRD Corp Claimable Courses scheme, a registered training provider delivers a programme registered with HRD Corp, and the employer applies for the grant in e-TRiS before training starts. Since 15 June 2026, Employer’s Circular No. 2/2026 says in-house training may start only 14 calendar days after the grant is approved, and an approved grant can no longer be changed: you cancel it and apply again. To register, a provider must be a company or body registered in Malaysia with a permanent office; HRD Corp charges RM1,000, plus RM500 per branch, and registration lasts one year.

Then the evidence. The provider uploads attendance for each day with the T3 form, which trainees sign daily; for remote online training, trainee details are still required but not a physical signature. The JD/14 form can only be approved at manager level or above. The provider submits its claim before the employer does, and claims are due within six months of completion. Keep these records as you go:

• The approved grant, with the programme and dates as registered
• Attendance for every day or session, matching the T3 form
• Results, completion and the certificate for each trainee
• Invoices and receipts, kept per employer and per grant
• A calendar reminder well before the six-month claim deadline

The PDPA after the 2024 amendments

The Personal Data Protection Act 2010 (Act 709) covers personal data in commercial transactions; it does not apply to the federal and state governments. The Personal Data Protection (Amendment) Act 2024 came in stages. From 1 April 2025, processors such as an LMS vendor must follow the Security Principle themselves, the maximum fine for breaching the data principles rose to RM1 million, and the transfer rules changed. From 1 June 2025, data protection officers, breach notification and data portability apply.

The Commissioner’s guidelines fill in the detail. A breach that may cause significant harm, or affects more than 1,000 people, goes to the Commissioner within 72 hours. If it may cause significant harm, affected people are told within seven days after that. The controller must require its processor, by contract, to report breaches promptly. You need a data protection officer if you process data on more than 20,000 people, sensitive or financial data on more than 10,000, or monitor people regularly and systematically. Access requests are answered within 21 days.

AI rules are taking shape. The Commissioner’s 2026 guideline on automated decision-making and profiling covers decisions with legal or significant effects, such as refusing someone a job or access to education. A public consultation on an AI and personal data protection framework is open from 5 to 23 October 2026. Until a framework is final, keep a person in charge of AI grades that affect a job or a qualification, and check the Commissioner’s site for updates.

Hosting and cross-border transfers

Malaysia no longer keeps a whitelist of countries. Under the amended section 129 and the Commissioner’s guidelines of 29 April 2025, you may transfer data abroad if the destination has a law substantially similar to the PDPA or gives adequate protection, which you check with a transfer impact assessment valid for up to three years. Exceptions include consent and necessity for a contract, or due diligence through binding corporate rules, contractual clauses or an approved certification. Keep a record of each receiver and country.

Classbase’s hosting region is confirmed during the demo, before anything is agreed. Whoever you talk to, ask these questions:

• In which country and data center are learner records, files and backups stored?
• Which sub-processors see the data, including AI model providers, and where are they?
• Will the contract oblige you to report a breach to us promptly, so we can meet the 72-hour deadline?
• Can we export one learner’s full record, for an access request within 21 days or a portability request?

Language: what to check, and what Classbase supports

Malay is the national language under Article 152 of the Federal Constitution, and the PDPA guidelines even require a data protection officer to be proficient in both Bahasa Melayu and English. Most corporate L&D runs in English, but safety and frontline courses often need Malay, and sometimes Chinese or Tamil. Ask which languages the screens, emails and certificates come in, and which the courses can be taught in.

To be clear about Classbase: its own screens are in English, Arabic and Turkish today, not Malay. Courses can be taught in the 40 languages the app lists, and the AI translates a course with your glossary, ready for review. Check in the demo that the course languages you need are on that list.

Buying an LMS in Malaysia: ePerolehan and a checklist

Federal agencies buy through ePerolehan, the Ministry of Finance’s e-procurement system, and suppliers register with the Ministry first. Most LMS buyers, though, are private employers spending their own levy, and they often run a shorter RFP. Whatever the route, put these points in your requirements:

How Classbase is designed to help

Classbase is an LMS and LXP built around AI agents, for training providers and corporate academies. It records attendance per session, read from Zoom, Microsoft Teams or Google Meet or taken with a check-in code, next to results and certificates with a code and QR anyone can verify. A training provider can run each client company as its own organization, so Harbour Logistics never sees another client, and reports export as CSV.

You decide what the AI may do, action by action: Do it, Ask first or Never. Grades the AI is unsure of wait for an instructor, and every action, by a person or an agent, is in the activity log. Five roles limit who sees learner data. It supports SSO with OIDC or SAML plus SCIM, imports SCORM 1.2 and 2004, works with LTI 1.3 and sends xAPI to your record store.

Be clear on what it isn’t. Classbase is not an HRD Corp registered training provider or a listed solution, doesn’t submit anything to e-TRiS, and we don’t claim any official integration or certification. Its screens are not in Malay. It is designed to keep the records an HRD Corp claim and the PDPA ask for, and in the demo we say what is ready today. Book a demo with one of your own courses, and we’ll confirm hosting.