Workplace Safety Law in Malaysia 2026: Why OSHA Now Reaches Your Office and Not Just Your Factory — the 5-Employee OSH Coordinator, the 40-Person Committee, the RM500,000 Penalty Ceiling and the Section 52 Liability That Falls on Directors Personally

Most foreign-owned companies in Malaysia treat workplace safety as a factory problem. They are two years out of date. Since 1 June 2024, when the Occupational Safety and Health (Amendment) Act 2022 finally came into force, the Occupational Safety and Health Act 1994 no longer applies only to the ten industries listed in its old First Schedule — it applies to every place of work in Malaysia, with very limited exceptions. A trading company with a shophouse office, a consultancy on the 21st floor of a KL tower, a five-person representative office: all of them are now employers with statutory safety duties, a mandatory appointment to make, a written policy to produce, and a penalty ceiling that rose tenfold to RM500,000. This guide sets out exactly what the law now requires, who inside your company has to be appointed and when, what has to exist on paper before an inspector asks, how an accident must be notified, and where personal liability attaches to the director rather than the company.

What actually changed on 1 June 2024 — and why your office is now in scope

The Occupational Safety and Health Act 1994 (Act 514) was drafted as an industrial statute. For thirty years its First Schedule confined it to ten sectors: manufacturing, mining and quarrying, construction, agriculture, utilities, transport, wholesale and retail trade, hotels and restaurants, finance and business services, and public services. In practice, most Malaysian offices operated as though safety law did not reach them, and for a good number of workplaces that was defensible.

The Occupational Safety and Health (Amendment) Act 2022 (Act A1648) removed that boundary. Brought into operation on 1 June 2024, it extends Act 514 to all places of work throughout Malaysia — including the public service and statutory authorities — subject only to narrow carve-outs such as the armed forces and work on board ships already governed by their own legislation. The practical consequence is simple and widely under-appreciated: there is no longer a "we are not an industrial employer" answer. If you employ people at a place of work in Malaysia, Act 514 is your statute.

The amendment did four other things that matter to a foreign-owned Sdn Bhd:

• It made risk assessment an express statutory duty rather than a matter of guidance.
• It created a new mandatory appointment — the occupational safety and health coordinator — for workplaces with five or more employees that are not required to have a full Safety and Health Officer.
• It imposed duties on a principal in respect of contractors and subcontractors working on its premises, closing the "they are not our employees" gap.
• It raised the maximum fine for breach of the core employer duties from RM50,000 to RM500,000.

Who counts as the "employer" — and the three mismatches foreign companies get wrong

Act 514 attaches duties to the employer and to the occupier of a place of work, and after the amendment also to the principal who engages contractors. Three mismatches recur in foreign-owned groups:

1. The regional structure. Staff are on the payroll of a Singapore or Hong Kong entity but work daily in the Malaysian office. Act 514 follows the place of work, not the payroll. The Malaysian entity that controls the premises carries occupier duties regardless of which group company issues the pay slip — and if the arrangement is also being used to avoid Employment Pass or payroll obligations, the safety file is often where an inspector first sees the whole picture.

2. The contractor gap. Cleaners, security guards, machine installers, renovation crews and outsourced warehouse labour are not your employees. Since June 2024 the principal's duty means their safety at your premises is nonetheless partly your legal problem — you must take reasonably practicable steps in respect of persons other than your employees who may be affected by your undertaking.

3. Expatriates and directors on the floor. A China-based engineering manager who visits the Malaysian plant for six weeks is a person at a place of work. Their induction, PPE and inclusion in the risk assessment are not optional courtesies; and if something happens to them, the notification obligations below apply in full.

The paperwork that must already exist: policy, risk assessment, records

Three documents form the spine of an Act 514 file. An inspector will ask for them in this order.

The written safety and health policy (section 16). Every employer must prepare — and revise as often as appropriate — a written statement of general policy on the safety and health of employees, the organisation and arrangements in force to carry it out, and bring it to the notice of all employees. The long-standing exception under the Occupational Safety and Health (Employers' Safety and Health General Policy Statements) (Exception) Regulations 1995 covers only employers with fewer than five employees. Above that line, a signed, dated, communicated policy is mandatory — and it must name the people who are actually responsible, not recite generalities.

The risk assessment. The amendment made express what DOSH had long expected through its HIRARC framework (Hazard Identification, Risk Assessment and Risk Control): the employer must assess the risks to safety and health arising out of the undertaking, and act on what the assessment finds. For an office this is not theatre — the credible hazards are electrical, ergonomic, fire evacuation, lone working, driving on company business, and chemical or biological exposure in a pantry or lab. For a warehouse or plant it is machinery guarding, forklift traffic, working at height, manual handling, noise and chemicals. What matters legally is that the assessment is documented, reviewed, and linked to controls that were implemented.

The records. Induction and training records, PPE issue records, machinery inspection and maintenance certificates, chemical safety data sheets and registers under the USECHH Regulations 2000 where relevant, noise monitoring under the Noise Exposure Regulations 2019, committee minutes, and the NADOPOD register described below.

The people you must appoint: coordinator, officer, committee

This is the single most-missed requirement of the 2024 changes, because it applies to ordinary service-sector companies that never previously thought about DOSH at all.

Note what the coordinator role is not. It is not a licensed profession, it does not require an external hire, and it does not transfer the employer's liability. It is an internal appointment — usually the operations or HR lead — who completes the prescribed training and becomes the identified point of coordination for safety matters. The cost of compliance here is a few days of training and a properly worded appointment letter. The cost of non-compliance is a RM50,000 exposure and, far worse, the absence of any credible safety structure when an accident is investigated.

When something happens: the NADOPOD notification chain

The Occupational Safety and Health (Notification of Accident, Dangerous Occurrence, Occupational Poisoning and Occupational Disease) Regulations 2004 — universally called NADOPOD — sit under section 32 of Act 514 and govern what you must tell DOSH, in what form, and how fast.

Two traps recur. First, a dangerous occurrence with no injury is still notifiable — the scaffold that collapsed overnight, the forklift that overturned in an empty aisle, the pressure vessel that failed. Companies routinely fail to report these and then have to explain the gap when a later incident is investigated. Second, the DOSH notification is not the SOCSO report. An employment injury also has to be reported to PERKESO under the Employees' Social Security Act 1969 so the employee's benefits are triggered. Two regulators, two filings, two deadlines — and doing one does not do the other.

Enforcement: notices first, prosecution second, and the director in the frame

DOSH occupational safety and health officers have wide powers of entry, inspection, examination and seizure. Enforcement usually escalates in this order:

1. Improvement notice (section 48) — where a provision is being contravened, requiring remedy within a stated period.
2. Prohibition notice (section 49) — where an activity involves or will involve an imminent risk of serious personal injury, requiring the activity to stop until remedied. For a factory or site, this is the commercially devastating one: it stops production, not paperwork.
3. Compound or prosecution — with the penalty ceilings below.

The extra layer for construction and manufacturing

If your Malaysian operation builds or makes things, Act 514 sits on top of a second stack of obligations rather than replacing it:

• Construction. The Occupational Safety and Health (Construction Work) (Design and Management) Regulations 2024 — CDM 2024 — allocate duties across the client, designer and principal contractor rather than leaving safety entirely with whoever is last on site. Site personnel also require CIDB registration and the construction personnel card, and projects above the gazetted contract value need an SHO. See our end-to-end guide to setting up a factory in Malaysia for where these sit in the approval sequence.
• Machinery and pressure equipment. The Factories and Machinery Act 1967 was repealed with effect from the 2024 commencement, with its subject matter migrating into Act 514 and its subsidiary regulations. Certificates of fitness for pressure vessels, hoisting machinery and passenger lifts, and the competent-person regime for their operation, remain live requirements — the statute they sit under changed; the duty did not.
• Chemicals and health surveillance. USECHH 2000 (chemical hazardous to health), the Noise Exposure Regulations 2019, and industry-specific codes bring in exposure monitoring, medical surveillance and record-keeping obligations that an ordinary HR function will not think of.

How safety law interacts with your other HR obligations

Act 514 does not stand alone, and foreign employers frequently confuse its duties with three neighbouring regimes:

The interaction that costs money is between the first and the last. Dismissing an employee for a safety breach — refusing PPE, bypassing a guard, falsifying a checklist — is defensible, but only if the safety rule was documented, communicated and enforced consistently, and only if the dismissal follows a proper domestic inquiry. Our guides to Employment Act compliance and dismissal and the Industrial Court set out that process; the safety file is what turns a safety dismissal into a winnable case.

A realistic first-year compliance sequence

For a newly incorporated foreign-owned company, the whole of Act 514 compliance can be built in a matter of weeks, and it is far cheaper done in this order than reconstructed after an incident.

1. Month 1 — scope it. Count employees at each place of work. Determine which of the three thresholds (5 / gazetted class / 40) you cross, now and at your projected headcount in twelve months.
2. Month 1 — appoint. Identify the coordinator, issue a written appointment letter, and enrol them in the prescribed training. If you are in a gazetted class, begin recruiting or contracting a registered SHO immediately — the pool is small and site-based.
3. Month 2 — assess. Run a documented HIRARC across every activity and location, including work-from-home arrangements and company driving. Record hazard, risk rating, control, owner and review date.
4. Month 2 — write the policy. Signed by the managing director, dated, naming responsibilities, and physically posted plus circulated to every employee in a language they understand. Bilingual is the practical standard in Malaysia.
5. Month 3 — train and record. Induction for all staff, PPE issue records, emergency response and evacuation drill with an attendance list.
6. Month 3 — build the notification capability. Open the JKKP 8 register, brief managers on what a dangerous occurrence is, and put the nearest DOSH office contact where the register lives.
7. Quarterly thereafter. Committee meeting with minutes (if 40+), risk assessment review, corrective action close-out, and a one-page safety report to the board so that section 52 due diligence is evidenced in the minutes.

What to do next

If your Malaysian entity was incorporated before June 2024 and nobody has revisited safety since, assume you are non-compliant on at least the coordinator appointment and the written policy — those two alone account for most of what DOSH finds in service-sector inspections. If you are about to open a plant, warehouse or site, the safety structure belongs in your pre-operational plan alongside Bomba, DOE and the manufacturing licence, not after commissioning.

ONEKEY BIZ handles the compliance build-out end to end for foreign-owned companies: threshold assessment, coordinator appointment and training arrangement, bilingual policy drafting, documented HIRARC, committee constitution and minute templates, the NADOPOD register, and the quarterly board reporting pack that makes the section 52 defence real. Where an SHO is required, we help scope the role and the contract. Talk to us through our contact page, or see how safety compliance fits into a wider corporate and legal advisory engagement — and if you are still at the setup stage, our step-by-step incorporation guide shows where this sits in the sequence. WhatsApp or call +60 12-321 1349.

This article is general information only, not legal, tax or immigration advice. Policies, thresholds and official fees are set by the relevant Malaysian authorities and may change. Talk to our consultants about your specific situation.