Malaysian trials of medicinal products run through NPRA's import licence and exemption system, ethics review and registration in the national research register, with a freshly amended data protection law. Capture lets Malaysian sponsors and investigators build and test a study without local IT or a vendor project.
Free sandbox · No credit card · 21 CFR Part 11 aligned
Study region
Malaysia
Key points for studies in Malaysia
Regulation
A Malaysian medicinal product trial has three linked requirements. The study is registered in NMRR. An ethics committee gives a favourable opinion. NPRA then approves the CTIL (or the CTX where the product is manufactured in Malaysia). Practitioner sources describe the ethics and NPRA reviews as able to run in parallel, with the final start only after both are in place, though published timelines are old, so ask NPRA and the committee for current ones.
The 8th edition of the guideline also ended sharing of a CTIL or CTX across trials following a WHO assessment in late 2023, folded safety reporting into the same document and brought back variations for a change of investigator. For the data team, the consequence is steady paperwork: each protocol amendment, new site or new investigator may need a regulatory filing. Capture helps by keeping approved forms locked for live use, tracking each change in a field-level audit trail with reason for change, and exporting a blank eCRF PDF (cover page, form index, visit-by-form matrix) for the ethics package.
Questionnaire, registry and many device studies do not need a CTIL or CTX, but they still need ethics review and usually NMRR registration. Ask the committee which path your study follows.
Pre-launch readiness
1 site activated
1 form not yet approved
Data protection
The 2024 amendments to the PDPA (Act A1727) changed three things that matter to a trial team. Cross-border transfers no longer rely on a white list; instead the destination must have a substantially similar law or offer protection at least equivalent to the PDPA. Data processors, which can include an EDC provider, have direct security obligations. Controllers must appoint a data protection officer where required and notify the Commissioner and affected people of breaches. Supporting guidelines were expected alongside these changes, so check the Personal Data Protection Department for the current position and any research provisions.
Capture hosts in the EU (Frankfurt) or the USA (N. Virginia), so for Malaysian participants this is a transfer out of Malaysia. Record the basis in your data sharing agreement and in the participant information. Pseudonymisation helps: site coordinators see participant names, researchers see coded IDs, and row-level security in the database enforces the split. Data is encrypted with AES-256 at rest and TLS in transit, and staff can turn on authenticator-app two-factor sign-in. For a comparison with the best-known regimes, see HIPAA vs GDPR clinical trial data.
Site coordinator
Jane Peterson
DOB: 04-Mar-1978
Subject 01-004
Sees direct identifiersResearcher
Subject 01-004
DOB: withheld
Coded ID only
Sees coded ID onlySame record, two roles. Row-level security enforces the split.
Inspection readiness
Ethics committees and regulators come back to a study after approval. Capture records every change field by field with timestamp, user identity, old value, new value and reason for change, and the audit trail cannot be edited through the interface. Repeating rows, such as concomitant medications, carry their own trail. Export it when a committee or monitor asks.
Weight changed 68.0 to 68.5 kg
Site coordinator · Reason: Transcription error
Query Q-0014 answered on Weight
Site coordinator · Reason: Source checked
Vital signs form locked
Data manager · Reason: Visit cleaned
Prepare every form, test your edit checks and sign a mock consent in the free sandbox. No credit card, no time limit.
At a glance
A planning checklist from public guidance, not an authority. Confirm each row with NPRA, the ethics committee and the site.
| Item | Who | Notes |
|---|---|---|
| NMRR registration | Sponsor or principal investigator | Needed before a CTIL or CTX application is accepted |
| Ethics review | Committee at the site (Ministry of Health, university or private hospital) | Favourable opinion required before NPRA approval |
| CTIL or CTX | NPRA | Per trial, not shared; variations for investigator changes |
| Site contract and budget | Site and sponsor | Administration timelines vary by institution |
| Data protection plan | Sponsor with counsel | Amended PDPA; transfer basis for hosted data |
| Blank eCRF PDF | Study team | Export from Capture for the ethics package |
General practice summary, not legal advice.
Malaysian research
Malaysia has public university hospitals, Ministry of Health facilities and a private hospital sector, and it is often used in Asia-Pacific programmes that also include Singapore and Thailand. Local sponsors range from large university groups to small clinical research groups. A team with no EDC budget can use Capture with no setup fee and no per-site fee, build from an uploaded protocol with the AI study builder (human review required), and enrol participants at the site with a QR code. See EDC for investigator-initiated trials and clinical trial software without a CRO.
If your programme extends beyond Malaysia, read the regional overview in clinical trial software for Southeast Asia and the neighbouring guides for Thailand and Singapore.
Before you start
Registration number ready for the NPRA application.
Ministry, university or private; favourable opinion before NPRA approval.
Imported or locally sourced product; per-trial licence; variations for amendments.
Consent and participant information in Malay, English or other languages sites need; instrument licences in your study file.
Legal basis, DPO if required, breach process and transfer basis for EU or US hosting.
Paper source and delayed entry where a site cannot rely on a connection.
NPRA, through the Clinical Trial Import Licence (CTIL) and Clinical Trial Exemption (CTX). An ethics committee must also give a favourable opinion, and the trial is registered in NMRR. Confirm the current guideline edition with NPRA.
No. The NPRA guideline states that a trial cannot begin until the ethics committee gives a favourable opinion and NPRA approves the CTIL or CTX.
The Personal Data Protection Act 2010 as amended in 2024, with reported phases in April and June 2025. Check the Personal Data Protection Department for current guidance, including cross-border transfers.
No. Capture hosts in the EU (Frankfurt) and the USA (N. Virginia). Record the transfer basis in your contracts and participant information.
No. Capture is web based and needs a connection to enter data. Plan how sites capture source when connectivity fails.
No regulator approves or certifies EDC software the way NPRA approves a trial. Capture provides controls such as an audit trail and e-signatures; your validated use and submissions are what regulators assess.
Yes. The free sandbox has every feature, with no credit card and no time limit.
Keep exploring
Clinical trial software for Southeast Asia
The regional picture.
Clinical trial software in Thailand
Thai FDA and the PDPA.
Clinical trial software in Singapore
HSA and ethics boards.
Audit trail software
Evidence for committees and inspectors.
Clinical trial software without a CRO
Self-serve study set-up.
HIPAA vs GDPR trial data
Comparing two data regimes.
Self-serve EDC, eCRF and eConsent. Free sandbox, no credit card.