Who Owns Your Website's Code, Design and Content? A Malaysian Business Guide

"We paid for it" is not a legal test

A business that commissions a website and pays the final invoice reasonably assumes it now owns what it paid for. Under Malaysian copyright law, that assumption is often — though not always — correct, which is exactly what makes it risky to rely on without checking. The default legal position is genuinely in the paying client's favour in many situations. The problem is that contracts routinely override that default, and a website is rarely one single work with one single owner in the first place.

What the law actually says

Copyright in Malaysia is governed by the Copyright Act 1987. Section 26(1) sets the general rule: copyright vests initially in the author — the person who actually created the work. Section 26(2) then addresses the situation most relevant to a commissioned website: where a work is commissioned from someone who is not the author's employer, copyright "shall be deemed to be transferred" to the person who commissioned it, "subject to any agreement between the parties excluding or limiting such transfer" (full consolidated text via WIPO Lex: Malaysia — Copyright Act 1987).

Read plainly, this means that if a Malaysian business genuinely commissions original work — bespoke code, original copy, a custom design — from a freelancer or agency who is not its employee, copyright in that original work is deemed to transfer to the business by default, without needing a separate written assignment document. That's a stronger starting position than many business owners assume, and it's worth knowing precisely because most articles on this topic skip it.

It also means Malaysia has no copyright registration system to check any of this against. Copyright arises automatically on creation; there is no certificate and no public register of ownership to search. The US government's own trade guidance on intellectual property in Malaysia summarises the position plainly: "copyrights are protected in Malaysia without any registration requirements" (International Trade Administration: Malaysia — Protecting Intellectual Property). MyIPO, the Intellectual Property Corporation of Malaysia, does offer an optional Copyright Voluntary Notification that creates a dated record usable as evidence if ownership is ever disputed — but filing one is not what creates the copyright, and skipping it does not mean nobody owns the work.

So why "we paid for it" still isn't safe to assume

Three reasons, none of them hypothetical.

The contract can — and often does — override the default. Section 26(2)'s transfer only applies "subject to any agreement between the parties excluding or limiting" it. Plenty of standard agency and freelancer contracts do exactly that: a clause stating the agency retains all intellectual property and grants the client only a licence to use the finished site is common, entirely legal, and completely defeats the statutory default. If nobody on your side ever read that clause, you don't actually know which of the two regimes you're operating under.

"Commissioned" has to mean something was genuinely made for you. The default transfer applies to work created for the commission — not to a pre-built template the agency reuses across other clients with your logo swapped in, and not to a theme or plugin they installed rather than wrote themselves. Ownership gets murky fast where a site is assembled largely from existing components with configuration and content layered on top, because it's no longer obvious how much of it was "commissioned" in the sense the Act means.

Most of a website was never the agency's to give you in the first place. This is the part "we paid for it" tends to miss entirely, and it's the next section.

Assignment versus licence

These are different things, and the difference is the whole point of a handover conversation. An assignment transfers ownership of copyright itself — the recipient becomes the owner outright, and this should be recorded in writing to avoid any doubt later about what was agreed. A licence only grants permission to use a work in defined ways, while the original creator keeps ownership throughout. A contract that promises "full rights to use your website" without ever using the words "assign" or "transfer ownership" is very likely describing a licence, not an assignment — regardless of how confidently the invoice was worded.

Third-party components carry their own licences

A typical website bundles several categories of material that were never the agency's property to assign, because the agency didn't create them either:

• GPL themes and plugins. WordPress core is released under the GPL, and WordPress.org's own licensing position is that themes and plugins built on it are derivative works that "inherit the GPL license" (WordPress.org: License). A GPL licence permits reuse and modification, but it isn't personal ownership — you can't exclude anyone else from using the same freely licensed theme, because your agency never owned it exclusively to begin with.
• Stock imagery. Standard stock-photo licences grant usage rights for specific, defined purposes rather than copyright ownership of the photograph itself. Extended or exclusive licences do exist, but they cost more and are rarely included in a standard project budget by default.
• Fonts. Many web fonts are distributed under open licences, such as the SIL Open Font License, that permit embedding them on a website without transferring ownership of the typeface design underneath.

None of this is a defect in your project — it's normal, and every website built with common tools works this way. The point is that "who owns the website" is really several smaller questions about several different components, and only some of them resolve in your favour by default.

What a contract should say

At minimum, a website contract should state explicitly what is being assigned versus what is only licensed, the effective date of any transfer, which deliverables it covers (typically custom code, custom design and written content — but not third-party components layered into them), and a list of the third-party components used together with confirmation their licences permit your intended use of the site.

What to ask for at handover

Beyond the contract clause itself, a clean handover should include full source-code access — not merely a live site you can log into — the original design files, a written list of every third-party theme, plugin, image and font used along with proof of its licence, and written confirmation of exactly what was assigned versus what was only licensed for use.

This is not legal advice

This article explains the general framework under the Copyright Act 1987; it is not a substitute for advice from a Malaysian lawyer on your specific contract or a live dispute.

Inherited a site from a previous developer and unsure what you actually hold rights to? JagaWeb's Essential System Review looks at what's documented about ownership and third-party licensing as one of its eight control points on a single site. It runs RM1,500, discounted to RM999 through 16 September 2026 — useful groundwork before relying on a site you can't fully account for, not a legal opinion on it.