In Malaysia, the Marketing Authorisation Holder (MAH) must run a pharmacovigilance system under NPRA's Guidelines on Good Pharmacovigilance Practices (GVP) for Product Registration Holders (2021). That means a responsible person for pharmacovigilance (RPPV), with a Malaysia-based local contact if the RPPV is abroad; reporting local serious adverse reactions within 7 or 15 calendar days and non-serious ones within 30; notifying emerging safety issues within 3 days and safety-related withdrawals abroad within 24 hours; monitoring literature and digital channels; and the PBRER, RMP and system documents that apply to the product. Duties vary by product category and registration conditions, and contracting the work out does not move the responsibility.
MAH responsibility under NPRA's guideline
Every product registered with Malaysia's Drug Control Authority has a registration holder, and NPRA's GVP guideline is written for that holder. The guideline, adopted mainly from the European GVP modules, sets out the holder's pharmacovigilance system: who is in charge, how adverse reactions are collected and reported, what periodic and risk documents are due, and how long records are kept. The legal basis is the Control of Drugs and Cosmetics Regulations 1984: Regulation 28 requires registration holders to report adverse reactions, and Regulation 29 lets the Director of Pharmaceutical Services issue directives and guidelines - contravening them is an offence. Safety issues are reviewed with the Malaysian Adverse Drug Reactions Advisory Committee (MADRAC), which advises the Drug Control Authority.
The holder can outsource parts of the work - to an affiliate or a specialist provider - but the guideline is clear that the holder "shall nevertheless retain full responsibility" for the quality and integrity of the system. Outsourcing changes who does the work, not who answers to NPRA.
The responsible person (RPPV) and the local contact
- A responsible person for pharmacovigilance (RPPV) must be permanently and continuously available to the holder, with sufficient experience or training in pharmacovigilance. If the RPPV or the local contact is not a healthcare professional, they need access to a medically qualified person.
- Preferably in Malaysia. If the RPPV sits abroad - NPRA gives Singapore as the example - a local contact person based in Malaysia is required, reachable by NPRA at all times and able to reach the RPPV at all times.
- Back-ups for both roles, with the information they need to step in.
- Contact details on file with NPRA for the RPPV, the local contact and all back-ups - name, position, address, email and phone. Changes are notified to NPRA by email within 30 calendar days of taking effect.
- Training records. Everyone involved in pharmacovigilance needs initial and continued training, documented in training plans and records.
For a foreign manufacturer whose global safety team sits in Europe or India, this usually means naming a trained local contact in Malaysia alongside the global RPPV - a person NPRA can reach at any time.
NPRA adverse reaction reporting deadlines
Deadlines run from the day the holder first knows about a case. A valid report needs four things: an identifiable reporter, an identifiable patient, a suspected medicine and a suspected reaction - missing information triggers documented follow-up. Holders report on the CIOMS I form to NPRA's National Adverse Drug Reaction Monitoring Centre, online, by email to fv@npra.gov.my, by post or by fax.
| What happened | Deadline to NPRA |
|---|---|
| Local serious reaction, fatal or life-threatening | As soon as possible, no later than 7 calendar days; complete report within a further 8 days |
| Local fatal adverse event following immunisation (AEFI) | Initial report within 24 hours of awareness; investigation assessment and documents within 7 calendar days of the initial report |
| Local serious reaction, not fatal or life-threatening | No later than 15 calendar days |
| Local non-serious reaction, expected or unexpected | Within 30 calendar days |
| Foreign individual case reports | Not required routinely |
| Emerging safety issue, including a regulatory decision abroad | No later than 3 calendar days |
| Registration or availability withdrawn or suspended in any country for safety reasons (not business reasons) | Within 24 hours |
Source: NPRA GVP guideline 2021, Appendix 2; NPRA pharmacovigilance FAQ.
The last two rows are where foreign manufacturers get caught: a safety action by the EMA or the FDA starts a Malaysian clock of days, not weeks. Your global safety function and your Malaysian holder need an agreed route for that information before it happens.
One related case: adverse reactions to unregistered medicines supplied under special approval or a special import permit are also reported to NPRA through the same route and timelines. Which unregistered medicines Malaysia imports most under special approval.
Literature and digital media monitoring
- Literature. The MAH keeps a systematic review of the scientific and medical literature for its active ingredients, at a frequency set by clinical judgement, with a route for findings to reach its safety function. Only cases that occurred in Malaysia are reported to NPRA as individual reports; other findings feed signal assessment.
- Digital channels. The MAH's own websites and digital programmes are screened regularly for suspected reactions; other websites and forums join the screening once the MAH knows they discuss its product. Screening frequency must let valid cases meet the deadlines above.
- Signals and quality. The system includes a documented process for detecting and evaluating new or changing safety signals, plus audits of the system and of any delegated work, and training records for the people involved.
Periodic reports and risk management plans
- PBRER for new chemical entities and biologics. Periodic Benefit-Risk Evaluation Reports every six months for the first two years after Malaysian approval, then annually for three years. The first data lock point falls no later than six months after approval. Submission is due within 70 calendar days of the data lock point for six- or twelve-month intervals, and 90 days for longer intervals or ad hoc requests unless NPRA sets another date. Every post-registration PBRER goes with a Malaysian annex (product overview in Malaysia, safety changes and actions, signals evaluated).
- Hybrid new drug products submit the latest PBRER once, when a new indication, form, dosage, strength or route is registered.
- Risk Management Plan (RMP) is required before registration for new drug products and biologics, with a Malaysia-Specific Annex on NPRA's template - an RMP in the EU format is accepted, but a global RMP alone is not enough. Updated RMPs are due within 70 calendar days of final sign-off.
- Generics and other products as a rule need neither a routine PBRER nor an RMP - but NPRA can request one when a safety concern arises, and the adverse reaction reporting above applies to every product.
- Issue-related summary reports on a specific safety question are prepared only when NPRA requests them, with 30 calendar days or less to respond. Orphan medicines can carry their own annual safety report requirement.
PVSS and PSMF requirements
Except for traditional medicines and health supplements, holders prepare a Pharmacovigilance System Master File (PSMF) - a living description of the system, updated as it changes - and a short Pharmacovigilance System Summary (PVSS). Preparing them and submitting them are different things: NPRA currently requests the PVSS only from holders in the voluntary phase of its GVP inspection programme and from applicants for conditional registration during a disaster, generally once. NPRA ran that voluntary inspection phase in 2023-2024 under guidance issued in March 2022 and published its findings in April 2025; the 2025 addendum describes inspections as part of NPRA's compliance oversight. Inspection or not, the GVP requirements apply to every holder.
Safety communications and records
- Direct Healthcare Professional Communications (DHPC) in Malaysia go through NPRA first: the holder submits a communication plan - objective, timeline, recipients, dissemination method, the marked-up package insert - for approval. The letter should not exceed three pages; the final signed version goes to NPRA before distribution, and NPRA is notified when distribution is complete.
- Records for each product are kept for as long as the registration exists and for at least 10 years after it ends, retrievable on request.
- Change of holder. After the Drug Control Authority approves a transfer, the new holder makes sure all pharmacovigilance data and records are transferred in full. For stock depleted during the transition, the holder that requested the depletion is responsible for pharmacovigilance issues and quality defects in those batches. How a change of holder works.
What to check when you choose an MAH
Pharmacovigilance is the part of holding a registration that never pauses. It runs alongside renewals, variations and, since July 2026, shortage and discontinuation reporting - all on the same holder. Before you appoint one, check:
- People: the named RPPV or local contact in Malaysia, and their back-ups.
- Data exchange: a written pharmacovigilance agreement - often called a Safety Data Exchange Agreement (SDEA) - setting out who reports what, the timelines, how duplicates are avoided and how transferred reports are reconciled.
- Access and exit: your access to safety records, and how they move if the registration moves.
If a distributor is your MAH, these duties sit with a company whose first business is sales; an independent MAH carries them as part of the service it is paid for. Independent MAH vs distributor as MAH.
Frequently asked questions
Who is responsible for pharmacovigilance in Malaysia?
The holder of the product registration - NPRA's Product Registration Holder, called the Marketing Authorisation Holder (MAH) in this guide. The holder may contract parts of the work to a third party, but keeps full responsibility for the pharmacovigilance system.
Does the responsible person for pharmacovigilance have to be based in Malaysia?
No. NPRA prefers the RPPV to be based in Malaysia but allows an RPPV abroad, for example in Singapore, if a local contact person based in Malaysia is appointed. The local contact must be reachable by NPRA at all times and able to reach the RPPV; back-ups are required for both roles.
How quickly must a serious adverse reaction be reported to NPRA?
For local reports: fatal or life-threatening serious reactions no later than 7 calendar days after the holder first knows, with a complete report within a further 8 days; other serious reactions within 15 calendar days; non-serious reactions within 30 calendar days.
Do generic medicines need a PBRER or a Risk Management Plan in Malaysia?
As a rule, routine PBRERs apply to newly approved new chemical entities and biologics, and RMPs to new drug products and biologics. NPRA can still request an RMP or a safety report for any product when a safety concern arises, and adverse reaction reporting applies to every product.
Does every holder have to submit a PVSS and a PSMF?
Holders other than those of traditional medicines and health supplements prepare them, but NPRA currently requests the PVSS only from holders in the voluntary phase of its GVP inspection programme and from conditional registration applicants. The PSMF is kept up to date as the system changes.
Are GVP inspections mandatory in Malaysia?
NPRA ran a voluntary phase of GVP inspections in 2023-2024 under guidance issued in March 2022, and its 2025 addendum describes inspections as part of its compliance oversight. Whether or not a holder is inspected, the GVP requirements apply in full.
How long must pharmacovigilance records be kept?
For as long as the product registration exists and for at least 10 years after it ends. When a registration moves to a new holder, the pharmacovigilance data must be transferred to the new holder.
You might also find useful
- After the MAL Number: Renewals, Variations and the Holder's Obligations in Malaysia
- Independent MAH vs Distributor as MAH in Malaysia: Decision Checklist
- Sources:
- NPRA - Malaysian Guidelines on Good Pharmacovigilance Practices (GVP) for Product Registration Holders, First Edition, August 2021: npra.gov.my (PDF)
- NPRA - Addendum to the GVP guideline (October 2025): npra.gov.my
- NPRA - Malaysian Guidance Document on Voluntary Good Pharmacovigilance Practices (GVP) Inspection, First Edition, March 2022: npra.gov.my
- NPRA - Outcome of GVP Inspection Voluntary Phase (2023-2024), 16 April 2025: npra.gov.my
- NPRA - FAQ: Pharmacovigilance for Product Registration Holders: npra.gov.my
- Editorial note: This page is general business and regulatory information for manufacturers evaluating Malaysia. It is not legal or regulatory advice. Requirements may change; check NPRA's current guidance, directives and product-specific registration conditions before making a submission. Last reviewed against NPRA guidance: 21 October 2026.