Axiata Group Berhad
Headquartered in Malaysia, Axiata Group Berhad[1] provides telecommunications and related services to over 190 million users across Asia.
In December 2022, Axiata and Telenor completed the merger of their Malaysian telecommunications subsidiaries, Celcom and Digi, creating the country’s largest mobile network operator, CelcomDigi. Following the merger, the newly formed entity demonstrated substantially greater transparency in its governance practices than Axiata, its largest shareholder in Malaysia, mainly reflecting Digi’s prior governance transparency. CelcomDigi adopted Digi’s human rights commitment and provided relatively clear disclosures regarding its human rights oversight structure and its approach to conducting human rights due diligence.
Despite these improvements, the merged company did not strengthen its practices or policies related to users’ freedom of expression. Instead, it ranked as the least transparent company in this category, as disclosures in this area declined slightly compared with its performance in the 2022 RDR Index. Notably, the Celcom brand no longer published advertising terms of service.
According to Freedom House, the level of internet freedom in Malaysia was slightly above the global average. While there was no public record of government-ordered national network shutdowns, authorities continued to block, filter, and remove websites and online content on political and religious concerns. For instance, the LGBTQ dating application Grindr has been blocked in Malaysia since April 2024. In a customer notice, CelcomDigi reported that it had blocked all SMS messages containing URL links, personal details, or phone numbers to prevent online fraud, responding to requests from Malaysian authorities. However, neither Axiata nor CelcomDigi published any country transparency reports detailing any government demands leading to website blocking or content restriction.
Meanwhile, Malaysia introduced regulatory changes that affected companies’ obligations related to personal data protection. All amendments to Malaysia’s 2010 Personal Data Protection Act (PDPA) took effect by June 1, 2025. The revised law required data processors to appoint a data protection officer and to notify both regulators and affected users following data breaches. To comply with these requirements CelcomDigi identified a “data protection officer” in its privacy notices to handle user queries, concerns, and complaints. The company also disclosed a crisis management framework for potential data breaches, including procedures for timely notification to regulators and affected parties.
Recent reports indicated that Telenor might divest its 33.1% stake in CelcomDigi by 2027. If the sale takes place, it could raise questions about the continuity of CelcomDigi’s transparency practices.
The 2026 RDR Index: Telco Giants Edition covers policies that were active on August 31, 2025. Policies that came into effect after August 31, 2025 were not evaluated for this ranking.
Scores reflect the average score across the services we evaluated, with each service weighted equally.
We rank companies on their governance, and on their policies and practices affecting freedom of expression and privacy.
Axiata recorded a double-digit increase in its governance score, primarily reflecting more comprehensive disclosures of CelcomDigi, the newly merged Malaysian telecommunications operator. Beyond a formal human rights commitment (G1), CelcomDigi established a top-down governance structure to oversee human rights-related issues (G2). The entity also reported conducting human rights due diligence and assessing the risks of “disruptive technologies” (G4a, G4d). At the group level, however, Axiata did not provide comparable disclosures on these issues. In addition, no evidence showed that Axiata provides users with remedies for freedom of expression (G6a).
Axiata exhibited minimal transparency in its approach to content governance and freedom of expression. Its services provided limited disclosure on its content restriction processes and lacked public-accessible policies governing advertising content and targeted advertising (F3a, F3b, F3c). The company disclosed no information on its response to government requests for websites or online content blocking, nor did it provide relevant data (F5a, F6). While CelcomDigi indicated that it follows an Authority Request Manual to address communication limitation (shutdown) orders, it did not share any further details on how such orders are implemented in practice (F10).
Axiata made notable progress in privacy protection areas, mainly due to its improvement in its security measures. CelcomDigi reported that it undergoes regular internal and external security audits (P13) and disclosed measures for responding to potential data breaches (P15). Despite its improvements, the company continued to lack systematic disclosures about how it manages user information. In particular, Axiata did not commit to data minimization (P3a) and did not clarify whether its services infer user information from data collected (P3b). At the service level, while Celcom provided users with some options to opt out of personalized promotions (P7) and allowed users to access their own data (P8), it did not indicate whether user data is used in the development of algorithmic systems (P7). Moreover, the company remained silent around government requests for user information (P10a, P11a).
[1] For the purposes of consistency and comparability across ranking cycles, RDR evaluates Axiata at the group level, CelcomDigi at the operating company level, and the Celcom brand at the service level. This approach reflects the post-merger structure while maintaining continuity with prior assessments conducted before the Celcom–Digi merger. Although Celcom and Digi merged to form CelcomDigi, many customers continue to use legacy Celcom services and plans, making service-level policies and practices under the Celcom brand still relevant for evaluating users’ experiences and rights.
[2] This adjusted score reflects changes in company performance after excluding the effects of reassessments, corrections, and updates to research guidance, and is intended to capture only policy-related developments.