Data Centre Insurance Malaysia: What Hyperscale, Colocation & Edge Facilities Actually Need

Does your data centre insurance programme reflect the kind of facility you actually operate? A hyperscale campus in Johor and a colocation tenant in Cyberjaya face almost entirely different risks, but Foundation frequently sees them buying near-identical cover off the same broker template. That approach leaves at least one of the two materially exposed.

This guide explains what data centre insurance means in the Malaysian market, and how hyperscale, colocation, and edge facilities should each structure their insurance programme around the risks that are specific to their operating model.

If you are focused on the construction phase of a new data centre build, our companion guide on data centre construction insurance covers CAR, EAR, and pre-operational exposure in depth. For operational-phase cover including EEI and BI considerations, see our data centre operations insurance guide. This article sits above both and answers the prior question: what does your specific facility type actually need?

What Is Data Centre Insurance in Malaysia?

Data centre insurance in Malaysia is a layered programme that protects the physical facility, the mechanical and electrical infrastructure, the IT equipment, the operational continuity, and the contractual liabilities that attach to hosting customer data and workloads. It is not a single product sold under one policy title. It is a bundle of Industrial All Risks, Electronic Equipment Insurance, Machinery Loss of Profits, Business Interruption, Public Liability, Cyber Liability, and often Professional Indemnity cover, stitched together for the specific risk profile of a given facility.

The three broad facility categories in the Malaysian market are hyperscale (large purpose-built campuses operated by or for a single major cloud or internet company), colocation (multi-tenant facilities where customers rent rack space, power, and cooling), and edge (small distributed facilities placed close to end users for low-latency workloads). Each faces different construction values, different downtime costs, different tenant exposures, and different contractual obligations. A standardised policy misses the point.

The practical implication: asking "how much does data centre insurance cost in Malaysia" is the wrong question. The right question is "how should my facility's risk profile drive the structure of the programme, before anyone talks about premium." Structure first, pricing second.

How the Three Facility Types Actually Differ

Dimension	Hyperscale	Colocation	Edge
Typical size	50 MW upward, single site or campus	5 to 30 MW, multi-tenant	Sub 1 MW, distributed network of sites
Primary tenant	Single hyperscaler or captive	Multiple enterprise and cloud tenants	Content delivery, 5G, IoT, streaming
Replacement value	Very high, often into LSR territory	High, varies with density	Moderate per site; aggregate can be high
Dominant operational risk	Cooling or power failure across a whole hall	SLA breach leading to tenant liability	Site outage and physical security
Third-party exposure	Small (one contract counterparty)	Large (many tenants, each with an SLA)	Contract-specific, often pass-through
Main BI driver	Hyperscaler contract penalty clauses	Lost rack revenue plus SLA refunds	Service credits and network reroute costs
Common under-insurance	MLOP limit too low for scale	Tenant liability not properly structured	Aggregate cover misses the portfolio risk

What a Hyperscale Facility Actually Needs

Hyperscale data centres in Malaysia, typically anchored in Johor, Cyberjaya, Nusajaya, and increasingly Penang, sit at the top end of insurance complexity. The total insured value is high enough to push most of them into Large and Specialised Risks (LSR) fire territory, which means premium is negotiated with reinsurers rather than dictated by tariff. That is a structural feature of the placement, not a footnote.

The single largest exposure on a hyperscale site is not fire. It is a chilled water loop failure, a UPS battery room incident, or a switchgear fault that takes out a full hall and triggers a contractual downtime penalty to the anchor customer. Those contractual penalties, written into hyperscaler master services agreements, can dwarf the physical repair cost by ten times or more. The insurance programme has to be structured around this, not around generic IAR and BI defaults.

Foundation's recommended hyperscale programme structure is built around five core components. First, IAR or LSR fire cover on the buildings, plant, and critical infrastructure, with reinstatement value updated annually as power density changes. Second, Machinery Breakdown with a Machinery Loss of Profits (MLOP) extension sized against the anchor customer's SLA penalties, not against internal revenue loss. Third, Electronic Equipment Insurance (EEI) for the IT hardware with specific language around redundancy and partial loss. Fourth, Business Interruption with an indemnity period long enough for cooling system rebuilds (typically 18 to 24 months, rarely shorter). Fifth, Cyber Liability and Technology Errors & Omissions for the service contract exposure.

What a Colocation Facility Actually Needs

Colocation operators face a fundamentally different risk profile from hyperscalers. The physical facility may be smaller, but the liability exposure is much larger because every tenant in the building has an SLA with the operator. A single cooling incident in a shared hall can trigger dozens of service credit claims simultaneously, plus potential liability claims for downstream business interruption suffered by the tenants' own customers.

For colocation, the centre of gravity in the insurance programme is liability, not property. A well-structured colo programme includes property cover on the building and M&E infrastructure, but its distinctive feature is a broad CGL with a products and completed operations section, plus Professional Indemnity for the service delivery exposure, plus Cyber Liability for data-handling claims, plus a specific tenant liability section that responds to SLA breaches without double-counting with the BI policy.

The most common mistake Foundation sees in colocation programmes is that the operator treats the facility as a property asset and insures it like one, without recognising that the revenue is contractual. When a claim comes in, the property policy pays for the damaged equipment and the BI policy pays for lost rack revenue, but the operator is still on the hook for direct SLA refunds and tenant liability claims that were never insured because nobody asked the right question at placement.

What an Edge Facility Actually Needs

Edge data centres are the newest category in the Malaysian market and the one where insurance thinking is least developed. An edge facility is typically a small self-contained site of a few hundred kilowatts or less, placed close to end users to reduce latency for content delivery, gaming, 5G, or IoT workloads. A single edge site might look small enough to cover under an ordinary commercial property policy. An operator running a portfolio of forty edge sites across the country is not running a small business, they are running a distributed network, and the insurance has to reflect that.

The three structural issues Foundation sees in edge programmes are aggregation, physical security, and contract-pass-through liability. Aggregation means the correlated risk of a single weather event, fibre cut, or power grid fault affecting multiple sites at once, which a per-site cover structure does not address. Physical security means the reality that edge sites are often placed in locations without the manned access control of a traditional data centre, increasing theft and vandalism exposure. Pass-through liability means the network operator's contract with the content owner often pushes downtime penalties through to the edge site operator, and the insurance has to be drafted to respond to those contractual flows.

The right programme for an edge portfolio typically includes a master property cover across all sites with appropriate sub-limits, a master liability cover with aggregate limits that reflect the network footprint, cyber liability for the data handling, and a specific contractual liability extension for the downstream SLA exposure. This is closer to a fleet insurance programme in structure than to a single-site data centre policy.

Common Mistakes in Malaysian Data Centre Insurance Programmes

Mistake	Consequence
Using a generic factory template for data centre cover	Missing EEI, MLOP, and cyber sections critical to the risk
BI indemnity period of 12 months	Cooling and switchgear rebuilds often take 18 to 24 months; BI runs out
MLOP limit set to internal revenue loss only	Hyperscaler contract penalties not covered; the real BI exposure is missed
Colocation operator treated as landlord, not service provider	No cover for SLA breach claims or professional indemnity exposures
Edge portfolio insured site by site	Aggregation and correlated-loss exposure invisible to insurers
Cyber liability bought as an afterthought	Data breach and ransomware events fall into a coverage gap
Sum insured not updated as power density grows	Average clause reduction at claim time on upgraded halls

Frequently Asked Questions

What types of insurance does a Malaysian data centre need?

A proper data centre insurance programme in Malaysia combines Industrial All Risks (property), Machinery Breakdown with Machinery Loss of Profits, Electronic Equipment Insurance, Business Interruption, Public Liability or Commercial General Liability, Cyber Liability, and Professional Indemnity. Each covers a specific exposure, and the programme is designed as a layered whole, not a collection of standalone policies.

Is fire insurance enough for a data centre?

No. Fire insurance covers physical damage from insured perils, but it does not cover machinery breakdown, electronic equipment failure, loss of cooling, data-related liability, or service level agreement breaches. A data centre that relies only on fire cover will find large categories of loss uninsured at claim time.

What is the difference between insuring a hyperscale and a colocation data centre?

Hyperscale facilities are usually single-tenant and dominated by contractual downtime penalties with an anchor customer, which drives the BI and MLOP sizing. Colocation facilities are multi-tenant and dominated by liability exposure to many customers through SLA commitments, which drives the liability and professional indemnity sections. The two programmes differ more in structure than in product list.

Does data centre insurance cover loss of customer data?

Loss or corruption of customer data is covered under Cyber Liability and Technology Errors & Omissions policies, not under property or machinery cover. A data centre operator needs explicit cyber cover to respond to data breach, ransomware, and data loss claims from customers. Property policies specifically exclude loss of intangible data as a head of claim.

How is insurance structured for an edge data centre portfolio?

Edge portfolios are typically covered under a master property and liability programme rather than site-by-site policies. The master structure addresses aggregation risk, physical security exposure, and contractual pass-through liability in a way that individual per-site policies cannot. This is closer in structure to a fleet insurance programme than to a single-site data centre policy.

Do Malaysian hyperscale data centres fall into LSR fire territory?

Most of them do. Hyperscale campuses in Johor and Cyberjaya regularly exceed the PIAM sum insured threshold for tariff fire, which means the fire and consequential loss cover is placed on a Large and Specialised Risks basis with significant reinsurance involvement. This changes how the programme is negotiated and how premium is determined at renewal.

How long does it take to place a new data centre insurance programme in Malaysia?

For a greenfield hyperscale or a new colocation facility, a specialist broker typically needs six to ten weeks to place the full operational programme from first underwriting meeting to bound cover. Edge portfolios can be placed faster but benefit from the same disciplined approach. Construction-phase CAR and EAR cover runs in parallel and should be structured with the operational programme in mind from day one.

Foundation Conclusion

Malaysia is in the middle of a data centre boom that has no real precedent in Southeast Asia. Capacity is being added faster than insurance markets can fully underwrite, and operators are under pressure to close cover quickly before their construction contracts or customer SLAs start to bite. The result is that a lot of programmes are being stood up in a hurry, with the same template applied to very different facilities, and with the biggest exposures often left uninsured because nobody asked the right questions at the placement stage.

A hyperscale campus, a colocation building, and an edge portfolio are three different businesses. They share some vocabulary and some equipment, but the risks that will actually hurt each of them are different, and the insurance programme should reflect that. If you are building in Malaysia now, or if you are reviewing an existing programme before your next renewal, start with the risk profile of your specific facility type and let that drive the structure. The products and the premium follow.

Foundation works with Malaysian data centre operators across all three categories. If you send us your facility description and what you currently carry, we will map the programme against the risks and tell you where it is working and where it is not. That conversation is free, it is usually quick, and it is almost always cheaper than finding a gap at claim time.

FAQ

What types of insurance does a Malaysian data centre need?

A proper data centre insurance programme in Malaysia combines Industrial All Risks, Machinery Breakdown with Machinery Loss of Profits, Electronic Equipment Insurance, Business Interruption, Public Liability or Commercial General Liability, Cyber Liability, and Professional Indemnity. Each covers a specific exposure, and the programme is designed as a layered whole.

Is fire insurance enough for a data centre?

No. Fire insurance covers physical damage from insured perils, but it does not cover machinery breakdown, electronic equipment failure, loss of cooling, data-related liability, or service level agreement breaches. A data centre that relies only on fire cover will find large categories of loss uninsured at claim time.

What is the difference between insuring a hyperscale and a colocation data centre?

Hyperscale facilities are usually single-tenant and dominated by contractual downtime penalties with an anchor customer, which drives the BI and MLOP sizing. Colocation facilities are multi-tenant and dominated by liability exposure to many customers through SLA commitments, which drives the liability and professional indemnity sections.

Does data centre insurance cover loss of customer data?

Loss or corruption of customer data is covered under Cyber Liability and Technology Errors and Omissions policies, not under property or machinery cover. A data centre operator needs explicit cyber cover to respond to data breach, ransomware, and data loss claims from customers.

How is insurance structured for an edge data centre portfolio?

Edge portfolios are typically covered under a master property and liability programme rather than site-by-site policies. The master structure addresses aggregation risk, physical security exposure, and contractual pass-through liability in a way that individual per-site policies cannot.

Do Malaysian hyperscale data centres fall into LSR fire territory?

Most of them do. Hyperscale campuses in Johor and Cyberjaya regularly exceed the PIAM sum insured threshold for tariff fire, which means the fire and consequential loss cover is placed on a Large and Specialised Risks basis with significant reinsurance involvement.

How long does it take to place a new data centre insurance programme in Malaysia?

For a greenfield hyperscale or a new colocation facility, a specialist broker typically needs six to ten weeks to place the full operational programme from first underwriting meeting to bound cover. Edge portfolios can be placed faster but benefit from the same disciplined approach.

Talk to our specialists about your data centre insurance programme

Disclaimer: This article provides general guidance on insurance coverage available in the Malaysian market as of April 2026. Policy terms, conditions, and availability vary by insurer, and data centre insurance is a specialist area with significant variation in wording and trigger. Always review your specific policy wording or consult a qualified insurance professional before making coverage decisions.