The Cybercrimes Bill 2026 (“Bill”) was passed by the Dewan Rakyat1 and the Dewan Negara in July 2026, without a single amendment,2 to repeal and replace the Computer Crimes Act 1997 (“CCA”).3
The Bill aims to address digital harms that have emerged in the nearly 30 years since the CCA was passed and introduces overdue protections against AI-generated deepfakes and synthetic deception,4 the non-consensual dissemination of intimate images,5 online scams, identity theft and computer-related fraud,6 and attacks on national critical information infrastructure such as power grids, water systems and emergency services.7 These are legitimate and overdue responses to real and growing digital harms.
As a signatory to the United Nations Convention against Cybercrime, Malaysia is required under Articles 6 and 24 to ensure that all cyber enforcement powers incorporate strict human rights safeguards, specifically independent judicial oversight, the principle of proportionality, and rights to an effective remedy. Malaysia has been invited to accede to the Council of Europe’s Convention on Cybercrime (“Budapest Convention”),8 of which Article 15 requires that such powers be subject to judicial or other independent supervision, defined grounds justifying their use and limits on their scope and duration, and that they incorporate the principle of proportionality.
Extreme Executive Overreach
The Bill appears to confer extraordinarily wide investigative and enforcement powers on the Executive with no express judicial oversight: officers may access computer systems and compel the production of passwords, encryption or decryption codes,9 intercept communications in real time with the Public Prosecutor’s authorisation,10 and exercise these powers well beyond the cybercrimes the Bill is meant to address,11 without express provisions for independent review, defined limits or any right of appeal. A person’s devices could be searched and communications intercepted without ever appearing before a judge — a fundamental failure of the checks and balances any democracy under the rule of law would impose on Executive power.
These powers extend to any public officer or Malaysian Communications and Multimedia Commission officer designated by the Minister,12 who may search premises and seize devices, with the possibility to do so without a warrant or court involvement,13 and issue secrecy bound preservation and disclosure notices that leave the recipient unable to disclose their existence,14 as long as the officer is “satisfied” that the data is “reasonably required”. Journalists’ sources and whistleblowers appear to be left just as exposed.
Investigative powers of this breadth, exercised on an officer’s own satisfaction without a warrant or any other statutory safeguard, pose serious risks to personal liberty and privacy, potentially infringing Article 5(1) of the Federal Constitution (“FC”). Such powers also create a real risk of random unbridled enforcement efforts and fishing expeditions being taken or attempted, which would be disproportionate and inconsistent with the guarantee of equal protection for all persons under Article 8(1) of the FC. The Clauses providing for this are therefore subject to challenge as being unconstitutional, and the purported actions of the authorities under those provisions would likewise be subject to challenge.
The Committee on Combating Cybercrimes overseeing enforcement is also stacked with government agencies and has no independent representation.15 Furthermore, the vague offences on manipulated content risk criminalising legitimate journalism, artistic expression, satire and political discourse,16 backed by severe penalties regardless of actual harm.17 This ambiguity risks infringing the constitutional guarantee of freedom of speech and expression under Article 10(1)(a) of the FC.
As there are no express safeguards, which Parliament should have built into the Bill itself, a person wrongly searched, intercepted or gagged by a secrecy notice would have to litigate their way to a remedy that the Bill ought to have guaranteed from the outset.
Malaysia deserves cybercrime legislation that is effective, proportionate and consistent with the rule of law, due process and the fundamental liberties guaranteed under the Federal Constitution. This Bill falls far short of expectations. The Bill does a disservice to the rule of law and is likely to attract legal challenges.
Anand Raj
President
Malaysian Bar
23 September 2026
1 “Dewan Rakyat Approves Cybercrimes Bill 2026”, Bernama, 1 July 2026.
2 “Dewan Negara passes Cybercrimes Bill 2026”, Free Malaysia Today, 20 July 2026.
3 Clause 61 of the Bill.
4 Clause 23 of the Bill.
5 Clause 24 of the Bill.
6 Clauses 17 and 22 of the Bill.
7 Clause 25 of the Bill.
8 “Antigua and Barbuda and Malaysia have been invited to accede to the Convention on Cybercrime”, Council of Europe Cybercrime, 24 September 2025.
9 Clause 36 of the Bill.
10 Clauses 40 and 41 of the Bill.
11 Clause 48 of the Bill. See also Clauses 36 – 41 of the Bill.
12 Clauses 26 and 27 of the Bill.
13 Clause 29 of the Bill.
14 Clauses 38 and 39 of the Bill.
15 Clause 4 of the Bill.
16 Clause 23 of the Bill.
17 Clauses 17, 25 and 59(b) of the Bill.