The Malaysian Bar has raised concerns over the extensive investigative and enforcement powers granted under the Cybercrimes Bill 2026, warning that the absence of express judicial oversight and independent safeguards could expose individuals and businesses to intrusive investigations.
In a statement today, Malaysian Bar president Anand Raj acknowledged the need to modernise Malaysia’s cybercrime legislation but said the new framework must balance effective enforcement with constitutional rights, privacy and due process
The Bill, passed by the Dewan Rakyat and Dewan Negara in July without amendments, seeks to repeal and replace the Computer Crimes Act 1997.
It introduces provisions addressing emerging digital threats, including AI-generated deepfakes, identity theft, online scams, computer-related fraud, the non-consensual dissemination of intimate images and attacks on national critical information infrastructure.
The Malaysian Bar said the Bill appears to grant enforcement officers broad powers to access computer systems, compel the disclosure of passwords and encryption codes, and intercept communications in real time with authorisation from the Public Prosecutor.
It expressed concern that certain powers could be exercised without a court warrant or express independent judicial review.
The statement also highlighted provisions allowing designated public officers and Malaysian Communications and Multimedia Commission personnel to conduct investigations and issue preservation or disclosure notices.
According to the Bar, these provisions could expose individuals to searches, surveillance and compulsory disclosure without sufficient statutory safeguards.
It warned that the powers could also affect journalists and whistleblowers, particularly where secrecy requirements prevent recipients from disclosing that they have received information requests.
While welcoming stronger protections against AI-generated deception and other digital offences, the Malaysian Bar cautioned that broadly worded provisions concerning manipulated content could create uncertainty for journalists, artists and other content creators.
The Bar argued that insufficiently defined offences could expose legitimate reporting, satire and political commentary to criminal investigation.
It said aspects of the Bill could face constitutional challenges involving personal liberty, equality before the law and freedom of speech under Articles 5, 8 and 10 of the Federal Constitution.
The Bar also questioned the composition of the Committee on Combating Cybercrimes, saying its government-heavy membership lacks independent representation.
During the Bill’s passage in the Dewan Rakyat on July 1, Deputy Prime Minister Datuk Seri Ahmad Zahid Hamidi said the legislation did not grant absolute powers to enforcement authorities.
He maintained that access to computer systems and data would remain subject to legal procedures and checks and balances intended to protect fundamental rights and privacy.
The Malaysian Bar, however, said safeguards should be expressly incorporated into the legislation rather than leaving individuals who believe their rights have been violated to seek remedies through litigation.
Anand also highlighted Malaysia’s international cybercrime commitments, urging greater alignment with principles of proportionality, independent supervision and effective remedies.
The Bar warned that the legislation could attract legal challenges if its enforcement provisions are not accompanied by clearer limits and accountability mechanisms.
