Malaysia’s Dewan Rakyat has passed the Cyber Crime Bill 2026, introducing new offences and penalties targeting digital crimes, including deepfakes and the creation or distribution of AI-generated intimate images.
The Bill, which contains 61 clauses, was approved by a majority voice vote after being debated by 48 Members of Parliament from both the government and opposition.
Deputy Prime Minister Datuk Seri Dr Ahmad Zahid Hamidi said the new law does not grant unlimited powers to enforcement agencies or override existing legislation, including the Official Secrets Act 1972. Instead, he stressed that it remains subject to strict legal procedures and checks and balances to safeguard the privacy and rights of the public.
He explained that authorities would not be allowed to access computer systems or digital data arbitrarily. Investigators may only issue data preservation notices if they are satisfied that the information is necessary for an investigation and there is a reasonable risk that the data could be altered, deleted or destroyed if immediate action is not taken.
Ahmad Zahid also said computer data can only be requested through a written notice issued to the individual or organisation that owns or controls the information, and only when it is required for a lawful investigation.
Responding to concerns that the legislation could restrict freedom of speech, he said the Bill is focused on tackling cybercrime rather than limiting public expression.
He also clarified that content created using artificial intelligence is not automatically considered illegal. Prosecutors must still prove criminal intent, the purpose behind the content and the harm caused before any offence can be established.
To strengthen the country’s cyber capabilities, Ahmad Zahid announced that the government established the Cybersecurity and Cryptology Development Centre on 3 June, combining CyberSecurity Malaysia and the Malaysian Cryptology Technology and Management Centre under the National Cyber Security Agency (NACSA). The centre will enhance expertise in areas including AI forensics.
The Deputy Prime Minister said the government remains concerned that vulnerable groups are increasingly being targeted through online financial scams, sexual exploitation, the non-consensual distribution of intimate images and digital content manipulation. He said the new legislation introduces several offences that were previously not clearly addressed under existing laws, providing stronger protection for victims.
He added that the government will continue strengthening cooperation with the Malaysian Communications and Multimedia Commission (MCMC), digital platform providers and international partners to speed up the removal of illegal online content. Authorities also plan to improve real-time information sharing through the National Scam Response Centre (NSRC).
Under the new framework, the Royal Malaysia Police (PDRM) will remain the lead enforcement agency, with the Commercial Crime Investigation Department spearheading investigations. NACSA will coordinate strategic efforts alongside MCMC, Bank Negara Malaysia and other technical agencies.
During the debate, several MPs proposed further refinements to the Bill, including clearer provisions on data access powers, the seizure of electronic devices and a more precise definition of AI-generated content to prevent satire, artistic works and political criticism from being misinterpreted as criminal offences.
Lawmakers also suggested including representatives from Sabah and Sarawak in the National Cyber Crime Committee, as well as introducing faster mechanisms to remove deepfake pornography and manipulated intimate images to better protect victims’ privacy.
