The Dewan Rakyat passes the Cybercrime Bill 2026, replacing the Computer Crimes Act 1997 with broader laws against modern cyber offences.
PETALING JAYA: The Dewan Rakyat has passed the Cybercrime Bill 2026, paving the way for Malaysia to replace the Computer Crimes Act 1997 with a broader law to tackle modern cyber offences.
The Bill was passed by voice vote after being debated by 48 MPs.
It covers offences involving online fraud, ransomware, identity theft, deepfakes, MyDigital ID abuse, unauthorised access, computer-related forgery and fraud, as well as offences involving critical national information infrastructure.
Under the Bill, those who share intimate images through a computer system can face up to five years’ imprisonment, a fine of up to RM300,000, or both.
The penalty increases to up to seven years’ imprisonment, a fine of up to RM500,000, or both, if the act is committed to humiliate, harm, coerce or threaten the person depicted.
The Bill also covers generated or manipulated visual or audio content, including deepfake-style material, if it falsely appears authentic and is used to commit or facilitate an offence.
Deputy Prime Minister Datuk Seri Dr Ahmad Zahid Hamidi said the Bill was meant to strengthen cybercrime enforcement, not restrict freedom of expression or differing views.
Winding up the debate, he said the powers under the Bill were not absolute.
“The government wishes to assure the House that none of the powers provided under this Bill are absolute or exercised without oversight,” he said.
“Maintaining an appropriate balance between effective law enforcement and the protection of fundamental rights has been a guiding principle in drafting this Bill.”
Zahid said access to computer systems or data would be limited to specific information relevant to investigations and subject to legal procedures.
He said the Bill should also be read together with existing laws protecting sensitive information, including the Official Secrets Act 1972, which safeguards classified government information from unauthorised disclosure.
On artificial intelligence, Zahid said AI-generated content would not be criminalised merely because it was produced using AI, and that prosecution would still require proof of criminal intent and wrongful conduct.
Police will remain the lead agency for criminal investigations, while the National Cyber Security Agency will act as the strategic coordinator.
