Deputy Prime Minister Datuk Seri Dr Ahmad Zahid Hamidi said the Bill provides for extraterritorial application where offences involve computer systems, programmes or data located in Malaysia, systems connected to Malaysia, or cases where Malaysian citizens are victims.
PETALING JAYA: The Cybercrime Bill 2026 will apply to offences involving Malaysian victims even when cybercrime cases cross international borders, the Dewan Rakyat was told today.
Deputy Prime Minister Datuk Seri Dr Ahmad Zahid Hamidi said the Bill provides for extraterritorial application where offences involve computer systems, programmes or data located in Malaysia, systems connected to Malaysia, or cases where Malaysian citizens are victims.
He said the legislation was necessary as cybercrime threats have evolved beyond basic hacking and data theft into more complex and borderless offences.
“Cybercrime threats today do not only involve intrusion into computer systems and data theft.
“They also include online fraud, telecommunications fraud, e-commerce crime, exploitation and sexual abuse material, ransomware attacks and the misuse of technologies such as artificial intelligence and the Internet of Things for criminal purposes,” he said when tabling the Bill for second reading.
Zahid said the rising prevalence of cybercrime posed threats to national confidentiality, personal data security and critical information infrastructure, while also exposing gaps in the existing legal framework.
“There is an urgent need to formulate a comprehensive cybercrime law to address cybercrime more effectively, in line with the increasingly complex and sophisticated cyber security threat landscape,” he said.
He added that the Bill would replace the Computer Crimes Act 1997 and align Malaysia’s legal framework with international obligations under the Budapest Convention and the United Nations Convention against Cybercrime.
Zahid said the legislation is based on the principle of technology neutrality, allowing enforcement to adapt to evolving digital technologies.
He said it would be jointly enforced by the Royal Malaysia Police, the Malaysian Communications and Multimedia Commission and the National Cyber Security Agency under the National Security Council in the Prime Minister’s Department.
The Bill also covers offences involving MyDigital ID, deepfakes, online fraud, ransomware, identity theft and the distribution of intimate images.
On MyDigital ID, he said the Bill criminalises offences such as password disclosure and the unlawful acquisition, storage, supply or transmission of another person’s authentication credentials linked to national digital identity systems.
“These provisions will protect a person’s digital identity information from being obtained, stored, supplied or transmitted to another party without lawful justification, especially for criminal purposes,” he said.
On deepfakes, Zahid said the law will address digitally generated or manipulated content used to facilitate offences under existing laws.
He also said current legislation is insufficient to address the widespread dissemination of intimate images, including those originally captured with consent but later shared without permission.
Zahid said the Bill followed 43 engagement sessions conducted by NACSA since September 2023 involving stakeholders such as the Bar Council, Malaysian Media Council, Malaysia Crime Prevention Foundation and civil society groups.
He added that the Bill comprises eight parts and 61 clauses aimed at strengthening Malaysia’s ability to combat evolving cybercrime threats.
