MALAYSIA should extend its personal data protection law to federal and state governments and strengthen safeguards against data breaches, rather than rely on banning individual applications, a civil society group said.
The group, Bersama, said the government’s immediate ban on Waze for civil servants had raised questions over the transparency of security decisions, the handling of location data and the absence of clear standards for applications used in official duties.
It said the Personal Data Protection Act 2010 did not cover federal and state governments, leaving a significant gap in the country’s data protection framework despite the risks posed by the handling of public information.
Bersama cited reported data leaks involving Maybank, Astro and the Election Commission in 2022 that allegedly affected nearly 13 million people, as well as the exposure of Telekom Malaysia customer data on the dark web in early 2024.
It also referred to CyberSecurity Malaysia’s mid-year 2023 threat landscape report, which found that the government sector accounted for 22 per cent of reported data leak incidents.
A total of 195 data breach incidents were reported in the first quarter of 2025, an increase of 29 per cent from the preceding quarter, it said.
The group also highlighted the financial impact of online crime, citing police figures showing that online fraud losses increased from RM1.57 billion in 2024 to RM2.97 billion in 2025, with another RM830 million lost in the first five months of this year.
The concerns follow the National Cyber Security Committee’s decision, chaired by the Prime Minister, on Oct 20 to prohibit civil servants from using Waze, citing the application’s alleged Israeli base.
The Chief Secretary to the Government issued a directive for immediate implementation across federal ministries, federal statutory bodies, state governments and local authorities. The government later cited data security concerns and recommended locally developed navigation application TuJu as an alternative.
Bersama said the authorities had not published a detailed technical assessment or clear implementation guidelines explaining the risks that prompted the ban.
It questioned whether the restriction applied to personal devices and use outside working hours, and whether frontline personnel, including police, ambulance crews and firefighters, had reliable alternatives for official duties.
The group also raised concerns about TuJu’s readiness after its operator reportedly acknowledged service disruptions a day after the government recommended the application.
It called for the government to disclose TuJu’s developer, public funding, procurement arrangements, security audits and safeguards governing access to users’ location data.
Among its proposals were transparent and standardised cybersecurity guidelines for applications used on government devices, publication of the risk assessment behind the Waze ban, and a review of previous data breaches involving public agencies.
It also urged amendments to the Personal Data Protection Act to cover federal and state governments, with corrective measures and accountability outcomes made public.
“Data security should not be a temporary political gimmick, but an ongoing, transparent and standards-based component of national governance,” it said. - October 23, 2026
