Malaysia has tabled the Cybercrime Bill 2026, which creates new offences relating to identity theft and the country’s National Digital Identity service as part of a broad overhaul of its cybercrime laws. The bill, given its first reading in the Dewan Rakyat, would repeal the Computer Crimes Act 1997 and expand the legal framework to cover digital fraud and content manipulated using artificial intelligence.
Identity sits among the bill’s core concerns. Its 61 clauses cover unauthorized access to computers, computer-related forgery and fraud, false communications, identity theft, the transmission of computer-generated or manipulated content, and offences relating to the National Digital Identity service. One clause specifically targets disclosing a National Digital Identity password or granting another party access while knowing, or having reason to believe, it will be used to commit or facilitate an offence, carrying a penalty of up to 100,000 ringgit, three years’ imprisonment, or both.
Deputy Prime Minister Ahmad Zahid Hamidi, who tabled the bill, said cybercrime now extends beyond system intrusions and data theft to identity theft, online fraud, ransomware, and the misuse of AI. He said the bill is intended to help Malaysia meet its obligations under the Budapest Convention on Cybercrime and the United Nations Convention Against Cybercrime, and that enforcement powers would sit with the National Cyber Security Agency under the National Security Council.
The bill carries a range of penalties scaling with severity, from fines for unauthorized access and data tampering to heavier sanctions for falsifying data tied to valuable security instruments and for disseminating intimate images. Its second and third readings are scheduled for July 1.
The identity provisions build on Malaysia’s national digital identity push, which has seen the government add facial biometric verification to MyDigital ID kiosks.
Sources: The Star
–
By Ji-seo Kim
