Domestic law and policy
The National Registration Act (1959) and its regulations provide the foundation for registering individuals and issuing identity cards.[31] The Electronic Government Activities Act (2007) promotes e-government including confidentiality and security of electronic records.[32] The Digital Signature Act (1997) governs digital transactions and contracts.[33] To safeguard data privacy and security, MyDigital ID must adhere to the Cybersecurity Act (2024), and Official Secret Act (1972).[34] The Cybersecurity Act (2024) addresses the management of cybersecurity threats in Malaysia, and the Official Secrets Act (1972) safeguards sensitive government information, including personal data, to protect national security and public interest.[35]
The MyDigital ID Helpdesk provides an avenue for individuals who experience problems with digital identity–based access to services to file complaints through the general feedback system.[36] Additionally, the complaint mechanisms of agencies that have integrated their platforms with MyDigital ID, such as ministerial portals or the Malaysian Communications and Multimedia Commission’s online consumer redress portal for telecommunications-related issues and data protection complaints to the Personal Data Protection Commissioner.[37] However, current publicly available information does not indicate the existence of a specialized, statutory dispute-resolution body or appeal process specifically for MyDigital ID registration refusals, account suspension, or authentication errors.
Data Protection
The Personal Data Protection Act (2010) (referred to hereafter as PDPA) regulates the processing of personal data in the private sector, requiring that personal data is processed fairly, kept accurate and up to date, and protected by appropriate security measures.[38] The PDPA has been substantially amended in 2024 to introduce new obligations such as mandatory data protection officers for certain data users, 72-hour breach notification, data portability, and enhanced rules for cross-border transfers.[39] However, the PDPA applies only to ‘commercial transactions’ and Section 3(1) expressly excludes the Federal and State Governments from its scope, which means that core government-run systems, including the national digital ID infrastructure, generally fall outside the PDPA’s direct scope.[40]
As a result of the government exemption in the law, the PDPA does not directly govern the design or operation of the MyDigital ID system.[41] Nevertheless, under the PDPA framework, private-sector controllers and processors that handle personal data in connection with digital ID–enabled services must still ensure that data is processed for specific purposes, is accurate and up to date, and is protected through appropriate technical and organizational measures, including access controls, secure storage, and safeguards for data.[42] The 2024 amendments also require such entities to designate data protection officers, implement formal breach-response processes with 72-hour notification to regulators, and conduct transfer impact assessments when sending biometric or other sensitive data abroad, thereby indirectly influencing the broader digital ID ecosystem.[43]
To address governance of public-sector data, Malaysia has introduced the Data Sharing Act (2025) (DSA), which applies to public sector agencies and regulates how data is shared between them.[44] Section 12 of the DSA provides that a public sector agency may only request data from another agency for specified purposes and that such a request is subject to an evaluation process before sharing can occur, thereby creating a formal gatekeeping mechanism for inter-agency exchange.[45] Once data is shared, the DSA imposes obligations on both the requesting and receiving agencies, including duties relating to data security, record-keeping, reporting particulars of data sharing, and preventing unauthorized onward sharing, which in principle should constrain how identity-related data can circulate within government.[46] These requirements appear consistent with public statements that MyDigital ID encrypts all data while in transit (while it is being transmitted between private networks or through the internet) and processes user data only temporarily during authentication, aligning operational design with statutory duties to ensure secure handling and controlled sharing of public-sector information.[47] Taken together, PDPA obligations on private actors and DSA obligations on public agencies create a hybrid governance landscape for digital ID–related data, even though a comprehensive, unified public-sector data protection regime remains absent.
According to official MyDigital ID documentation and statements from the Malaysian government, the MyDigital ID system does not automatically store biometric data such as fingerprints or facial recognition templates on its own servers.[48] Instead, the system functions as an authentication layer that verifies a user’s identity for government services by matching biometric data and MyKad information against pre-existing records held by the National Registration Department (NRD), without retaining this biometric or personal data in the MyDigital ID infrastructure after the transaction.[49]
However, it should be noted that the government has experienced major data security failures in the past. In December 2022, a data breach compromised the personal information of nearly 13 million citizens.[50] Government-linked databases have experienced repeated leaks, creating widespread public skepticism about the security of centralized digital identity infrastructure.[51] Human rights organizations and UN bodies have also documented broader patterns of arbitrary detention, abusive conditions, and deportations affecting undocumented persons in Malaysia, including refugees, asylum seekers, stateless persons, and migrant workers with irregular status.[52] For instance, the creation of a separate government-run Refugee Registration Document (DPP) system that collects extensive biometric data for “monitoring” purposes is outside the PDPA framework.[53]
International Commitments
Malaysia is not a signatory to any specific international treaty or framework dedicated solely to digital IDs. The ASEAN Framework on Personal Data Protection is a non-binding regional instrument that aims to harmonize data protection standards across Southeast Asia.[54] Malaysia participates in the Asia-Pacific Economic Cooperation’s Cross-Border Privacy Rules (APEC CBPR) System.[55] The APEC CBPR is a certification mechanism, not a treaty, that verifies compliance with data protection standards for cross-border data transfers.[56] It is engaged in the ASEAN Digital Economy Framework Agreement (DEFA), which covers digital identity alongside data protection and cybersecurity.[57]
Malaysia has ratified CEDAW (1995 with Article 9(2) reservation), CRC (1995 with Articles 2 and 7 reservations), and CRPD (2010 with Articles 15 and 18 reservations).[58] However, Malaysia has not ratified the Statelessness Conventions, Refugee Convention, ICCPR, ICESCR, or ICERD.[59] The 2024 CEDAW Committee highlighted risks of statelessness arising from discriminatory nationality laws, including provisions affecting children born out of wedlock to Malaysian fathers. It also highlighted the restrictions on Malaysian women’s ability to pass down citizenship in certain circumstances.[60] The Universal Periodic Review 2024 urged Malaysia to resolve the issue of statelessness create systems that recognize refugee document.[61]
The country has also pledged in 2025 to the Ministerial Declaration on a Decade of Action for Inclusive and Resilient Civil Registration and Vital Statistics in Asia and the Pacific where countries committed to ensure that every birth is registered by 2030 and to close registration gaps among marginalized populations.[62] The Declaration highlights the barriers faced by stateless persons in accessing civil registration services and pledges to ‘develop and implement measures to avoid the potential exclusion of digitally marginalized or vulnerable populations from statistical data and facilitate their access to services and entitlements’.[63]