Malaysia

Summary

Malaysia presents moderate crawling risk under a civil-law-influenced common-law system with no EU baseline. The Computer Crimes Act 1997 (CCA) s.3 criminalises intentional unauthorised access; public pages carry implicit authorisation, but ToS prohibition or post-C&D scraping may negate it. The Personal Data Protection (Amendment) Act 2024 (Act A1727, in force in phases from 2025) substantially upgraded the PDPA 2010 — adding mandatory breach notification, DPO requirements, enhanced penalties (up to RM 1 million), data portability, and processor obligations. The Cyber Security Act 2024 (in force 26 August 2024) adds a national cybersecurity licensing and incident-reporting framework that may affect operators of large-scale crawl infrastructure. No TDM copyright exception exists in Malaysia (Copyright Act 1987 uses a closed fair-dealing list). No sui generis database right. The Communications and Multimedia Act 1998 s.233 is primarily a content/speech provision (not a scraping vehicle) and was partially struck down by the courts in 2025 as unconstitutional.