Dewan Rakyat Passes Cybercrimes Bill 2026, Targeting Deepfakes

In brief: On 1 July 2026, the Dewan Rakyat passed the Cybercrimes Bill 2026 by majority voice vote, following debate involving 48 government and opposition MPs. The Bill establishes a comprehensive 61-clause framework of cybercrime offences and penalties, with a strong emphasis on deepfakes and the non-consensual creation or distribution of digitally manipulated intimate images.

This article concerns Malaysian technology and criminal law.

What does the Bill target?

The legislation responds to a fast-moving threat. Increasingly accessible AI image and video generation tools have made it possible for bad actors to fabricate convincing but entirely fake intimate imagery of real people without their consent — a form of abuse that existing Malaysian laws, largely drafted before such technology existed, were not well equipped to address directly. By creating specific offences for this conduct, the Bill gives prosecutors and victims a clearer legal basis to pursue cases that might previously have required awkward reliance on more general provisions on obscenity, defamation or harassment, none of which were designed with synthetic media in mind.

How wide is its scope?

Beyond deepfakes, the Bill's broader 61-clause scope suggests it addresses a wider range of cybercrime offences — positioning Malaysia to update its digital-era criminal law more comprehensively, rather than through piecemeal amendments to older statutes.

What does it mean for businesses and law firms?

For firms advising on technology, media and reputation matters, the Bill creates fresh causes of action and defence considerations that will need to be built into client advice — particularly for businesses operating in social media, content hosting, or any platform where user-generated content involving real people's likenesses could become a vector for deepfake abuse. The Bill will also intersect with existing data protection and online safety frameworks, meaning platforms may face overlapping compliance obligations that will need careful mapping once the Bill is gazetted into force.

What happens next?

The Bill has since been passed by the Dewan Negara (Senate) on 20 July 2026. The next milestones to watch are royal assent and the effective date once the Bill is gazetted into force.

Frequently asked questions

What is a deepfake, in legal terms?

A deepfake is digitally manipulated or AI-generated media — an image, video or audio clip — that convincingly depicts a real person doing or saying something they did not. The Cybercrimes Bill 2026 focuses in particular on non-consensual, digitally manipulated intimate images.

Why does Malaysia need a specific deepfake law?

Because older laws on obscenity, defamation and harassment were written before this technology existed and do not fit synthetic media neatly. Specific offences give prosecutors and victims a clearer basis to act.

What should platforms and businesses do now?

Organisations that host user-generated content or use people's likenesses should begin mapping how the new offences interact with their existing data protection and online safety obligations, ready for when the Bill is gazetted into force.

Last updated: 14 August 2026.

This article is published by Khaw Ewe Seng & Co., Advocates & Solicitors (Penang) for general information about Malaysian law. It is not legal advice, and it does not create a solicitor–client relationship. For advice on a specific matter, please consult a qualified lawyer.