[Feature Article] The Star: AI governance law must possess statutory teeth

Securing Malaysia’s digital sovereignty against autonomous AI

by Thulasy Suppiah, Managing Partner

THE recent revelation that an OpenAI agent breached an Australian government health portal while performing a research task represents a chilling escalation in global cybersecurity. We are no longer defending against human hackers or static code; we are facing autonomous, goal-oriented algorithms capable of bypassing systemic firewalls without direct human intervention.

For Malaysia, this warning arrives at a precarious juncture. Our rapid national digitisation, centralising citizens’ sensitive data into systems like MyDigitalID and PADU, creates an increasingly valuable honeypot of sovereign data. Yet, under Section 3(1) of the Personal Data Protection Act (PDPA) 2010, the Act does not apply to the Federal and State Governments. In an era where foreign AI agents can independently breach external systems, this legislative blind spot creates a distinct public-sector accountability gap.

When an autonomous AI breaches a sovereign system, the immediate legal question is accountability. Major developers frequently describe such incidents as actions their models “did not intend.” We must not allow technical autonomy to become a shield for corporate liability.

While Singapore has commendably initiated multilateral dialogues urging tech giants to commit to transparency, relying on voluntary corporate goodwill is insufficient. As Australia discovered, voluntary disclosure can result in catastrophic delays; OpenAI took nearly three months to notify the Australian government. In a landscape where AI operates in milliseconds, delayed reporting is a severe governance failure.

Fortunately, Malaysia is currently shaping its regulatory future through the proposed AI Governance Bill. This is our opportunity to codify robust legal safeguards.

Specifically, the Bill’s proposed “AI Incident Reporting” framework must possess statutory teeth. Taking cues from the European Union’s AI Act, Malaysia should mandate strict reporting deadlines for serious incidents involving high-risk AI systems—generally within 15 days, shortened to two days for certain particularly serious cases and 10 days where a death is involved—backed by meaningful financial penalties for delayed disclosure.

Furthermore, Principle 3 of the proposed framework must be strictly enforced. The law must unequivocally establish that legal responsibility cannot be displaced onto the AI system itself. Accountability must remain traceable to the developer or deployer who exercised control over the system.

Holding foreign developers accountable is only half the equation. Our domestic defence posture must radically evolve. Government agencies and National Critical Information Infrastructure (NCII) operators can no longer rely on legacy perimeter security. Our institutional infrastructure must be hardened to detect and isolate the probing and bypass attempts such agents can generate in real time.

By strengthening public-sector data accountability, enforcing rapid incident reporting and ensuring responsibility remains traceable to those who control AI systems, Malaysia can ensure our digital borders remain secure in an autonomous future.

Written By: 
Thulasy Suppiah
Lawyer focusing on AI, Data Centers & Cybersecurity
Managing Partner @ Suppiah & Partners
UG-13, Lexa Galleria, 45, Jalan 34/26, 
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238

 

© 2026 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Featured Articles

How Generative Ai Is Driving Financial Markets In 2026 And Beyond – Navigating The Friction Between Algorithms And Intuition In The Financial Sector

Maturing With Sophistication and Speed: Malaysia's Intellectual Property Landscape

Navigating The Friction Between Algorithms And Intuition In The Financial Sector

By Thulasy Suppiah, Managing Partner of Suppiah & Partners

Despite significant momentum in other fields, the adoption of Generative AI (GenAI) in financial services was somewhat slow and cautious. This restraint is hardly surprising. Financial market activity is one of the most heavily regulated sectors in the global economy. In line with their fiduciary duties, financial service providers have the legal responsibility to act in the best interest of financial customers, which also means protecting them from risks of deceptive outputs, misinformation or other risks related to GenAI tools. As a result, full end-to-end automation without human oversight is still at the development phase, with financial institutions promising to keep a firm human in the loop to navigate compliance and systemic risks.

THE TENSION BETWEEN STRICT FINANCIAL REGULATION AND THE DEPLOYMENT OF GENAI

According to the Generative artificial intelligence in finance, OECD Artificial Intelligence Papers, No. 9, data privacy challenges are exacerbated in GenAI models. GenAI models learn by hoovering up massive amounts of random internet data rather than neatly sorted files, which creates big privacy and ownership problems. These models swallow everything at once and often use copyrighted books, private personal details and artwork without appropriate permission from the original creators. This means personal or IP-protected information is compromised, and there’s difficulty to distinguish if the requested information from the AI is authentic, stolen or completely made up.

Financial institutions have resolved these challenges by avoiding public models entirely. Instead, they deploy private and highly constrained architectures inside isolated enterprise clouds. These setups use zero-data-retention agreements alongside automatic redacting of Personally Identifiable Information (PII). Through Retrieval-Augmented Generation (RAG), firms ground model responses strictly in verified internal document databases. This significantly reduces hallucinations and compliance risks. Furthermore, institutions restrict GenAI to internal support tasks like text summarisation, research drafting and code development. GenAI cannot take autonomous customer actions and remains subject to strict human oversight.

With these safeguards in place, AI has been more surely adopted across the entire financial system to make operations faster, safer and more efficient. Banks and stock markets use AI to pick investments, trade shares in milliseconds, evaluate loan applications and instantly spot fraud or money laundering. Newer tools like GenAI boost these capabilities even further by writing computer code, drafting marketing content and answering customer support queries automatically.

IMPROVED SERVICES

Today, operational optimisation is one of the most widely reported use case of AI in finance. AI replaces repetitive tasks like Profit and Loss (P&L) reconciliations with fast, accurate automation. GenAI acts as an intelligent search engine to simplify internal data analysis, summarise contracts and streamline Human Resource processes. On the front end, it personalises client communication, tailors marketing campaigns and boosts customer support.

AI can assist financial service providers to interact with customers in an indirect way, by preparing portfolio allocation recommendations tailored to the customer’s profile.

However, a more direct involvement with the customer, for example allowing the model to directly recommend or even automatically execute suggested recommendations is considered too risky, as it takes away the human parameter.

PERSONALISED CUSTOMER BOTS

When AI is allowed to interact with customers directly, it is usually in the form of chat bots. The true magic of GenAI at this front line of finance is that it can create conversations so natural and contextual that the idea of a machine being involved vanishes entirely.

While primitive chatbots have bumped along since ELIZA in 1966, modern GenAI transforms these clunky scripts into hyper-personalised financial advisers. Klarna – a Swedish financial technology (fintech) company founded in Stockholm in 2005 (best known globally as a pioneer of the Buy Now, Pay Later (BNPL) payment model), stands out as a prime example of this shift. By deploying an AI assistant powered by OpenAI, Klarna handled two-thirds of its customer service chats (over 2.3 million conversations) in its first month alone. The bot managed tasks ranging from refund requests to dispute resolution, doing the work of 700 full-time agents while driving a 20 percent boost in customer satisfaction.

SUPPORT FOR FRONTLINE EMPLOYEES AND FINANCIAL ASSISTANTS

Traditional robo-advisors rely on rigid, rule-based algorithms that group clients into broad categories based on basic risk questionnaires. GenAI transforms this approach by dynamically evaluating a client’s entire financial life, including market history, personal goals, tax situations and spending habits. Then it delivers hyper-customised advice through natural, conversational interactions.

Morgan Stanley serves as a prime example of an institution executing this effectively.

In 2024, Morgan Stanley deployed AI @ Morgan Stanley Debrief – an OpenAI-powered tool which, with client consent, generates notes on the financial advisors’ behalf in client meetings and later outputs action items.

After the meeting, it summarises key points, creates an email for an advisor to edit and send at their discretion, and saves a note into Salesforce (the world’s leading cloud-based Customer Relationship Management platform, where businesses store, manage and track every interaction with their customers).

It also acts as an internal generative assistant that synthesises the bank’s entire repository of proprietary research, market insights and investment strategies. Rather than replacing human advisors, the tool acts as a co pilot, enabling advisors to instantly generate highly tailored investment strategies and personalised summaries for individual clients in seconds. This hybrid model delivers the speed and hyper- segmentation of automated advice, combined with the nuanced, conversational delivery expected from a high-touch wealth manager.

FRAUD PREVENTION

Visa has agreed to acquire fraud intelligence provider BioCatch for USD 2.4 billion (RM 9.76 billion) to strengthen its cybersecurity portfolio as AI increases the sophistication of financial scams. The purchase targets global account takeovers and fraudulent schemes that cost the world economy more than USD 1 trillion (MYR 4.07 trillion) annually.

Andrew Torre, President of Value-Added Services at Visa, highlights that AI now enables these attacks at an unprecedented scale. He notes that integrating BioCatch will allow Visa clients to detect and stop fraudulent activity well before it reaches the final point of payment.

Mastercard’s Decision Intelligence Pro solution, trained on billions of annual transactions, evaluates payment legitimacy in under 50 milliseconds. This real-time analysis boosts fraud detection rates by up to 20 per cent while sharply reducing false declines, and protects payment ecosystems without disrupting genuine transactions.

Meanwhile, HSBC plans to use GenAI in combination with agentic AI to strengthen financial crime and risk management. This dual approach involves building new architecture within the financial crime function to identify risks earlier, helping to prevent harm while also delivering a more seamless customer experience. When risks are flagged, HSBC expects response times to improve significantly, with the ability to intervene twice as quickly across the nearly one billion transactions the bank monitors for financial crime each month.

Machine learning algorithms in GenAI can continuously analyse transaction data to spot unusual spending spikes or unexpected location changes in real time.

Beyond fraud, AI streamlines customer onboarding by automating Know Your Customer (KYC) and Anti-Money Laundering (AML) checks against sanction lists. GenAI builds on this and automatically drafts Suspicious Activity Reports (SARs) and audit logs directly from internal database flags, which significantly cuts manual labour.

PROFIT CAPTURE

GenAI is helping investors work faster and make smarter bets. Instead of humans spending days reading hundreds of long company reports, news articles and financial rules, the AI scans them in seconds to find hidden bargains and create sales presentations.

Bloomberg leads this space with its own specialised AI model, BloombergGPT, and a smart assistant on its computer screens called Ask Bloomberg (ASKB). Traders can simply type questions to search global markets, run complex calculations and spot money-making opportunities instantly. As a result, investment banks close deals faster, manage client money better and squeeze far more profit out of the market.

Bloomberg’s dominant market position (where it holds around a third of the financial information of the entire global market) stems directly from a proprietary data archive built over four decades, complemented by several critical structural advantages. The firm trained BloombergGPT on FinPile, an exclusive 363-billion-token dataset of curated financial documents. This proprietary archive gives its models access to decades of US Securities and Exchange Commission (SEC) filings, financial news, press releases and research that standard models cannot reach behind paywalls. Beyond static content, Bloomberg streams live pricing, order book data and real-time market sentiment directly into its AI systems, allowing models to evaluate live market moves rather than outdated information. To overcome noisy financial inputs, thousands of internal data analysts clean, normalise and tag incoming data, boosting accuracy and drastically lowering hallucination rates.

Over 300,000 financial professionals already use the Bloomberg terminal daily.

TRADING

In trading, AI can reduce frictions and create efficiencies, increasing also the speed of trading. In electronic markets, AI-powered algorithms act like ultra-fast automated traders that buy and sell assets without human intervention. Instead of sticking to rigid rules, these algorithms learn from real-time market data to automatically adjust order sizes, execution times and trade locations, ensuring massive trades do not cause sudden price surges or market crashes. They can even predict how rival traders will move and react in milliseconds. However, because these systems learn from the same market cues, they risk accidentally aligning their behaviours and engaging in unintended market collusion.

 

J.P. Morgan demonstrates this through its DNA (Deep Neural Network for Algo Execution) system. This DNA uses reinforcement learning to continually scan liquidity across global currency and stock markets. It dynamically breaks up massive institutional orders and executes them in tiny fractions across the best available channels, getting clients the best possible prices without disrupting the wider market. For instance, if a pension fund needs to buy £100 million (RM 547,377,700) in foreign currency, dumping that order at once spikes the price. DNA uses reinforcement learning to slice the order into small pieces and route them quietly across different market venues. The DNA helps a single bank execute trades at the best price with minimal market disruption.

PRODUCT RECOMMENDATION

Klarna, the Swedish digital bank, lets shoppers buy items online or in-store and pay for them later in instalments. In 2024, the company launched an AI shopping assistant that works like an interactive chat. The tool gives shoppers personal product suggestions, compares different brands and highlights verified customer reviews. By providing clear expert advice directly in the app, it helps users quickly find the best products at the right price.

AI product recommendations help online stores boost sales while giving shoppers a better experience. By suggesting items tailored to each person’s taste, AI encourages customers to buy more and build bigger shopping carts. These smart suggestions save shoppers time by quickly showing them products they actually want. Happy customers are much more likely to return and buy from the same store again. Behind the scenes, the AI tracks buying patterns to help businesses stock the right amount of inventory, preventing empty shelves or wasted extra stock.

These AI-driven recommendations continuously learn and refine their suggestions, becoming more accurate over time.

CODE GENERATION

Software development is another high-impact area for GenAI in financial services, as modern banks function as much like software companies as financial institutions. GenAI acts as an intelligent coding copilot, generating new code, fixing syntax errors, running automated tests and modernising legacy infrastructure with minimal downside risk.

Goldman Sachs leads this space with its firm-wide GS AI Assistant. Deployed directly into developer workspaces, the tool acts as an in-house coding assistant for thousands of software engineers. It speeds up software creation, automates line-by-line debugging and translates old code into modern programming languages, helping the firm deliver new trading platforms and consumer tools much faster. This use case is rather underdiscussed, despite its enormous practical potential and the relatively limited downside risks.

WEALTH MANAGEMENT

Lloyds Banking Group is using GenAI to democratise wealth management across its vast customer base. Chief Data and Analytics Officer Ranil Boteju envisions bringing elite, private-banker-style financial guidance to millions of everyday account holders. By deploying AI assistants that continuously evaluate live transaction histories, cash reserves and risk tolerances, the system generates real-time, tailored nudge, such as proactive savings alerts, budget optimisations and personalised investment options directly within the mobile app. This automated approach turns complex personal finance into accessible, bite-sized recommendations, effectively closing the advice gap for everyday consumers.

Traditionally, dedicated financial planners and custom investment strategies are only available to wealthy individuals with significant assets. By using GenAI, Lloyds automates data analysis across millions of retail accounts, giving ordinary high street customers personalised budgeting, saving advice and risk profiling at no extra cost.

CONCLUSION

GenAI is transforming financial markets. Many would have us believe it is not replacing human professionals, but is only removing operational friction to enable industry participants to make smarter, faster decisions. Indeed, smart technologies are drastically cutting the time needed for administrative tasks, client preparation, and regulatory research from hours to minutes.

However, a paper from the Annals of Faculty of Economics, from University of Oradea, From Intuition to Algorithms: The Transformation of Decision-Making through Intelligent Data Technologies, shows that AI and data-driven technologies are more than supporting decision-making. The field appears to be in a phase of accelerated development, where AI, data analytics, and decision-making processes are becoming increasingly interconnected. These dynamics highlight a clear shift from decision-making based solely on intuition to a digital transformation of management practices.

When algorithms filter massive datasets, surface specific patterns, and present pre-packaged recommendations, they inevitably shape the final choice. Even with a human strictly in the loop, the algorithm subtly guides the outcome by deciding what data gets prioritised and what gets left out. In practice, the boundary between supporting a decision and driving it becomes remarkably thin.

Look out for Part 2 of this article next month where we explore deeper concerns about how algorithms accelerate the market, and whether human judgment can remain strictly at the core.

© 2026 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Newsletter

[Feature Article] MalaysiaKini: Esha Clause – Why Punishment Alone Cannot Protect Children

Esha Clause - Why Punishment Alone Cannot Protect Children

by Thulasy Suppiah, Managing Partner

MALAYSIA has recently undergone a significant shift in its legal approach to bullying and cyberbullying, driven largely by public outrage over tragic losses of life. The most notable result is Section 507D(2) of the Penal Code—widely dubbed the “Esha Clause.”

This provision criminalises threatening, abusive or insulting conduct intended to provoke a person to harm themselves or another person, or that the perpetrator knew or ought to have known was likely to do so. If that provocation results in a suicide attempt or death by suicide, the maximum prison sentence rises to ten years.

Having this law on the books sends a strong moral message. However, the public must understand the harsh legal reality: a severe penalty does not guarantee an easy conviction, nor does it act as an immediate shield for victims.

In a criminal court, proving that bullying took place may only be half the battle. The ongoing investigation into the tragic death of 14-year-old Keziah Nisha may become an important test of this clause. 

While police are presently investigating the case under Section 507B, the investigation remains active and no final charging decision has been announced. It would therefore be premature to conclude that Section 507D (2) has been ruled out.

Nevertheless, the case highlights the immense difficulty at the heart of the Esha Clause. Prosecutors must prove not merely that the conduct was cruel or distressing, but that the accused intended to provoke self-harm or knew or ought to have known that the conduct was likely to do so. Where suicide followed, they must also prove that it occurred as a result of that provocation. Human distress rarely has a single, tidy cause. Where mental health, accumulated incidents, and other pressures overlap, establishing that connection beyond a reasonable doubt becomes a monumental hurdle.

But there is a deeper limitation to the Esha Clause. It is fundamentally an after-the-fact tool. It can hold a perpetrator accountable after threatening or abusive conduct has occurred, but it cannot by itself provide the immediate protection a vulnerable person may urgently need.

Criminal law can punish and deter, but it cannot substitute for protecting a victim in real time. Although the Esha Clause applies regardless of the victim’s age, its limitations are especially serious when children are involved. Children depend heavily on parents, teachers and school administrators to recognise the danger and intervene before bullying escalates into self-harm.

True protection therefore depends on what happens during the critical hours and days after a child first reports bullying or shows signs of distress. Yet Malaysia has moved from fragmented legal protections to an increasingly crowded anti-bullying framework. Beyond the Penal Code, we now have the Online Safety Act and the Anti-Bullying Act 2026, which established the Tribunal for Anti-Bullying.

While these measures serve different purposes, making sense of them in the midst of a crisis can be daunting. Teachers and school administrators must currently navigate the 2023 bullying guidelines, the sweeping 402-page 2026 Safe School Management Guidelines, the separate Student Protection Policy, the SAFE framework, and procedural reporting timelines such as SOP 1:3:7.

Having multiple laws and thick policy documents is not the same as having a cohesive safety net. When a child is facing severe psychological distress, a terrified parent or an overwhelmed teacher does not have time to solve an administrative puzzle. They need a single, unambiguous “no-wrong-door” emergency triage protocol. This must include an immediate suicide risk assessment, interim protection, and a designated response coordinator.

The Esha Clause is necessary, but it is not a safety net. The true measure of our national anti-bullying framework should not be how severely we can punish a perpetrator after the fact, but whether we can protect a victim in time. If a child facing bullying has attempted suicide or is already gone, our frontline intervention system has failed to reach that child in time. To truly honour Esha and the other victims who inspired these reforms, early intervention must become our first and most urgent line of defence.

Written By:

Thulasy Suppiah,
Managing Partner,
Suppiah & Partners,

UG-13, Lexa Galleria, 45, Jalan 34/26,
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238

© 2026 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Featured Articles

[Feature Article] The Star: When the Cloud is Threatened by Drought

When the Cloud is Threatened by Drought

by Thulasy Suppiah, Managing Partner

THE devastating flood in Tibet and Nepal has once again drawn attention to the growing environ-mental risks facing fragile moun-tain regions in a warming world.

Closer to home, Malaysia faces a different climate challenge. As the country grapples with a strengthening El Nino, SPAN (National Water Services Commission) recently reported that nine of 49 major dams sup-plying raw water in Peninsular Malaysia and Labuan were at warning levels, two on alert and one critical.

El Nino is a naturally occurring climate phenomenon, but it is unfolding in a world warmed by human activity. Forecasts point to a very strong event extending into 2027, and Malaysian authori-ties have warned of pressure on domestic water supply, agricul ture and industrial activity.

Against this backdrop, Malaysia is rapidly expanding its data centre footprint. Globally, data centres accounted for about 1.5% of electricity consumption in 2024, with the International Energy Agency (IEA) projecting demand to more than double by 2030.

The concern is not only the pace of growth but its concentra-tion in hubs such as Malaysia, too. The question is whether our resource planning can keep pace.

To its credit, the government has begun to respond. The Investment, Trade and Industry Ministry’s Guidelines for Sustainable Development of Data Centres encourage facilities to avoid water-stressed areas and use reclaimed water.

A dedicated Data Centre Task Force (DCTF) has also been estab-lished to assess utility capacity before projects are approved.

But El Nino presents a harder question: Are we assessing water availability under normal condi-tions, or stress-testing projects against severe drought?

Our environmental framework also deserves another look. Under the Environmental Quality Act 1974, data centres are not explicitly identified as a stan-dalone “prescribed activity” requiring an Environmental Impact Assessment (EIA).

Given the scale of new hyper-scale facilities, major projects should be assessed for cumula-tive regional demand rather than in isolation.

Operators should disclose actu-al water-use efficiency and electricity consumption and also demonstrate credible plans to reduce reliance on potable water during periods of stress.

El Nino offers a real-world stress test of whether Malaysia’s digital infrastructure is resilient to the climate in which it must operate.

Written By:

Thulasy Suppiah,
Managing Partner,
Suppiah & Partners,

UG-13, Lexa Galleria, 45, Jalan 34/26,
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238

© 2026 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Featured Articles

[Feature Article] The Star & MalaysiaKini: The Unfinished Business of Merdeka

The Unfinished Business of Merdeka

By Thulasy Suppiah, Managing Partner of Suppiah & Partners

As we mark 69 years of independence, Merdeka must be understood not merely as a historical milestone from 1957, but as an ongoing, living project. While we have long secured our political sovereignty, our journey toward true social and economic independence remains unfinished.

This divide is starkly visible in our daily lives. In digital spaces, public debates too often devolve into categorising citizens by race, casually reducing individuals to a “Type.” This digital tribalism proves that the colonial legacy of “divide and rule” has simply mutated, finding new life in algorithms, anonymity, and manufactured outrage.

Recent investigations and data paint a deeply concerning picture of these fractures across three critical areas:

In employment, a study by the Centre for Governance and Political Studies (Cent-GPS) demonstrated that job applicants face drastically skewed callback rates based on ethnicity despite having identical qualifications.

In housing, research by Architects of Diversity (AOD) revealed that nearly half of Klang Valley rental listings impose racial criteria, forcing marginalised tenants to pay a “discrimination tax” in higher rents just to secure a home.

In our digital discourse, an undercover investigation by media platform The Fourth exposed how social hostility is often not organic, but manufactured. Irresponsible parties fund hidden agencies, cybertroopers, and comment seeders to artificially amplify polarising talking points, creating a false illusion of widespread communal division.

These practices persist due to a glaring legislative and regulatory vacuum. We currently have a crucial window of opportunity to begin addressing these structural flaws.

In housing, as the government finalises the Residential Tenancy Bill, it is imperative that lawmakers include explicit anti-discrimination clauses. Enacting tenancy reform without addressing racial screening merely treats the symptoms of an unfair market while ignoring its root cause. We cannot claim to legislate fairness if we leave legal loopholes for unjust exclusion.

In employment, private corporations must move beyond performative diversity statements and institutionalise objective hiring safeguards, such as blind recruitment processes that evaluate candidates solely on professional merits before personal demographics are revealed.

In our digital sphere, regulatory frameworks must evolve to demand strict transparency for funded online campaigns, ensuring the public knows when social media discourse has been artificially manufactured by shadowy actors.

Yet, there is profound reason for optimism. Divisive rhetoric is steadily losing its grip on the younger demographic. Young Malaysians—born into a hyper-connected world—are increasingly recognizing that the shared struggles of stagnant wages, housing affordability, and economic uncertainty do not discriminate by race, looking past the manufactured narratives designed to compartmentalise them.

Away from the political arena and the extremes of social media, the authentic Malaysian experience has always been defined by profound warmth, shared spaces, and the quiet solidarity we show one another during national crises. As we look toward our seventh decade as an independent nation, true Merdeka requires us to bridge the gap between the unity we live and the fairness we legislate.

Only by actively rejecting the practices that fracture us can we move a step closer to fulfilling the true promise of Merdeka.

Written By:

Thulasy Suppiah,
Managing Partner,
Suppiah & Partners,

UG-13, Lexa Galleria, 45, Jalan 34/26,
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238

© 2026 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Newsletter

[Feature Article] The Star: Is Corporate Malaysia Serious About Protecting Our Data?

Is Corporate Malaysia Serious About Protecting Our Data?

By Thulasy Suppiah, Managing Partner of Suppiah & Partners

For Malaysians, the cycle has become exhaustingly predictable. From massive ransomware attacks crippling statutory bodies to recent headlines of internal employees casually leaking sensitive customer billing details online, the public is caught in a continuous loop of data compromises.

While the nature of these threats varies wildly—ranging from highly sophisticated, AI-driven external cyberattacks to rudimentary internal snooping—the corporate response is almost always identical. The public is inevitably met with a standard public relations script: the company assures us it was an “isolated incident,” claims no broader systems were compromised, and reiterates that they take data privacy “very seriously.”

However, as these incidents compound, a critical legal and governance question must be asked: How can the public independently verify these claims? When a breach occurs, how do we know if the data controller truly implemented all necessary and reasonable security measures prior to the failure, or if their architecture was fundamentally inadequate from the start?

This is particularly relevant when examining insider threats. If a company’s system architecture allows an employee to casually browse a customer’s sensitive billing or identification details without a verified, logged business justification, it points to a systemic failure in basic internal access controls. If an organisation fails to implement fundamental “Zero Trust” protocols internally, it is difficult to trust their capacity to defend against complex, external cyber threats.

Recognising the importance of these risks, the Personal Data Protection Department (JPDP) earlier this year issued guidelines on Data Protection by Design (DPbD) and Data Protection Impact Assessments (DPIA).

These guidelines should not be treated as mere administrative guidance. DPbD encourages organisations to build privacy safeguards into their systems from the outset, rather than addressing weaknesses only after deployment. Where proposed data processing is likely to pose a high risk, the DPIA requires data controllers to identify, assess and reduce those risks before processing begins.

Yet, the persistent pattern of data leaks suggests that much of corporate Malaysia is treating these critical guidelines as mere paperwork exercises to be filed away, rather than architectural mandates to be engineered into their daily operations.

We cannot continue to accept a culture where data security is only prioritised after a crisis has occurred. Suing a rogue employee or issuing an apology after data has already surfaced online or on the dark web is purely reactive.

To break this loop, regulatory oversight must fundamentally shift. Regulators must move beyond issuing post-incident fines and begin conducting proactive, unannounced audits of corporate access controls. Data controllers must be compelled to actively demonstrate exactly how data protection principles are hardcoded into their systems.

Until companies are held accountable for their internal architecture before a breach happens, the public will remain vulnerable to the next “isolated incident.”

Written By:

Thulasy Suppiah,
Managing Partner,
Suppiah & Partners,

UG-13, Lexa Galleria, 45, Jalan 34/26,
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238

© 2026 Suppiah & Partners. All rights reserved. The contents of this newsletter are intended for informational purposes only and do not constitute legal advice.

More Newsletter