[Feature Article] The Star: AI governance law must possess statutory teeth

October 17, 2026October 22, 2026 by loswebstudio99 in Featured Articles

[Feature Article] The Star: AI Governance Law Must Possess Statutory Teeth

Securing Malaysia’s digital sovereignty against autonomous AI

by Thulasy Suppiah, Managing Partner

THE recent revelation that an OpenAI agent breached an Australian government health portal while performing a research task represents a chilling escalation in global cybersecurity. We are no longer defending against human hackers or static code; we are facing autonomous, goal-oriented algorithms capable of bypassing systemic firewalls without direct human intervention.

For Malaysia, this warning arrives at a precarious juncture. Our rapid national digitisation, centralising citizens’ sensitive data into systems like MyDigitalID and PADU, creates an increasingly valuable honeypot of sovereign data. Yet, under Section 3(1) of the Personal Data Protection Act (PDPA) 2010, the Act does not apply to the Federal and State Governments. In an era where foreign AI agents can independently breach external systems, this legislative blind spot creates a distinct public-sector accountability gap.

When an autonomous AI breaches a sovereign system, the immediate legal question is accountability. Major developers frequently describe such incidents as actions their models “did not intend.” We must not allow technical autonomy to become a shield for corporate liability.

While Singapore has commendably initiated multilateral dialogues urging tech giants to commit to transparency, relying on voluntary corporate goodwill is insufficient. As Australia discovered, voluntary disclosure can result in catastrophic delays; OpenAI took nearly three months to notify the Australian government. In a landscape where AI operates in milliseconds, delayed reporting is a severe governance failure.

Fortunately, Malaysia is currently shaping its regulatory future through the proposed AI Governance Bill. This is our opportunity to codify robust legal safeguards.

Specifically, the Bill’s proposed “AI Incident Reporting” framework must possess statutory teeth. Taking cues from the European Union’s AI Act, Malaysia should mandate strict reporting deadlines for serious incidents involving high-risk AI systems—generally within 15 days, shortened to two days for certain particularly serious cases and 10 days where a death is involved—backed by meaningful financial penalties for delayed disclosure.

Furthermore, Principle 3 of the proposed framework must be strictly enforced. The law must unequivocally establish that legal responsibility cannot be displaced onto the AI system itself. Accountability must remain traceable to the developer or deployer who exercised control over the system.

Holding foreign developers accountable is only half the equation. Our domestic defence posture must radically evolve. Government agencies and National Critical Information Infrastructure (NCII) operators can no longer rely on legacy perimeter security. Our institutional infrastructure must be hardened to detect and isolate the probing and bypass attempts such agents can generate in real time.

By strengthening public-sector data accountability, enforcing rapid incident reporting and ensuring responsibility remains traceable to those who control AI systems, Malaysia can ensure our digital borders remain secure in an autonomous future.

Written By:
Thulasy Suppiah
Lawyer focusing on AI, Data Centers & Cybersecurity
Managing Partner @ Suppiah & Partners
UG-13, Lexa Galleria, 45, Jalan 34/26,
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238

[Feature Article] The Star: Smart Glasses Raise Privacy, Abuse Concerns Nationwide

September 30, 2026October 21, 2026 by loswebstudio99 in Featured Articles

[Feature Article] The Star: Smart Glasses Raise Privacy, Abuse Concerns Nationwide

by Thulasy Suppiah

[Feature Article] MalaysiaKini: House Arrest – What is Stopping Najib from Using Rosmah’s Phone?

September 26, 2026October 21, 2026 by loswebstudio99 in Featured Articles

[Feature Article] MalaysiaKini: House Arrest - What is Stopping Najib from Using Rosmah's Phone?

by Thulasy Suppiah

[Feature Article] MalaysiaKini: Esha Clause – Why Punishment Alone Cannot Protect Children

September 2, 2026September 11, 2026 by loswebstudio99 in Featured Articles

Esha Clause - Why Punishment Alone Cannot Protect Children

by Thulasy Suppiah, Managing Partner

MALAYSIA has recently undergone a significant shift in its legal approach to bullying and cyberbullying, driven largely by public outrage over tragic losses of life. The most notable result is Section 507D(2) of the Penal Code—widely dubbed the “Esha Clause.”

This provision criminalises threatening, abusive or insulting conduct intended to provoke a person to harm themselves or another person, or that the perpetrator knew or ought to have known was likely to do so. If that provocation results in a suicide attempt or death by suicide, the maximum prison sentence rises to ten years.

Having this law on the books sends a strong moral message. However, the public must understand the harsh legal reality: a severe penalty does not guarantee an easy conviction, nor does it act as an immediate shield for victims.

In a criminal court, proving that bullying took place may only be half the battle. The ongoing investigation into the tragic death of 14-year-old Keziah Nisha may become an important test of this clause.

While police are presently investigating the case under Section 507B, the investigation remains active and no final charging decision has been announced. It would therefore be premature to conclude that Section 507D (2) has been ruled out.

Nevertheless, the case highlights the immense difficulty at the heart of the Esha Clause. Prosecutors must prove not merely that the conduct was cruel or distressing, but that the accused intended to provoke self-harm or knew or ought to have known that the conduct was likely to do so. Where suicide followed, they must also prove that it occurred as a result of that provocation. Human distress rarely has a single, tidy cause. Where mental health, accumulated incidents, and other pressures overlap, establishing that connection beyond a reasonable doubt becomes a monumental hurdle.

But there is a deeper limitation to the Esha Clause. It is fundamentally an after-the-fact tool. It can hold a perpetrator accountable after threatening or abusive conduct has occurred, but it cannot by itself provide the immediate protection a vulnerable person may urgently need.

Criminal law can punish and deter, but it cannot substitute for protecting a victim in real time. Although the Esha Clause applies regardless of the victim’s age, its limitations are especially serious when children are involved. Children depend heavily on parents, teachers and school administrators to recognise the danger and intervene before bullying escalates into self-harm.

True protection therefore depends on what happens during the critical hours and days after a child first reports bullying or shows signs of distress. Yet Malaysia has moved from fragmented legal protections to an increasingly crowded anti-bullying framework. Beyond the Penal Code, we now have the Online Safety Act and the Anti-Bullying Act 2026, which established the Tribunal for Anti-Bullying.

While these measures serve different purposes, making sense of them in the midst of a crisis can be daunting. Teachers and school administrators must currently navigate the 2023 bullying guidelines, the sweeping 402-page 2026 Safe School Management Guidelines, the separate Student Protection Policy, the SAFE framework, and procedural reporting timelines such as SOP 1:3:7.

Having multiple laws and thick policy documents is not the same as having a cohesive safety net. When a child is facing severe psychological distress, a terrified parent or an overwhelmed teacher does not have time to solve an administrative puzzle. They need a single, unambiguous “no-wrong-door” emergency triage protocol. This must include an immediate suicide risk assessment, interim protection, and a designated response coordinator.

The Esha Clause is necessary, but it is not a safety net. The true measure of our national anti-bullying framework should not be how severely we can punish a perpetrator after the fact, but whether we can protect a victim in time. If a child facing bullying has attempted suicide or is already gone, our frontline intervention system has failed to reach that child in time. To truly honour Esha and the other victims who inspired these reforms, early intervention must become our first and most urgent line of defence.

Written By:

Thulasy Suppiah,
Managing Partner,
Suppiah & Partners,

UG-13, Lexa Galleria, 45, Jalan 34/26,
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238

[Feature Article] The Star: When the Cloud is Threatened by Drought

September 2, 2026September 11, 2026 by loswebstudio99 in Featured Articles

When the Cloud is Threatened by Drought

by Thulasy Suppiah, Managing Partner

THE devastating flood in Tibet and Nepal has once again drawn attention to the growing environ-mental risks facing fragile moun-tain regions in a warming world.

Closer to home, Malaysia faces a different climate challenge. As the country grapples with a strengthening El Nino, SPAN (National Water Services Commission) recently reported that nine of 49 major dams sup-plying raw water in Peninsular Malaysia and Labuan were at warning levels, two on alert and one critical.

El Nino is a naturally occurring climate phenomenon, but it is unfolding in a world warmed by human activity. Forecasts point to a very strong event extending into 2027, and Malaysian authori-ties have warned of pressure on domestic water supply, agricul ture and industrial activity.

Against this backdrop, Malaysia is rapidly expanding its data centre footprint. Globally, data centres accounted for about 1.5% of electricity consumption in 2024, with the International Energy Agency (IEA) projecting demand to more than double by 2030.

The concern is not only the pace of growth but its concentra-tion in hubs such as Malaysia, too. The question is whether our resource planning can keep pace.

To its credit, the government has begun to respond. The Investment, Trade and Industry Ministry’s Guidelines for Sustainable Development of Data Centres encourage facilities to avoid water-stressed areas and use reclaimed water.

A dedicated Data Centre Task Force (DCTF) has also been estab-lished to assess utility capacity before projects are approved.

But El Nino presents a harder question: Are we assessing water availability under normal condi-tions, or stress-testing projects against severe drought?

Our environmental framework also deserves another look. Under the Environmental Quality Act 1974, data centres are not explicitly identified as a stan-dalone “prescribed activity” requiring an Environmental Impact Assessment (EIA).

Given the scale of new hyper-scale facilities, major projects should be assessed for cumula-tive regional demand rather than in isolation.

Operators should disclose actu-al water-use efficiency and electricity consumption and also demonstrate credible plans to reduce reliance on potable water during periods of stress.

El Nino offers a real-world stress test of whether Malaysia’s digital infrastructure is resilient to the climate in which it must operate.

Written By:

Thulasy Suppiah,
Managing Partner,
Suppiah & Partners,

UG-13, Lexa Galleria, 45, Jalan 34/26,
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238

[Feature Article] The Star & MalaysiaKini: The Unfinished Business of Merdeka

August 24, 2026October 21, 2026 by loswebstudio99 in Featured Articles

The Unfinished Business of Merdeka

By Thulasy Suppiah, Managing Partner of Suppiah & Partners

As we mark 69 years of independence, Merdeka must be understood not merely as a historical milestone from 1957, but as an ongoing, living project. While we have long secured our political sovereignty, our journey toward true social and economic independence remains unfinished.

This divide is starkly visible in our daily lives. In digital spaces, public debates too often devolve into categorising citizens by race, casually reducing individuals to a “Type.” This digital tribalism proves that the colonial legacy of “divide and rule” has simply mutated, finding new life in algorithms, anonymity, and manufactured outrage.

Recent investigations and data paint a deeply concerning picture of these fractures across three critical areas:

In employment, a study by the Centre for Governance and Political Studies (Cent-GPS) demonstrated that job applicants face drastically skewed callback rates based on ethnicity despite having identical qualifications.

In housing, research by Architects of Diversity (AOD) revealed that nearly half of Klang Valley rental listings impose racial criteria, forcing marginalised tenants to pay a “discrimination tax” in higher rents just to secure a home.

In our digital discourse, an undercover investigation by media platform The Fourth exposed how social hostility is often not organic, but manufactured. Irresponsible parties fund hidden agencies, cybertroopers, and comment seeders to artificially amplify polarising talking points, creating a false illusion of widespread communal division.

These practices persist due to a glaring legislative and regulatory vacuum. We currently have a crucial window of opportunity to begin addressing these structural flaws.

In housing, as the government finalises the Residential Tenancy Bill, it is imperative that lawmakers include explicit anti-discrimination clauses. Enacting tenancy reform without addressing racial screening merely treats the symptoms of an unfair market while ignoring its root cause. We cannot claim to legislate fairness if we leave legal loopholes for unjust exclusion.

In employment, private corporations must move beyond performative diversity statements and institutionalise objective hiring safeguards, such as blind recruitment processes that evaluate candidates solely on professional merits before personal demographics are revealed.

In our digital sphere, regulatory frameworks must evolve to demand strict transparency for funded online campaigns, ensuring the public knows when social media discourse has been artificially manufactured by shadowy actors.

Yet, there is profound reason for optimism. Divisive rhetoric is steadily losing its grip on the younger demographic. Young Malaysians—born into a hyper-connected world—are increasingly recognizing that the shared struggles of stagnant wages, housing affordability, and economic uncertainty do not discriminate by race, looking past the manufactured narratives designed to compartmentalise them.

Away from the political arena and the extremes of social media, the authentic Malaysian experience has always been defined by profound warmth, shared spaces, and the quiet solidarity we show one another during national crises. As we look toward our seventh decade as an independent nation, true Merdeka requires us to bridge the gap between the unity we live and the fairness we legislate.

Only by actively rejecting the practices that fracture us can we move a step closer to fulfilling the true promise of Merdeka.

Written By:

Thulasy Suppiah,
Managing Partner,
Suppiah & Partners,

UG-13, Lexa Galleria, 45, Jalan 34/26,
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238

More Newsletter

[Feature Article] The Star: Is Corporate Malaysia Serious About Protecting Our Data?

July 28, 2026October 21, 2026 by loswebstudio99 in Featured Articles

Is Corporate Malaysia Serious About Protecting Our Data?

By Thulasy Suppiah, Managing Partner of Suppiah & Partners

For Malaysians, the cycle has become exhaustingly predictable. From massive ransomware attacks crippling statutory bodies to recent headlines of internal employees casually leaking sensitive customer billing details online, the public is caught in a continuous loop of data compromises.

While the nature of these threats varies wildly—ranging from highly sophisticated, AI-driven external cyberattacks to rudimentary internal snooping—the corporate response is almost always identical. The public is inevitably met with a standard public relations script: the company assures us it was an “isolated incident,” claims no broader systems were compromised, and reiterates that they take data privacy “very seriously.”

However, as these incidents compound, a critical legal and governance question must be asked: How can the public independently verify these claims? When a breach occurs, how do we know if the data controller truly implemented all necessary and reasonable security measures prior to the failure, or if their architecture was fundamentally inadequate from the start?

This is particularly relevant when examining insider threats. If a company’s system architecture allows an employee to casually browse a customer’s sensitive billing or identification details without a verified, logged business justification, it points to a systemic failure in basic internal access controls. If an organisation fails to implement fundamental “Zero Trust” protocols internally, it is difficult to trust their capacity to defend against complex, external cyber threats.

Recognising the importance of these risks, the Personal Data Protection Department (JPDP) earlier this year issued guidelines on Data Protection by Design (DPbD) and Data Protection Impact Assessments (DPIA).

These guidelines should not be treated as mere administrative guidance. DPbD encourages organisations to build privacy safeguards into their systems from the outset, rather than addressing weaknesses only after deployment. Where proposed data processing is likely to pose a high risk, the DPIA requires data controllers to identify, assess and reduce those risks before processing begins.

Yet, the persistent pattern of data leaks suggests that much of corporate Malaysia is treating these critical guidelines as mere paperwork exercises to be filed away, rather than architectural mandates to be engineered into their daily operations.

We cannot continue to accept a culture where data security is only prioritised after a crisis has occurred. Suing a rogue employee or issuing an apology after data has already surfaced online or on the dark web is purely reactive.

To break this loop, regulatory oversight must fundamentally shift. Regulators must move beyond issuing post-incident fines and begin conducting proactive, unannounced audits of corporate access controls. Data controllers must be compelled to actively demonstrate exactly how data protection principles are hardcoded into their systems.

Until companies are held accountable for their internal architecture before a breach happens, the public will remain vulnerable to the next “isolated incident.”

Written By:

Thulasy Suppiah,
Managing Partner,
Suppiah & Partners,

UG-13, Lexa Galleria, 45, Jalan 34/26,
Wangsa Maju, 53300 Kuala Lumpur.
Handphone no: 012-4915238