Is doxxing illegal in Malaysia? The 2025 Penal Code offences and what they mean for community pages

This is general information, not legal advice. The provisions described here are recent and there is little case law interpreting them yet. Read the current text of the Penal Code at lom.agc.gov.my, and consult a lawyer about any actual case.

Short answer. Yes, doxxing is illegal in Malaysia. Since 11 July 2025, sections 507E and 507F of the Penal Code make it an offence to publish or circulate a person's identity information in order to harass, distress or frighten them, or so that harm follows. The maximum is three years' imprisonment, a fine, or both. The word "doxxing" does not appear in the statute; the conduct does.

For years, online harassment in Malaysia was prosecuted — when it was prosecuted at all — under provisions written for other purposes: criminal intimidation, insulting modesty, or the improper-use offence in section 233 of the Communications and Multimedia Act 1998. Bullying and doxxing were not offences in their own right.

That changed on 11 July 2025, when the Penal Code (Amendment) Act 2025 came into force and inserted sections 507B to 507G. This guide explains what they cover and why the admin of a community page should take them seriously.

What the new sections cover

Broadly, the provisions fall into three groups.

Threatening, abusive or insulting communications

Sections 507B and 507C concern the use of threatening, abusive or insulting words or communications, or acts of that nature. One section is aimed at conduct intended to cause a person harassment, distress, fear or alarm. The other covers conduct that is likely to cause those effects to a person, whether or not that was the aim. The offences can be committed by any means, which expressly includes electronic communication.

Causing fear of harm, and provocation

Section 507D concerns conduct that leads a person to believe that harm will be caused to them. It also contains the most serious offence in the group: where a person attempts or dies by suicide as a result of such provocation, the offender is liable to imprisonment for up to ten years.

Doxxing

Sections 507E and 507F concern publishing or circulating a person's identity information.

• Section 507E applies where this is done to cause the person harassment, distress, fear or alarm. The maximum penalty is three years' imprisonment, a fine, or both.
• Section 507F applies where it causes the person to believe that harm will follow, or helps bring that harm about. The maximum penalty is one year's imprisonment, a fine, or both.

Those maximums are as summarised by a criminal lawyer in the New Straits Times on 25 January 2026, which also makes the point that the Penal Code has no offence named doxxing — sections 507E and 507F are simply the provisions that cover what the word describes.

Section 507G supplies the definitions. "Identity information" is defined widely, to cover the kinds of information by which a person can be identified or located.

Maximum penalties differ from section to section — in broad terms, imprisonment of up to one or three years, a fine, or both, with the ten-year maximum reserved for the provocation offence described above.

What counts as identity information in practice

Without attempting to restate the statutory definition, the information that features in real doxxing incidents is predictable:

• full name where the person was previously anonymous or known only by a handle;
• home address, hostel block and room number;
• phone number, email address, social media profiles;
• identity card, passport or student number;
• workplace, employer, class schedule;
• vehicle registration number;
• photographs that show a person's face, home or car;
• the names and details of family members.

It makes no difference that each piece was already discoverable somewhere. Doxxing consists of the gathering together and the pointing: placing in front of an audience that has reason to be angry the means of finding someone.

How a confession page becomes the instrument

Admins tend to think of harassment as something done to their page — spam, abuse in the comments. The new offences are a reason to consider the opposite case, in which the page is what delivers the harm.

The "name and shame" post. A submission that identifies a person and invites public anger: the driver who parked badly, the customer who left a bad review, the student who allegedly jumped a queue. It is often accompanied by a photograph or a number plate. The submitter feels justified. The result is a named individual facing hundreds of hostile strangers.

The exposure post. "The person behind [anonymous account] is [name], from [faculty], lives in [block]." This is doxxing in its plainest form.

The campaign. A string of submissions about the same person over days or weeks. No single post is extreme. Taken together they amount to a sustained course of conduct directed at one individual, who watches it unfold in public.

The "find this person" post. "Does anyone know who this is?" with a photograph attached. Whatever the motive, it asks the audience to do the identifying, and somebody in the comments will oblige.

The comment section. A post that was carefully anonymised, beneath which a reader supplies the name, the Instagram handle and the faculty.

In each case the admin chose to publish, or chose to leave the comments standing. Whether an offence has been committed by the author, the admin or both will depend on the facts and on how the courts read the sections. But an admin who knowingly publishes a person's details to a hostile audience is in a poor position to say that they bear no responsibility for what follows.

Other laws that may apply alongside

The same conduct can engage several provisions:

• Section 233 of the Communications and Multimedia Act 1998 — transmitting content that is obscene, indecent, false, menacing or grossly offensive with intent to abuse, threaten or harass.
• Criminal intimidation under the Penal Code — threatening a person with injury to their person, reputation or property.
• Defamation, civil and criminal, where what is said about the person is false and damaging. See Defamation and confession pages.
• The Anti-Sexual Harassment Act 2022, where the conduct is sexual in nature.
• The Personal Data Protection Act 2010, where personal data is disclosed in a commercial context without a lawful basis.

What an admin should refuse

A short and firm list is easier to apply than case-by-case judgement.

1. No identity information about private individuals — none of the items listed earlier, ever.
2. No photographs of people taken or published in order to shame them.
3. No "who is this?" posts.
4. No series. If one person is the subject of repeated submissions, stop publishing any of them, however mild each one appears.
5. No calls to action against a person — "let her know what you think", "make him famous", "you know what to do".
6. No reposting of material from someone's private or personal accounts in order to mock them.

When a submission describes something that really is wrong — an assault, a theft, a scam — the answer is still not to publish the person's details. Tell your audience where such matters can be reported. A confession page cannot investigate, cannot hear the other side, and cannot undo the consequences if it identifies the wrong person. Misidentification is common, and its results fall on someone who did nothing.

Controlling the comments

• Remove comments that name, tag or otherwise identify the subject of a post, as soon as you see them.
• Use the platform's keyword filters to hold comments containing a name once it has started to circulate.
• Close comments on a post when identification attempts keep recurring.
• Where a commenter persists, restrict or ban them from the page.

More detail is in Managing comments on confession posts.

If your page has already published something

1. Remove it now, including from Instagram, from stories, and from anywhere it was cross-posted.
2. Remove the comments that identified the person, and close the thread.
3. Do not post an explanation that repeats the details.
4. If the person contacts you, apologise, confirm what has been removed, and ask whether anything else is still visible.
5. Record what happened and what you have changed in your process.
6. If you are contacted by the police or by a lawyer, take legal advice before you respond.

If someone is being targeted

If you become aware — through the queue or otherwise — that a person is the subject of a campaign, they may not know it. Consider whether to let them know, discreetly and without disclosing submissions, that they may wish to look at their privacy settings and keep records. Our guide for people on the receiving end, What to do if an anonymous page posts about you, sets out their options, including reporting to the platform, to MCMC and to the police.

Why this matters beyond the law

The 2025 amendments followed public concern over cases in which sustained online abuse was linked to a death. The provisions exist because the harm is real. A page with thousands of followers, pointed at a single nineteen-year-old, is an enormous force, and the person on the receiving end has no comparable way of answering back.

An admin holds the switch. Most of the time the right use of it is the dull one: decline, delete, move on to the next submission.

Common questions

Is doxxing illegal in Malaysia?

Yes. Since 11 July 2025, sections 507E and 507F of the Penal Code make it a criminal offence to publish or circulate a person's identity information in order to cause them harassment, distress, fear or alarm, or so that they believe harm will follow. The statute does not use the word "doxxing", but this is the conduct it describes.

What is the penalty for doxxing in Malaysia?

Under section 507E, up to three years' imprisonment, a fine, or both. Under section 507F, up to one year's imprisonment, a fine, or both. Where threatening or abusive conduct of the kind covered by section 507D leads a person to attempt or die by suicide, the maximum is ten years.

Is cyberbullying a crime in Malaysia?

Yes. Sections 507B to 507D, in force since 11 July 2025, cover threatening, abusive or insulting words and communications that are intended or likely to cause a person harassment, distress, fear or alarm, by any means including electronic communication.

Is it still doxxing if the information was already public?

It can be. Doxxing is the gathering together and the pointing: placing a person's name, address, number plate or photograph in front of an audience that has reason to be angry with them. That each detail could be found somewhere is not what the offence turns on.

Can a page admin be liable for a doxxing post that someone else submitted?

Possibly. Whether an offence is committed by the author, the admin or both depends on the facts and on how the courts read the sections, and there is little case law yet. An admin who knowingly publishes a person's details to a hostile audience is in a poor position to say they bear no responsibility for what follows.

Where can doxxing be reported in Malaysia?

To the platform the post is on, to the Malaysian Communications and Multimedia Commission through its complaints portal at aduan.mcmc.gov.my, and to the police. Keep screenshots showing the post, the account or page that published it, and the date.