Adakah doxxing menyalahi undang-undang di Malaysia? Kesalahan Kanun Keseksaan 2025 dan maksudnya untuk halaman komuniti

This is general information, not legal advice. The provisions described here are recent and there is little case law interpreting them yet. Read the current text of the Penal Code at lom.agc.gov.my, and consult a lawyer about any actual case.

Jawapan ringkas. Ya, doxxing adalah menyalahi undang-undang di Malaysia. Sejak 11 Julai 2025, seksyen 507E dan 507F Kanun Keseksaan menjadikan kesalahan untuk menerbitkan atau mengedarkan maklumat identiti seseorang dengan tujuan untuk mengganggu, menyusahkan atau menakutkan mereka, atau supaya kemudaratan berlaku. Hukuman maksimum adalah tiga tahun penjara, denda, atau kedua-duanya. Perkataan "doxxing" tidak muncul dalam statut; perbuatan itu ada.

For years, online harassment in Malaysia was prosecuted — when it was prosecuted at all — under provisions written for other purposes: criminal intimidation, insulting modesty, or the improper-use offence in section 233 of the Communications and Multimedia Act 1998. Bullying and doxxing were not offences in their own right.

Itu berubah pada 11 Julai 2025, apabila Akta Kanun Keseksaan (Pindaan) 2025 berkuat kuasa dan memasukkan seksyen 507B hingga 507G. Panduan ini menerangkan apa yang dilindungi dan mengapa pentadbir halaman komuniti harus mengambil serius perkara ini.

What the new sections cover

Broadly, the provisions fall into three groups.

Threatening, abusive or insulting communications

Sections 507B and 507C concern the use of threatening, abusive or insulting words or communications, or acts of that nature. One section is aimed at conduct intended to cause a person harassment, distress, fear or alarm. The other covers conduct that is likely to cause those effects to a person, whether or not that was the aim. The offences can be committed by any means, which expressly includes electronic communication.

Causing fear of harm, and provocation

Section 507D concerns conduct that leads a person to believe that harm will be caused to them. It also contains the most serious offence in the group: where a person attempts or dies by suicide as a result of such provocation, the offender is liable to imprisonment for up to ten years.

Doxxing

Sections 507E and 507F concern publishing or circulating a person's identity information.

• Seksyen 507E terpakai apabila ini dilakukan untuk menyebabkan gangguan, kesusahan, ketakutan atau kebimbangan kepada seseorang. Hukuman maksimum adalah tiga tahun penjara, denda, atau kedua-duanya.
• Seksyen 507F terpakai apabila ia menyebabkan seseorang percaya bahawa kemudaratan akan berlaku, atau membantu membawa kemudaratan itu. Hukuman maksimum adalah satu tahun penjara, denda, atau kedua-duanya.

Hukuman maksimum tersebut adalah seperti yang diringkaskan oleh peguam jenayah dalam New Straits Times pada 25 Januari 2026, yang juga menyatakan bahawa Kanun Keseksaan tidak mempunyai kesalahan bernama doxxing — seksyen 507E dan 507F hanyalah peruntukan yang meliputi apa yang diterangkan oleh perkataan itu.

Section 507G supplies the definitions. "Identity information" is defined widely, to cover the kinds of information by which a person can be identified or located.

Maximum penalties differ from section to section — in broad terms, imprisonment of up to one or three years, a fine, or both, with the ten-year maximum reserved for the provocation offence described above.

What counts as identity information in practice

Without attempting to restate the statutory definition, the information that features in real doxxing incidents is predictable:

• full name where the person was previously anonymous or known only by a handle;
• home address, hostel block and room number;
• phone number, email address, social media profiles;
• identity card, passport or student number;
• workplace, employer, class schedule;
• vehicle registration number;
• photographs that show a person's face, home or car;
• the names and details of family members.

It makes no difference that each piece was already discoverable somewhere. Doxxing consists of the gathering together and the pointing: placing in front of an audience that has reason to be angry the means of finding someone.

How a confession page becomes the instrument

Admins tend to think of harassment as something done to their page — spam, abuse in the comments. The new offences are a reason to consider the opposite case, in which the page is what delivers the harm.

The "name and shame" post. A submission that identifies a person and invites public anger: the driver who parked badly, the customer who left a bad review, the student who allegedly jumped a queue. It is often accompanied by a photograph or a number plate. The submitter feels justified. The result is a named individual facing hundreds of hostile strangers.

The exposure post. "The person behind [anonymous account] is [name], from [faculty], lives in [block]." This is doxxing in its plainest form.

The campaign. A string of submissions about the same person over days or weeks. No single post is extreme. Taken together they amount to a sustained course of conduct directed at one individual, who watches it unfold in public.

The "find this person" post. "Does anyone know who this is?" with a photograph attached. Whatever the motive, it asks the audience to do the identifying, and somebody in the comments will oblige.

The comment section. A post that was carefully anonymised, beneath which a reader supplies the name, the Instagram handle and the faculty.

In each case the admin chose to publish, or chose to leave the comments standing. Whether an offence has been committed by the author, the admin or both will depend on the facts and on how the courts read the sections. But an admin who knowingly publishes a person's details to a hostile audience is in a poor position to say that they bear no responsibility for what follows.

Other laws that may apply alongside

The same conduct can engage several provisions:

• Section 233 of the Communications and Multimedia Act 1998 — transmitting content that is obscene, indecent, false, menacing or grossly offensive with intent to abuse, threaten or harass.
• Criminal intimidation under the Penal Code — threatening a person with injury to their person, reputation or property.
• Defamation, civil and criminal, where what is said about the person is false and damaging. See Defamation and confession pages.
• The Anti-Sexual Harassment Act 2022, where the conduct is sexual in nature.
• The Personal Data Protection Act 2010, where personal data is disclosed in a commercial context without a lawful basis.

What an admin should refuse

A short and firm list is easier to apply than case-by-case judgement.

1. No identity information about private individuals — none of the items listed earlier, ever.
2. No photographs of people taken or published in order to shame them.
3. No "who is this?" posts.
4. No series. If one person is the subject of repeated submissions, stop publishing any of them, however mild each one appears.
5. No calls to action against a person — "let her know what you think", "make him famous", "you know what to do".
6. No reposting of material from someone's private or personal accounts in order to mock them.

When a submission describes something that really is wrong — an assault, a theft, a scam — the answer is still not to publish the person's details. Tell your audience where such matters can be reported. A confession page cannot investigate, cannot hear the other side, and cannot undo the consequences if it identifies the wrong person. Misidentification is common, and its results fall on someone who did nothing.

Controlling the comments

• Remove comments that name, tag or otherwise identify the subject of a post, as soon as you see them.
• Use the platform's keyword filters to hold comments containing a name once it has started to circulate.
• Close comments on a post when identification attempts keep recurring.
• Where a commenter persists, restrict or ban them from the page.

More detail is in Menguruskan komen pada siaran pengakuan.

If your page has already published something

1. Remove it now, including from Instagram, from stories, and from anywhere it was cross-posted.
2. Remove the comments that identified the person, and close the thread.
3. Do not post an explanation that repeats the details.
4. If the person contacts you, apologise, confirm what has been removed, and ask whether anything else is still visible.
5. Record what happened and what you have changed in your process.
6. If you are contacted by the police or by a lawyer, take legal advice before you respond.

If someone is being targeted

If you become aware — through the queue or otherwise — that a person is the subject of a campaign, they may not know it. Consider whether to let them know, discreetly and without disclosing submissions, that they may wish to look at their privacy settings and keep records. Our guide for people on the receiving end, Apa yang perlu dilakukan jika halaman tanpa nama menyiarkan tentang anda, sets out their options, including reporting to the platform, to MCMC and to the police.

Why this matters beyond the law

The 2025 amendments followed public concern over cases in which sustained online abuse was linked to a death. The provisions exist because the harm is real. A page with thousands of followers, pointed at a single nineteen-year-old, is an enormous force, and the person on the receiving end has no comparable way of answering back.

An admin holds the switch. Most of the time the right use of it is the dull one: decline, delete, move on to the next submission.

Soalan lazim

Adakah doxxing menyalahi undang-undang di Malaysia?

Ya. Sejak 11 Julai 2025, seksyen 507E dan 507F Kanun Keseksaan menjadikannya kesalahan jenayah untuk menerbitkan atau mengedarkan maklumat identiti seseorang dengan tujuan untuk menyebabkan gangguan, kesusahan, ketakutan atau kebimbangan kepada mereka, atau supaya mereka percaya kemudaratan akan berlaku. Statut itu tidak menggunakan perkataan "doxxing", tetapi inilah perbuatan yang diterangkannya.

Apakah hukuman untuk doxxing di Malaysia?

Di bawah seksyen 507E, sehingga tiga tahun penjara, denda, atau kedua-duanya. Di bawah seksyen 507F, sehingga satu tahun penjara, denda, atau kedua-duanya. Apabila tingkah laku mengancam atau kesat seperti yang dilindungi oleh seksyen 507D menyebabkan seseorang cuba atau mati akibat bunuh diri, hukuman maksimum adalah sepuluh tahun.

Adakah buli siber jenayah di Malaysia?

Ya. Seksyen 507B hingga 507D, berkuat kuasa sejak 11 Julai 2025, meliputi perkataan dan komunikasi yang mengancam, kesat atau menghina yang bertujuan atau berkemungkinan menyebabkan gangguan, kesusahan, ketakutan atau kebimbangan kepada seseorang, melalui apa-apa cara termasuk komunikasi elektronik.

Adakah ia masih doxxing jika maklumat itu sudah umum?

Ia boleh jadi. Doxxing adalah pengumpulan dan penunjukan: meletakkan nama, alamat, nombor plat atau gambar seseorang di hadapan khalayak yang mempunyai sebab untuk marah kepada mereka. Bahawa setiap butiran boleh ditemui di suatu tempat bukanlah apa yang menjadi asas kesalahan itu.

Bolehkah pentadbir halaman bertanggungjawab atas siaran doxxing yang dihantar oleh orang lain?

Mungkin. Sama ada kesalahan dilakukan oleh pengarang, pentadbir atau kedua-duanya bergantung pada fakta dan bagaimana mahkamah membaca seksyen-seksyen tersebut, dan masih terdapat sedikit undang-undang kes. Pentadbir yang sengaja menerbitkan butiran seseorang kepada khalayak yang bermusuhan berada dalam kedudukan yang lemah untuk mengatakan mereka tidak bertanggungjawab atas apa yang berlaku.

Di mana doxxing boleh dilaporkan di Malaysia?

Kepada platform siaran itu, kepada Suruhanjaya Komunikasi dan Multimedia Malaysia melalui portal aduannya di aduan.mcmc.gov.my, dan kepada polis. Simpan tangkapan skrin yang menunjukkan siaran, akaun atau halaman yang menerbitkannya, dan tarikh.