Malaysian law for page admins — an overview

This is general information, not legal advice. It summarises the law as we understand it at the date above. Laws are amended and courts interpret them; if you have received a letter, a summons or a visit from the police, speak to a lawyer. Official texts of Malaysian Acts are published by the Attorney General's Chambers at lom.agc.gov.my.

Short answer. In Malaysia the admin of a page is treated as the publisher of what appears on it. Section 114A of the Evidence Act 1950 presumes it, defamation law treats repeating a statement as publishing it, and section 233 of the Communications and Multimedia Act 1998 and the 2025 Penal Code offences on harassment and doxxing can all apply to what a page posts. One rule removes most of the risk: do not publish allegations of fact about identifiable people.

A confession page feels informal: a few students, a form, a queue of anonymous messages. Legally it is something more definite. Each time an admin approves a submission, they are publishing it, and Malaysian law attaches responsibilities to publishing that do not depend on who wrote the words or on whether the author can ever be found.

This overview covers the main areas an admin should know about. Each has a fuller guide of its own, linked from its section.

The starting point: you are the publisher

Three ideas run through everything that follows.

Repeating a statement is publishing it. If someone sends you a damaging claim about a third person and you post it, the law treats you as having made the statement yourself. "I only shared what was submitted" is not, on its own, a defence.

You are presumed to have published what appears on your page. Section 114A of the Evidence Act 1950, in force since 2012, provides that a person whose name, photograph or pseudonym appears on a publication depicting them as its owner, host, administrator or editor — or who in any manner facilitates its publication — is presumed to have published it unless the contrary is proved. The same section creates similar presumptions for the registered subscriber of the network service a publication came from, and for whoever has custody or control of the computer it originated on. The presumption can be rebutted, but the burden of doing so is on you.

Anonymity protects the author far more than the admin. The submitter may be untraceable. The page is not. In practice the admin is the person a complainant, a lawyer or an investigating officer can find — and so the person they contact.

None of this means that running a page is reckless. It means the decision to publish is yours and should be made as though it were.

Defamation

Defamation is the area in which admins are most often caught out.

A statement is defamatory if it tends to lower a person in the estimation of right-thinking members of society, or to expose them to hatred, contempt or ridicule. To bring a claim, a person must show that the statement was defamatory, that it referred to them, and that it was published to at least one other person. They do not need to be named — it is enough that people who know them would understand the statement to be about them.

Civil defamation is governed by the Defamation Act 1957 together with case law. The main defences are justification (the statement is substantially true, and you can prove it), fair comment (an honest opinion on a matter of public interest, based on true facts) and privilege. An admin publishing an anonymous allegation can almost never rely on justification, because they have no means of proving what an unknown person told them.

Defamation can also be a crime: sections 499 and 500 of the Penal Code provide for up to two years' imprisonment, a fine, or both.

→ Full guide: Defamation and confession pages

Offensive and menacing communications: section 233

Section 233 of the Communications and Multimedia Act 1998 makes it an offence to use network facilities or services to make or transmit content that is obscene, indecent, false, menacing or grossly offensive in character, with intent to abuse, threaten or harass another person, among other things. It is the provision most often used in Malaysia against online posts.

The section was amended with effect from February 2025. The amendments raised the threshold from "offensive" to "grossly offensive", extended the offence to cover communications made with intent to commit fraud or dishonesty, and increased the maximum penalty to a fine of RM500,000, two years' imprisonment, or both — with heavier penalties where the offence is committed against a child. Its wording has also been the subject of constitutional challenge in the courts, so read the current text and do not rely on an old summary, including this one.

For an admin, the practical points are that both the person who writes such content and the person who transmits it can be within the section, and that complaints are investigated by the Malaysian Communications and Multimedia Commission (MCMC).

Harassment, bullying and doxxing

Amendments to the Penal Code that came into force on 11 July 2025 added sections 507B to 507G, creating specific offences for the first time for:

• using threatening, abusive or insulting words or communications that cause, or are likely to cause, harassment, distress, fear or alarm;
• conduct that causes a person to believe that harm will be done to them, with much heavier penalties — up to ten years' imprisonment — where a person attempts or dies by suicide as a result of the provocation;
• publishing a person's identity information in order to cause them harassment, distress, fear or alarm — in other words, doxxing.

Depending on the offence, these carry terms of imprisonment of up to one or three years, a fine, or both.

A confession page is an obvious vehicle for exactly this conduct: a post exposing where someone lives, a campaign of submissions about one person, a "name and shame". An admin who publishes such material is doing more than hosting a problem.

→ Full guide: Doxxing and harassment: the 2025 Penal Code offences

Race, religion and royalty

Malaysia treats speech touching on race, religion and the royal institution — often called the "3Rs" — with particular seriousness. Several laws may apply, among them the Sedition Act 1948 and provisions of the Penal Code concerning statements that cause disharmony or ill-will on religious grounds or that are likely to cause public alarm.

These provisions are broad, and they are enforced. A community page gains nothing from publishing submissions that attack an ethnic or religious group or insult the rulers, and it takes on real risk in doing so. Most pages simply rule the whole area out, and that is the sensible course.

Sexual content and content involving children

• Obscene material. Distributing obscene material is an offence under the Penal Code, and obscene or indecent content transmitted online falls within section 233.
• Children. The Sexual Offences Against Children Act 2017 creates serious offences relating to child sexual abuse material, including making, possessing and distributing it, and relating to sexual communication with a child. "Child" means a person under 18.
• Sexual harassment. The Anti-Sexual Harassment Act 2022 established a tribunal that hears complaints of sexual harassment, which can include conduct carried out online.

If material of this kind reaches your queue, the answer is never to publish it. What to do instead is set out in Moderating images and video.

Personal data

The Personal Data Protection Act 2010 regulates how personal data is processed in the course of commercial transactions. It was substantially amended in 2024, with changes phased in during 2025 that include mandatory data breach notification and a requirement for certain organisations to appoint a data protection officer.

A purely voluntary, non-commercial student page may fall outside the Act. A page that earns money, or a business that provides a submission platform, is much more likely to fall within it. Either way, the Act's principles — collect only what you need, keep it secure, do not keep it longer than necessary — are simply good practice for anyone holding other people's secrets.

→ Full guide: Personal data and community pages: a PDPA primer

Online safety

The Online Safety Act 2025 came into force on 1 January 2026. Its duties fall on licensed platform providers — the large social media and messaging services — and not on individual users or page admins. It requires those platforms to reduce users' exposure to defined categories of harmful content, to provide reporting tools, and to take additional measures to protect children. Under a Child Protection Code made under the Act, large platforms have been required since 1 June 2026 to prevent children under 16 from holding accounts.

For an admin, the Act's importance is indirect. The platforms that host your page are under more pressure to act on reports, and your audience may be changing.

→ Full guide: The Online Safety Act 2025 and the under-16 rule

Comments are yours too

Admins tend to think about what they post and forget what readers add underneath. In 2021 the Federal Court held the company operating the news portal Malaysiakini liable for contempt of court over comments left by its readers, relying in part on the section 114A presumption, and fined it RM500,000. That case concerned contempt and not defamation, and a news organisation and not a student page — but the reasoning, that a publisher who provides the platform and has the ability to control it answers for what appears there, is not confined to newspapers.

Moderate your comments. See Managing comments on confession posts.

If something arrives

A message from someone who says a post is about them. Take it down and reply courteously. This resolves the overwhelming majority of problems. See How to handle a takedown request.

A letter of demand from a lawyer. Do not ignore it and do not reply in anger. Remove the content, keep a copy of the letter and of the post, do not admit anything in writing, and take legal advice before responding.

Contact from the police or MCMC. Be polite, ask for the request in writing, and take legal advice. You are entitled to consult a lawyer.

If cost is a concern, the government's Legal Aid Department (Jabatan Bantuan Guaman) and the legal aid centres run by the Malaysian Bar may be able to assist those who qualify.

Five habits that keep a page out of trouble

1. Do not publish allegations of fact against identifiable people. This single rule removes most legal risk.
2. Do not publish anyone's personal details.
3. Stay away from race, religion and royalty.
4. Act on removal requests at once, and ask questions afterwards.
5. Keep a record of what you decided and why.

Not one of these requires legal training. Each asks only that you treat the Publish button as a decision that belongs to you.

Common questions

Is a page admin legally responsible for anonymous posts in Malaysia?

Yes. Repeating a statement is publishing it, so an admin who posts a damaging claim sent in by someone else is treated as having made the statement. Section 114A of the Evidence Act 1950 also presumes that the administrator of a page published what appears on it; the presumption can be rebutted, but the burden of doing so is on the admin.

What is section 114A of the Evidence Act 1950?

A presumption, in force since 2012. A person whose name, photograph or pseudonym appears on a publication depicting them as its owner, host, administrator or editor, or who in any manner facilitates its publication, is presumed to have published it unless the contrary is proved.

What does section 233 of the Communications and Multimedia Act cover?

It makes it an offence to use network facilities or services to make or transmit content that is obscene, indecent, false, menacing or grossly offensive, with intent to abuse, threaten or harass another person, among other things. Since the February 2025 amendments the maximum penalty is a fine of RM500,000, two years' imprisonment, or both, and complaints are investigated by MCMC.

Does the Online Safety Act 2025 apply to page admins?

Not directly. Its duties fall on licensed platform providers — the large social media and messaging services — and not on individual users or page admins. Its importance for an admin is indirect: the platforms that host a page are under more pressure to act on reports.

Does the PDPA apply to a confession page?

It depends. The Personal Data Protection Act 2010 regulates personal data processed in the course of commercial transactions, so a purely voluntary, non-commercial student page may fall outside it. A page that earns money, or a business that provides a submission platform, is much more likely to fall within it.

What should an admin do on receiving a letter of demand?

Do not ignore it and do not reply in anger. Remove the content, keep a copy of the letter and of the post, do not admit anything in writing, and take legal advice before responding.