Malaysia

With the explosive growth of buy-now-pay later (“BNPL”) schemes and alternative financing models, Malaysia’s credit consumer landscape has long been marked by fragmented regulation. The passing of the Consumer Credit Bill 2025 (“CCB 2025”) by the Dewan Rakyat on 21 July 2025 signals a pivotal step toward creating a unified regulatory framework – offering both oversight and consumer protection in one consolidated law. This article highlights what non-bank credit providers and credit service providers need to know about the CCB 2025, including licensing requirements, compliance obligations, enforcement mechanisms and timelines. 1. Establishment of the Consumer Credit Commission The cornerstone of the CCB 2025 is the creation of the Consumer Credit Commission (“Commission”), a statutory body tasked with overseeing the licensing, registration, and supervision of credit businesses and credit service providers. The Commission will also serve as a policy advisor to the government on all matters relating to consumer credit. 2. Licensing and Registration Framework The CCB 2025 introduces a structured regime requiring licensing for credit businesses and registration for credit service businesses. Under the CCB 2025, any person who intends to carry out the following types of credit business is required to obtain a licence from the Commission: (a) BNPL scheme; (b) Leasing; (c) Factoring; (d) Islamic BNPL scheme; (e) Islamic leasing; and (f) Islamic factoring. Certain activities, such as Islamic financing facility or Islamic pawnbroking, require licensing from the registrar of Islamic credit providers (“Registrar”). On the other hand, registration by the Commission is required in order to carry out the following credit service business: (a) Debt collection; (b) Impaired loan or financing acquisition; and (c) Debt counselling and management. There are certain requirements to be fulfilled by the applicants for licensing or registration such as the minimum financial requirements and compliance with any regulations, standards or guidelines or other requirements relating to licensing or conditions, as may be specified by the Commission or the Registrar. 3. Who is a ‘Credit Consumer’? The CCB 2025 defines a ‘credit consumer’ as: (a) an individual who obtains, has obtained or intends to obtain credit for personal, domestic, or household purposes; (b) a micro or small enterprise obtains, has obtained or intends to obtain credit not exceeding RM300,000; (c) any other person or category of persons specified by the Commission; or (d) a social guarantor providing non-commercial guarantees for the above. 4. Phased Implementation Timeline The CCB 2025 will be rolled out in three distinct phases: (a) Phase 1 (upon enforcement to 2027): the Commission will regulate previously unregulated credit providers (e.g. BNPL) while existing ministries and government agencies will retain oversight of the businesses within their respective sectors. (b) Phase 2 (2028-2030): the Commission expands to absorb regulatory functions from Ministry of Housing and Local Government and the Ministry of Domestic Trade and Cost of Living. (c) Phase 3 (2031 onwards): the Commission becomes the sole regulatory body for all consumer credit activity, subject to a government review. 5. Conduct Requirements & Consumer Protection The CCB 2025 imposes strict behavioural standards. Licensed credit business providers and registered credit service providers must continue to comply with the minimum financial requirements and ensure that their controllers, directors or senior management satisfy fit and proper requirements, as may be specified by the Commission or the Registrar. Further, licensed credit business providers and registered credit service providers are under a duty to carry on their businesses in a fair, responsible and professional manner when dealing with credit consumers. Licensed credit business providers and registered credit service providers are prohibited from certain business conduct, including: (a) engaging in misleading or deceptive conduct; (b) inducing or attempting to induce a credit consumer through an advertisement; (c) exerting undue pressure, influence or using harassment, coercion pr physical force in relation to the offer of any credit product or services or the payment for such credit product or services; or (d) demanding payments from a credit consumer in any manner for unsolicited credit product or services. Additionally, providers must conduct affordability assessments before extending or increasing credit and offer repayment relief mechanisms for consumers facing hardship due to illness, job loss, or natural disasters. 6. Enforcement Powers & Penalties The Commission is vested with significant enforcement powers. Non-compliance with the CCB 2025 may result in the credit business providers and/or the credit service providers being subject to potential liabilities such as criminal penalties of up to RM5 million in fines and/or 5 years imprisonment, civil remedies such as compensation, injunctions and rectification orders or administrative actions comprising inspections, audits, suspension or revocation of licences. These measures aim to deter predatory lending and ensure compliance throughout the ecosystem. 7. Regulatory and Supervisory Authority (“RSA”) The CCB 2025 further introduces the concept of RSA which comprises (a) the Commission; (b) the Central Bank of Malaysia; (c) the Securities Commission Malaysia; (d) the Ministry of Domestic Trade and Cost of Living; (e) the Ministry of Housing and Local Government; and (f) the Malaysia Co-operative Societies Commission. Each RSA regulates its respective sector in accordance with the relevant legislation. The functions and powers of the RSA under the CCB 2025 are in addition to the functions and powers of the RSA under other relevant written laws. Conclusion The CCB 2025 represents a watershed moment in Malaysia’s credit regulatory landscape. While the enforcement date depends on gazettement and subsequent implementation phases, non-bank credit providers and credit service providers should act now to review existing business models, assess licensing or registration obligations, implement robust consumer protection policies and prepare for data reporting and compliance audits. With stricter oversight, greater transparency, and unified standards, the CCB 2025 aims to elevate trust and fairness in Malaysia’s consumer credit ecosystem while offering long-overdue protection to vulnerable borrowers. This article is authored by our Partner, Ms Hoong Wei En and Associate, Ms Lim Jia Wen (Trisha). The information in this article is intended only to provide general information and does not constitute any legal opinion or professional advice. Written by: HOONG WEI EN Partner [email protected] LIM JIA WEN (TRISHA) Associate [email protected] LegalTaps September 2025

Introduction The right to privacy encompasses “the right to be let alone, the right of a person to be free from unwarranted publicity and the right to live without undue interference by the government or any private individual in matters with which the public is not concerned.”1 The tenets on this right may be broken down into: informational privacy (control over personal data and communications), bodily privacy (protection against invasive procedures and exploitation of physical autonomy), territorial privacy (limits on intrusions into private spaces, such as homes and workplaces), and decisional privacy (autonomy in personal life decisions, such as family life, sexual identity, and reproductive choice).2 Internationally, privacy is entrenched as a fundamental right. Article 12 of the Universal Declaration of Human Rights (“UDHR”) provides that “no one shall be subjected to arbitrary interference with his privacy, family, home or correspondence.” Similarly, Article 17 of the International Covenant on Civil and Political Rights (“ICCPR”), expressly prohibits unlawful interference with privacy. Malaysia, although being a member and signatory, has yet to ratify the UDHR or the ICCPR into our local legislation. Other common law jurisdictions have also developed privacy jurisprudence. In the United Kingdom, the tort of misuse of private information emerged from Campbell v MGN Ltd [2004] UKHL 22.3 In India, the Supreme Court has recognised privacy as intrinsic to the right to life and personal liberty under Article 21 of its Constitution (equivalent of Article 5(1) of the Malaysian Federal Constitution).4 Although the Federal Constitution does not expressly protect privacy, Malaysian courts have read the right to privacy into Article 5(1), and certain statutes provide limited, sector-specific protection. This article evaluates whether privacy rights truly exist in Malaysia by examining constitutional interpretation, case law, and statutory recognition. Privacy as a Constitutional Right Article 5(1) states: “No person shall be deprived of his life or personal liberty save in accordance with law.” The judiciary, however, has adopted a prismatic and liberal interpretation, and held that the words “life” and “personal liberty” may be expanded to include ancillary rights.5 In Sivarasa Rasiah v Badan Peguam Malaysia & Anor [2010] 2 MLJ 333, Gopal Sri Ram FCJ said in obiter that “… personal liberty in Article 5(1) includes within its compass other rights such as the right to privacy”. This paved the way for privacy to be read into Malaysia’s constitutional fabric, though not as an independent right. The Court of Appeal in Muhamad Juzaili bin Mohd Khamis v State Government of Negeri Sembilan [2015] 3 MLJ 513 followed suit and extended this reasoning, striking down a Syariah criminal enactment that criminalised cross-dressing. The court recognised that dignity, gender identity, and privacy fall within the ambit of Article 5(1). Although later reversed on procedural grounds, the Federal Court did not disturb the substantive recognition of privacy. In Maria Chin Abdullah v Ketua Pengarah Imigresen & Anor [2021] 1 MLJ 750, the Federal Court reiterated that unenumerated rights could be housed within Article 5(1). While the decision was primarily concerned with freedom of movement, Tengku Maimun Tuan Mat CJ (as she then was) opined that privacy forms part of personal liberty, drawing from Indian jurisprudence. More recently, in Genting Malaysia Bhd v Pesuruhjaya Perlindungan Data Peribadi & Ors [2022] 11 MLJ 898, the High Court held that the Personal Data Protection Act 2010 (“PDPA”) must be construed harmoniously with Article 5(1), since informational privacy is constitutionally protected. The court emphasised that unjustified access to personal data (even by public officers) without necessity or proportionality would destroy privacy. Despite these developments, the constitutional recognition of privacy remains limited as the Federal Court statements above were made in orbiter and hence, do not constitute binding judgements. Even with constitutional recognition, the right to privacy would only apply vertically against the State and not between private individuals.6 Privacy in Private Law In contrast to constitutional law, Malaysian private law has not recognised a general tort of invasion of privacy. Instead, plaintiffs typically frame privacy-related claims under existing heads of liability such as breach of confidence, defamation, or nuisance.7 The early position was restrictive. In Ultra Dimension Sdn Bhd v Kook Wei Kuan [2001] MLJU 751, the High Court held that English common law (applicable – in some circumstances - under Section 3 of the Civil Law Act 1956) did not recognise privacy as an independent right and, hence, no cause of action arose from alleged invasion of privacy. This position was later reversed when the Court of Appeal in Maslinda bt Ishak v Mohd Tahir bin Osman & Ors [2009] 6 MLJ 826 (“Maslinda”) seemingly accepted the High Court’s finding on the recognition of the tort of invasion of privacy. However, the significance of this milestone was quickly diminished when the Court of Appeal in Dr Bernadine Malini Martin v MPH Magazines Sdn Bhd & Ors [2010] 5 MLJ 755 (“Dr Bernadine”), backpedalled and shot down the seeming recognition in Maslinda by stating that it was “unfortunate” for the claimant that invasion of privacy was not an actionable wrong in Malaysia. Hence, at present we appear to have two conflicting Court of Appeal decisions on the recognition of tort of invasion of privacy. As a result of the conflicting decisions, two lines of cases have subsequently emerged. In Mohamad Izaham bin Mohamed Yatim v Norina bt Zainol Abidin & Ors [2017] 7 MLJ 772, the High Court followed Dr Bernadine and held the Court of Appeal in Maslinda was not called to decide on the tort of invasion of privacy hence it did not expressly or impliedly recognise invasion of privacy as an actionable wrong. Even if privacy were accepted to be actionable, it would be limited to matters of private morality and modesty only.8 In Lew Cher Phow @ Lew Cha Paw & Ors v Pua Yong Yong & Anor [2011] MLJU 1195, CCTV surveillance directed at a neighbour’s house was deemed an “unwarranted violation” of privacy and dignity. It ought to be noted that the court did not appear to have considered Dr Bernadine. In Lee Ewe Poh v Dr Lim Teik Man & Anor [2011] 1 MLJ 835, the court held that unconsented photography of a patient’s private parts during surgery even if in accordance with standard practice amounted to an invasion of privacy, departing from the old English position. Again, the court here did not appear to have considered Dr Bernadine. Photographs that were published in the public domain will however, not constitute invasion of privacy.9 The difference in judicial positions underscore the uncertainty of Malaysian jurisprudence on privacy, highlighting the urgent need for either legislative intervention or a definitive ruling by the Federal Court to resolve the uncertainty. Until the Federal Court delivers a definitive ruling, privacy in private law remains unsettled. Statutory Recognition of Privacy Rights The legislature has addressed privacy indirectly through sector-specific legislation, but no general privacy law exists to date. a. Personal Data Protection Act 2010 The PDPA regulates the processing of personal data in commercial transactions.10 It grants data subjects rights of access, correction, and withdrawal of consent. The privacy protection afforded is subject to limitations - it does not apply to federal or state governments,11 nor to personal or household activities. This exemption of federal and state governments is significant since the federal and state governments are the largest collector of personal data. The enactment of the Data Sharing Act 2024 intensifies concerns that state surveillance may expand without robust safeguards. Further, the PDPA does not grant individuals private enforcement rights to address personal data related privacy concerns.12 b. Penal Code Section 509 criminalises words or gestures intended to insult modesty or “intrude upon the privacy” of a person, encompassing acts such as non-consensual photography/videography and the dissemination thereof. For instance, in Pendakwa Raya v Nor Hanizam bin Mohd Noor [2019] MLJU 638, the court held that surreptitious video recording of a woman bathing constituted an intrusion upon privacy under section 509 and such intrusion is a serious offence. Overall, statutory protections are fragmented and sectoral, leaving significant gaps. For instance, personal data on social media, political surveillance, or private communications which are the most vulnerable to privacy breaches may fall outside statutory protection altogether.13 Where do we go from here? This brief analysis reveals that privacy rights in Malaysia exist in fragmented and uncertain forms. Thus, there is no hard and fast rule on the enforcement of privacy rights in Malaysia. Safeguards remain piecemeal, inconsistent, and fact-oriented. In an era of digital revolution where pervasive digital surveillance and mass data processing are more rampant than ever, this legal lacuna raises eyebrows. It is high time for reform to be injected, either by judicial affirmation by the Federal Court of a tort of privacy or a broader reading of Article 5(1) or a legislative enactment of a comprehensive privacy statute, binding on both private actors and the State which is on par with international human rights standards. Until then, privacy in Malaysia remains a contested and underdeveloped right, leaving individuals vulnerable to intrusion in both private and public spheres. This article is authored by our Partners, Lee Lin Li, Ng Kim Poh, and Pupil, Wong Yun Xin. The information in this article is intended only to provide general information and does not constitute any legal opinion or professional advice. Written by: LEE LIN LI Partner [email protected] NG KIM POH Partner [email protected] WONG YUN XIN Pupil-in-Chambers [email protected] 1 Toh See Wei v Teddric Jon Mohr & Anor [2017] 11 MLJ 67. 2 The right to privacy and challenges: A critical review [2008] 5 MLJ cxxi; May I have some privacy please? [2022] 1 MLJ ccxxxv. 3 The tort of misuse of private information was described as “protecting an aspect of privacy”. 4 Kharak Singh v State of UP & Others 1964 SCR (1) 332. 5 Maria Chin Abdullah v Ketua Pengarah Imigresen & Anor [2021] 1 MLJ 750. 6 Beatrice a/p Fernandez v Sistem Penerbangan Malaysia [2005] 3 MLJ 681. 7 The case for the tort of privacy in Malaysia [2023] 1 MLJ xlv. 8 See also Toh See Wei v Teddric Jon Mohr & Anor [2017] 11 MLJ 67; John Dadit v Bong Meng Chiat & Ors [2015] MLJU 1961; Chan Ah Kien v Brite-Tech Berhad & Anor [2019] MLJU 2017. 9 Sherinna Nur Elena bt Abdullah v Kent Well Edar Sdn Bhd [2014] 7 MLJ 298. 10 Personal Data Protection Act 2010, S 2(1). 11 Personal Data Protection Act 2010, S 3(2). 12 Ranjan Paramalingam & Anor v Persatuan Penduduk Taman Bangsar Kuala Lumpur [2023] 2 MLRA; Tan Kok Pin v Loh Chun Hoo & Ors [2022] MLRHU 3065. 13 Between lex lata and lex ferenda: An evaluation of the extent of the right to privacy in Malaysia [2017] 4 MLJ xxix. --------------- ------------------------------------------------------------ --------------- ------------------------------------------------------------   LegalTaps September 2025

The Industrial Relations (Amendment) Regulations 2025 [P.U.(A) 153/2025] has taken effect on 15th May 2025. In essence, the amendments aim to clarify and streamline the procedures for trade union recognition and the conduct of secret ballots. The key amendments are outlined below: Voluntary Recognition of Trade Unions Pursuant to the amendments, Regulation 4 of the Industrial Relations Regulations 2009 (“Regulations”) now provides that if an employer or trade union of employers is satisfied that the scope of membership of a trade union of workmen making the claim for recognition to represent workmen or class of workmen is in accordance with the constitution of the trade union of workmen, the employer or trade union of employers shall “voluntarily” accord recognition to such trade union of workmen in the prescribed form and accordingly notify the Director General of Industrial Relations (“DGIR”) by serving the prescribed form within 14 days from its issuance. The wording of Section 9(3) of the Industrial Relations Act 1967 differs slightly, in which the employer, in choosing to accord recognition, is subject to the scope of membership of the trade union and in accordance with the constitution of the trade union as follows – “An employer or a trade union of employers upon whom a claim for recognition has been served shall, within twenty-one days after the service of the claim: (a) Granting recognition subject to the scope of the trade union's membership as of the claim date and in accordance with the constitution of the trade union, or (b) If not granting recognition, providing written reasons to the trade union explaining the refusal.” The Hansard on the Industrial Relations (Amendment) Bill 2019 explains that Section 9 is amended to establish voluntary recognition by the employer or trade union. The employer must ensure alignment with the scope of membership of the workmen' trade union seeking recognition. This is to prevent the employer or the employer’s trade union from granting voluntary recognition to a trade union of workmen whose membership scope does not cover the employees of the employer or the trade union of employers concerned. Secret Ballot to ascertain Sole Bargaining Rights The new Regulation 13D of the Regulations is amended, whereby it is provided that if a trade union competing for sole bargaining rights fails to attend the secret ballot meeting after 2 attempts or declares its intention to not participate in the determination of sole bargaining rights, the trade union shall be presumed uninterested and excluded from the decision on sole bargaining rights. In such a case, the DGIR shall decide on which trade union that is to be vested with sole bargaining rights. In essence, the new Regulation 13GA provides that the trade union which obtains the highest number of votes in the secret ballot shall be vested with sole bargaining rights. In the event of a tie, the DGIR shall conduct a further secret ballot among the trade unions of workmen receiving equivalent highest number of votes, until one union obtains the highest number of votes. For any further secret ballot in consequence of the tie, the DGIR shall decide the date, time, venue and any other matter which is necessary for conducting the secret ballot. The employer or trade union of employers shall affix copies of the notice for the secret ballot at a conspicuous place in the premises of the employers concerned for 7 consecutive days immediately preceding the day of the casting of the secret ballot. Only workmen listed in the existing Appendix 1 of Form FE or Appendix 1 of Form FF are entitled to vote. Shorter Timeline for Deemed Withdrawal of a Representation for Unfair Dismissal When a workman files a representation for wrongful dismissal, the process begins with a conciliation session facilitated by the Industrial Relations Department (IRD), attended by both the workman and the former employer. If the conciliation fails to resolve the dispute, the matter is automatically referred to the Industrial Court for adjudication through a formal court trial. Should the workman fail to attend any of the conciliation meetings at the IRD after 2 attempts, the DGIR will issue a notice, using the prescribed form, to the workman's last known address, instructing the workman to attend a final conference or conciliation meeting. Following the amendments, if the workman fails to attend the final conciliation meeting on the scheduled date and does not provide a valid reason for the absence within 30 days (reduced from the previous 60-day period), the Director General of Industrial Relations (DGIR) may treat the representation as withdrawn. This article is authored by our Partner, Mr Leonard Yeoh and Senior Associate, Ms Pua Jun Wen. The information in this article is intended only to provide general information and does not constitute any legal opinion or professional advice. Written by: LEONARD YEOH Partner [email protected] PUA JUN WEN Senior Associate [email protected] LegalTaps September 2025

  After years of courtroom twists and turns, Kingtime International Ltd has emerged victorious in a high-stakes patent showdown against Petronas Carigali Sdn Bhd, with the Court of Appeal overturning a 2023 High Court decision that had dismissed Kingtime’s infringement suit and invalidated its patents. At the heart of the dispute? A mobile offshore production unit (MOPU) with a detachable wellhead support structure built using Kingtime’s patented invention. Kingtime claimed that Petronas Carigali had taken delivery of this MOPU from a third-party manufacturer and used it, fully aware that it incorporated their patented technology. But the legal drama didn’t stop there. In May 2022, years after Kingtime first sued and after leave to appeal to the apex court against a finding of infringement and validity of the Kingtime patents by the manufacturer in a related suit had been dismissed, Petronas Carigali sought to invalidate Kingtime’s patents. What followed was a 12-day trial, culminating in a blow for Kingtime in August 2023, when the High Court sided with Petronas on both fronts. Kingtime appealed. After five days of hearings spread across three sessions—in October 2024, February 2025, and May 2025—the tide turned. The Court of Appeal not only revived Kingtime’s patents and found infringement by Petronas Carigali, it also ordered, a refund of RM800,000 in costs that Kingtime had to Petronas Carigali, an additional RM950,000 in appellate costs to be paid by Petronas Carigali and remittance of damages to the High Court for assessment. A judicial milestone While the full grounds of judgment are not yet available, this case tackled several important issues in Malaysian patent law at the Court of Appeal: • Res Judicata (Judgments Binding on Privies): The Court of Appeal ruled that Petronas Carigali, as the user of the infringing MOPU, was bound by the earlier decision against the manufacturer. The Court of Appeal found that Petronas Carigali and the manufacturer were privies by virtue of their conduct and close connection. This challenges the High Court’s stance that users may escape liability even when the very same product has already been deemed infringing. • Double Recovery and Account of Profits: Can a patent holder recover from both the maker and the user of an infringing product? And can they claim profits instead of just damages? • Patent Claim Construction: Kingtime argued that the High Court’s rigid literal approach to interpreting claims, especially where clerical errors and inconsistencies were obvious, ought to be rejected. • Inventive Step & Prior Art: Kingtime argued that the High Court’s finding of a lack of inventive step ought to be overturned due to lack of expert evidence and improper mosaicking of prior art. The analysis must be grounded in the perspective of a person skilled in the art without the benefit of hindsight. What’s next? With damages now headed back to the High Court for assessment, the financial implications for Petronas Carigali could be significant. But beyond the numbers, this case sets a powerful precedent—reshaping how Malaysian courts approach patent enforcement, claim interpretation, and remedies. For inventors, legal practitioners, and corporations navigating the complex world of IP, Kingtime v Petronas Carigali is more than a case—it’s a new chapter in Malaysian patent law. Our partner and head of IP practice, Lee Lin Li and senior associate, Lim Jing Xian, together with a team of brilliant lawyers acted for Kingtime. For further information on the matters discussed above or intellectual property law generally, please get in touch with Lee Lin Li, our partner and head of IP practice. The information in this article is intended only to provide general information and does not constitute any legal opinion or professional advice.   Written by: LEE LIN LI Partner [email protected] LIM JING XIAN Senior Associate [email protected]