Computer Crimes Act 1997
(Act 563)

Overview

The Computer Crimes Act 1997 (Act 563) was one of Malaysia's earliest pieces of cyber legislation — enacted as part of the MSC Malaysia cyber law framework to provide a legal basis for prosecuting computer-related offences. It was among the first such laws in Asia, reflecting Malaysia's ambition to establish itself as a credible, legally sound destination for technology investment under the Multimedia Super Corridor programme.

The Act addresses offences relating to unauthorised access to computer material, unauthorised access with intent to commit further offences, unauthorised modification of computer contents, and the wrongful communication of access codes. It has been applied in cases ranging from hacking and corporate espionage to more recent social media and cybersecurity-related prosecutions.

Key Offences Under the Act

The Computer Crimes Act 1997 establishes five principal categories of offence, each targeting a different form of computer-related misconduct.

Jurisdiction and Territorial Scope

One of the notable features of the Computer Crimes Act is its broad jurisdictional reach. The Act applies to offences committed in Malaysia and — significantly — to offences committed outside Malaysia where the computer, program, or data involved is located in Malaysia at the time of the offence. This extraterritorial provision reflects the borderless nature of cybercrime and was prescient in anticipating the global reach of computer-related offending.

The Act also applies regardless of whether the accused is a Malaysian citizen — meaning foreign nationals who commit computer crimes targeting Malaysian systems can be prosecuted under the Act if they are present in Malaysia or extradited.

Relation to Other Cyber Laws

The Computer Crimes Act 1997 operates alongside Malaysia's other cyber laws as part of the comprehensive MSC Malaysia legal framework. It works in conjunction with the Communications and Multimedia Act 1998 — which covers content and communications offences — and the Digital Signature Act 1997, which governs the authentication of digital transactions.

In practice, many cyber prosecutions in Malaysia involve charges under both the Computer Crimes Act and the CMA — with the former covering the access or modification offence and the latter covering any communications-related conduct, particularly where social media or online platforms are involved.

The Act in the MSC Malaysia Context

The Computer Crimes Act was one of the five core cyber laws enacted under the MSC Malaysia initiative — alongside the Communications and Multimedia Act 1998, the Digital Signature Act 1997, the Telemedicine Act 1997, and the Copyright (Amendment) Act 1997. Together, these laws fulfilled MSC Malaysia's Bill of Guarantees commitment to becoming a regional leader in cyber law — providing the legal certainty that global technology companies required before establishing operations in the Multimedia Super Corridor.

The Act's enactment in 1997, a full year before the CMA, demonstrated Malaysia's proactive approach to building the legal infrastructure for the digital economy — one of the key factors that distinguished the MSC from comparable initiatives in the region at the time.

Why This Act Is Being Replaced

It feels almost unfair to call the Computer Crimes Act 1997 "outdated," because in its day it was ahead of the curve — Malaysia had a computer crime law before most of its neighbours had even drafted one. But the honest truth is that the Act was written for a world that no longer exists. In 1997, the internet was dial-up, e-commerce was a novelty, the smartphone was still a decade away, and artificial intelligence belonged to science fiction. The Act's drafters pictured a fairly specific kind of wrongdoing: a person gaining access to a computer they had no right to touch, and tampering with what they found.

For nearly thirty years, that compact framework has been asked to do far more than it was ever designed for. Prosecutors have had to stretch provisions written for 1990s hacking over crimes their authors could never have imagined — ransomware gangs that lock up hospital systems, syndicates running billion-ringgit online scams, deepfake videos that clone a real person's face and voice, and the theft and resale of digital identities. Each time, the law has had to be bent to fit, and every bend is a weakness a defence lawyer can exploit.

A few specific gaps made replacement, rather than yet another amendment, the sensible path:

• No language for AI and deepfakes. The single biggest gap. The Act simply has no concept of synthetic or manipulated content, because none existed when it was written — leaving one of today's most damaging harms almost unaddressed.
• Identity theft and online fraud had no clear home. These crimes were prosecuted by borrowing provisions written for other purposes, making cases harder to bring and outcomes less predictable.
• Nothing on the National Digital Identity. As Malaysia rolls out MyDigital ID, the misuse of digital identity credentials needed offences of its own — which a 1997 statute could never have anticipated.
• No duties for service providers, and weak cross-border reach. Modern cybercrime is borderless and flows through platforms and networks; the old Act gave authorities limited tools to compel cooperation or pursue offenders operating from overseas.
• Penalties that no longer matched the harm. The scale of loss from a modern scam operation dwarfs anything contemplated in 1997, and the Act's penalties had not kept pace.

Amending the Act piece by piece would have produced a patchwork — a 1997 skeleton with modern parts bolted on awkwardly. The government chose instead to start fresh with a purpose-built framework: the Cybercrimes Bill 2026, which will become the Cybercrimes Act 2026 once it completes its remaining stages.

The Transition — What Will Change

So what actually happens when the switch is flipped? The short version: the Computer Crimes Act 1997 is repealed in full and replaced by a far broader framework. But the change is more layered than a simple swap, and it's worth understanding how it will play out.

The old Act is repealed — but not erased overnight

Clause 61 of the new Bill expressly repeals Act 563. Importantly, though, any investigation, trial or proceeding already underway under the 1997 Act when the new law commences will continue as if the old Act had not been repealed. And any reference to the old Act sitting inside other laws will be read as a reference to the new one. In other words, nothing in progress falls through the cracks — there's a deliberate bridge from the old regime to the new.

Timing matters — the new law is not in force yet

This is the part people most often get wrong. Passing the Dewan Rakyat is a milestone, not the finish line. The new Act only comes into operation on a date the Minister appoints by notification in the Gazette — after it also clears the Dewan Negara and receives Royal Assent. Until that commencement date arrives, the Computer Crimes Act 1997 on this page remains the law in force. If you're dealing with a matter today, it is still the 1997 Act that applies.

What the change looks like, side by side

Once the new Act commences, here is how the ground shifts:

What it means for you, in plain terms

If you're an ordinary user, the practical effect is broader protection — more of the scams, fakes and identity abuses you might fall victim to will have a clear criminal offence attached to them. If you're a business or platform, expect heightened expectations: the new Act places real duties on service providers and treats data breaches that enable fraud far more seriously. And if you're simply trying to understand which law applies right now, the answer stays simple until commencement — it's still the 1997 Act. For the full picture of the incoming framework, see the Cybercrimes Bill 2026 reference page.