# Online Harassment Law in Malaysia: What ONSA Changes > Online harassment in Malaysia now meets two laws: the Online Safety Act 2025 for platforms and Penal Code sections 507B to 507G for harassers and doxxing. - URL: https://www.awarexone.com/research/online-harassment-malaysia-law-online-safety-act - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-05 - Topics: Online safety, Content removal, Malaysia - Related service: Social media content removal: https://www.awarexone.com/social-media-recovery/social-media-content-removal ## Short answer Malaysia has two laws for online harassment. The Online Safety Act 2025, in force since 1 January 2026, binds licensed platforms, not users. Penal Code sections 507B to 507G, in force since 11 July 2025, make abusive or threatening communication and doxxing crimes. Report on the platform, then to MCMC, and to the police for threats. ## Summary - Two laws now matter to a harassment victim in Malaysia: the Online Safety Act 2025, which binds platforms, and new Penal Code offences, which bind the person harassing you. - The Online Safety Act does not apply to individual users; it requires licensed platforms to give you a reporting tool, acknowledge your report and assess it. - Penal Code sections 507B to 507G, in force since 11 July 2025, cover threatening, abusive or insulting communication and publishing someone's identity information to harass them. - Keep dated evidence, report the content on the platform first, then complain to MCMC, and make a police report for threats, doxxing or anything that makes you fear for your safety. - The platform, MCMC or a court decides; content you simply dislike usually stays up, and false or mass reports can be dismissed. - This article is general information, not legal advice, and a defamation claim is a civil matter that needs a lawyer. Someone keeps posting about you, sending abusive comments, or has shared your address or phone number online. You have heard that Malaysia has a new Online Safety Act and that cyberbullying is now a crime, and you want to know what that actually means for you. The short answer: two separate laws now apply. The Online Safety Act 2025 makes large platforms responsible for handling harmful content, including harassment. The Penal Code amendments make harassment and doxxing offences that the police can investigate. You can use both, side by side. This guide explains each law in plain terms, which report to make first, what each route can and cannot do, and what to avoid. It is general information, not legal advice. For advice on your own situation, speak to a lawyer. Last checked: 5 October 2026. ## What Does Malaysian Law Say About Online Harassment? Malaysia deals with online harassment through two laws that work at different levels. The [Online Safety Act 2025](https://www.mcmc.gov.my/en/onsa/information-hub/about-onsa) (Act 866) came into force on 1 January 2026 and is enforced by MCMC; it places duties on licensed platforms, not on the people who post. The Penal Code (Amendment) Act 2025 came into force on 11 July 2025, according to the [Legal Affairs Division statement](https://dmedia.penerangan.gov.my/upload/sm/11072025.1277949580.pdf), and added sections 507B to 507G, which cover threatening, abusive or insulting communication and the spreading of personal information to harass someone. In practice, you report the content to the platform and to MCMC under the first law, and you make a police report under the second when there are threats or doxxing. ## Two Laws, Two Jobs: A Side-by-Side View People often mix the two up because both were in the news around the same time. This table separates them. *General information based on MCMC's ONSA pages, the Act's text and the Legal Affairs Division statement at the time of writing. Not legal advice.* | | Online Safety Act 2025 | Penal Code sections 507B to 507G | | --- | --- | --- | | Who it binds | Licensed platforms and network providers | Any person who harasses, threatens or doxxes | | In force | 1 January 2026 | 11 July 2025 | | Who enforces it | MCMC | The police, then the prosecution and courts | | What it can lead to | A platform or MCMC making content inaccessible | An investigation and possible criminal charge | | Where you start | The report button on the platform, then aduan.mcmc.gov.my | A police report at a station | | Does it remove the post? | It can, if the content is assessed as harmful | Not by itself; pair it with a platform report | ## The Online Safety Act 2025: Duties on Platforms, Not Users MCMC's [ONSA FAQ](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/ONSA-FAQ-English.pdf) is direct about this: all regulatory obligations apply to licensed service providers, and the Act does not apply to individual users. It also says that internet messaging or social media services with eight million or more users in Malaysia are deemed licensees under the current licensing framework. So the Act does not make a rude comment a crime. What it does is make large platforms answer for how they handle harmful content. Under the [Act itself](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/Online-Safety-Act-2025-Act-866.pdf), a licensed platform must: - Provide a way for users to report content they believe is harmful (section 16). - Offer tools that let you stop or limit other users from identifying, locating or communicating with you (section 15). - Run a user assistance channel for online safety concerns and questions (section 17). - Acknowledge each report, tell you its status in writing and assess it (section 21). - Publish an Online Safety Plan explaining its safety measures (section 20). The time limits for these steps are left to regulations, so the Act itself does not promise a reply within a set number of days. ## Is Harassment "Harmful Content" Under ONSA? Yes. The First Schedule of the Act lists nine kinds of harmful content. Item five is content that may cause harassment, distress, fear or alarm by way of threatening, abusive or insulting words, communication or acts. MCMC's [ONSA home page](https://www.mcmc.gov.my/en/onsa/home) describes the same category as content that threatens, intimidates or causes distress or alarm. Two other points from the Act matter for harassment victims: - Harassment is harmful content, but not priority harmful content. Only child sexual abuse material and financial fraud are priority items that must be made inaccessible as soon as possible. For harassment, the Act says a platform may make the content inaccessible after assessing it. - The Act does not apply to private messaging features, which section 2 defines as a feature for sending content to a specific and limited number of recipients chosen by the user. Abuse in a direct message or a small private chat may fall outside ONSA's platform duties, although the Penal Code and MCMC's general complaint route still apply. ## What Happens After You Report Under ONSA The Act sets out a path for each report, first at the platform and then at MCMC. Knowing it helps you understand the replies you get. 1. You report the content on the platform. The platform acknowledges it and assesses it. 2. The platform must dismiss a report it considers frivolous, vexatious, not made in good faith or trivial, or one whose subject has already been reported. It must tell you in writing. 3. If your report is dismissed, you can ask the platform to look again and give your reasons. 4. If the platform decides the content is harmful, it may make it inaccessible, and it must notify both you and the person who posted it. 5. Separately, or at the same time, you can report to MCMC. If MCMC decides the content is harmful, it must instruct the platform in writing to make it permanently inaccessible. If you report the same content to both at the same time and the outcomes differ, MCMC's instruction or determination prevails. MCMC's [Reporting and Support page](https://www.mcmc.gov.my/en/onsa/information-hub/reporting-support) says you may report directly to licensed providers such as Facebook, WhatsApp and TikTok through the platform or post, or submit a report to MCMC at [aduan.mcmc.gov.my](https://aduan.mcmc.gov.my/). The Act also lets MCMC tell a platform to restore content it removed, so the system protects lawful speech as well as victims. ## The Penal Code Amendments: Harassment and Doxxing as Crimes The second law targets the person, not the platform. The [Legal Affairs Division statement of 11 July 2025](https://dmedia.penerangan.gov.my/upload/sm/11072025.1277949580.pdf) says the amendments add sections 507B to 507G to deal with bullying, including cyberbullying: threatening, abusive or insulting communication meant to cause emotional distress or fear, and the spreading of personal information without consent, known as doxxing, which can carry a prison term of up to three years. The [Penal Code (Amendment) Act 2025](https://lom.agc.gov.my/ilims/upload/portal/akta/outputaktap/2731052_BI/Penal%20Code%20(Amendment)%20Act%202025%20A1750.pdf) (Act A1750) shows how the sections divide the ground. In outline: - 507B: threatening, abusive or insulting words, communication or acts intended, or known or ought to be known to be likely, to cause harassment, distress, fear or alarm. - 507C: the same kind of words or acts seen or heard by someone likely to feel harassed, distressed, afraid or alarmed. - 507D: making a person believe harm will come to them or someone else, or provoking a person to harm themselves. - 507E: publishing or circulating a person's identity information to cause harassment, distress, fear or alarm. - 507F: publishing identity information to make a person believe harm will come to them or someone close, or to help someone harm them. - 507G: definitions, including identity information as any information that identifies or purports to identify a person. The sections apply "in any manner or by any means", so they cover a comment, a post, a video or a message equally. Whether a particular post meets the legal test is for the police, the prosecution and the courts, not for the victim or the platform. The statement also says enforcement must be fair and must not undermine the freedom of speech protected by the Constitution. ## Which Route Fits Your Situation? Most people need more than one route. This matches common situations to where they usually start. It is a guide, not a legal assessment. *Common harassment situations and typical first steps in Malaysia. General information only.* | What is happening | Start here | Then | | --- | --- | --- | | Insulting or abusive comments on your posts | Report on the platform, block or restrict the account | MCMC complaint if the platform dismisses it | | A page, group or account set up to mock or target you | Report the page or account on the platform | MCMC complaint; police report if it includes threats | | Threats to hurt you or your family | Police report; call 999 if you are in immediate danger | Platform report and MCMC complaint | | Your address, IC number or phone number posted to target you | Police report and a platform privacy or harassment report | MCMC complaint | | Intimate images shared without consent | Police report and the platform's priority reporting form | MCMC complaint | | False statements damaging your reputation | Platform report; speak to a lawyer about defamation | Police report only if there are also threats or harassment | | Abuse in private messages or a small chat | Block, keep evidence, report in the app | Police report; MCMC accepts private messaging complaints | For intimate images, put your safety and the police report first; our guide to [removing intimate images posted without consent](https://www.awarexone.com/research/intimate-image-abuse-removal-malaysia) covers the specialist routes. ## Evidence Checklist Before You Report Every route above runs on evidence. Collect it before you block anyone or before the poster deletes it. MCMC's [complaint steps](https://www.mcmc.gov.my/en/faqs/online-content-problems/what-are-the-steps-required-for-me-to-lodge-a-comp) ask for the specific URLs, screenshots showing the date and time the content was posted, and any police report; for private messaging apps, the sender's and receiver's number or user ID. - The full link to each post, comment, video and profile, copied from the share or copy link option. - Screenshots with the date, time and URL or username visible. Take them on the device where you saw the content. - The username and display name of each account, since display names change easily. - For chat apps, the sender's number or user ID and your own. - A short dated timeline: when it started, what happened, and anything that changed offline. - Every report reference number, rejection email and in-app status update from the platform. - A copy of your police report, if you make one, and of any letter sent to the site owner or moderator. Do not edit or crop screenshots in a way that hides the date or source. Our [evidence guide for harassment reports](https://www.awarexone.com/research/collect-evidence-before-reporting-harassment) goes through capture and storage in more detail. ## Making the MCMC Complaint and the Police Report MCMC's complaint steps say to report to the platform, content owner or moderator first, and that a report from the affected person is prioritised over a third-party one. Then you file at aduan.mcmc.gov.my with the evidence above, attaching copies of what you already sent the platform. Our step-by-step on [lodging an MCMC complaint about harmful content](https://www.awarexone.com/research/mcmc-complaint-harmful-content-how-to) walks through the form. MCMC is not the only agency. Its own enforcement table maps threats to life or property, identity theft and the criminal side of defamation under the Penal Code to the police, and civil defamation under the Defamation Act 1957 to civil action. Content that is grossly offensive, indecent or menacing under the Communications and Multimedia Act 1998 stays with MCMC. For threats and doxxing, a police report is the route that can lead to a charge; our guide to [taking online harassment to the police](https://www.awarexone.com/research/police-report-online-harassment-malaysia) covers what to bring. > Note: **A police report does not remove a post.** A report opens an investigation. It does not, on its own, take content down. Keep the platform report and the MCMC complaint running alongside it, and add your police report number to both. ## What These Laws Will Not Do It helps to be honest about the limits before you start, so a rejection does not feel like the end. - They do not cover content you simply disagree with. Criticism, bad reviews and unflattering opinions are usually lawful, and they usually stay up. - They do not guarantee removal. The platform assesses first, MCMC can overrule it, and courts decide criminal and civil cases. - They do not reward volume. The Act requires platforms and MCMC to dismiss reports that repeat an earlier report or are not made in good faith. - ONSA does not apply to private messaging features, so a direct message campaign may need the Penal Code route instead. - Neither law gives you the right to find out who runs an anonymous account. That information goes to the police through their own legal process, not to the victim. ## Mistakes That Weaken a Harassment Case - Asking friends to mass report the post. Duplicate reports can be dismissed and coordinated reporting can break platform rules. - Filing a false copyright, impersonation or identity claim to force a takedown. That is a false statement, and it can turn the case against you. - Replying, threatening or posting the harasser's details in return. That can itself fall under the same Penal Code sections. - Trying to unmask an anonymous account yourself, or paying someone who offers to hack or trace it. - Paying a "takedown agent" who promises removal. Nobody outside the platform, MCMC or a court can promise that. - Deleting your own messages or blocking before you have captured the evidence. > Warning: **Defamation is different.** If the problem is a false statement that damages your reputation, the main remedy is a civil defamation claim, which needs a lawyer. A lawyer can also advise on a letter of demand or a court injunction. This article cannot assess whether a statement is defamatory. ## When a Case Review Makes Sense Many people can handle a single abusive post alone with the steps above. A second pair of hands helps when the harassment spans several platforms, when reports keep coming back rejected, or when a business or public profile is being targeted. SocialSafe by AwareXone reviews the links and what you have already reported, then prepares rights-based reports through official platform and legal channels only; we never file false or mass reports, and the platform still decides. You can read how our [social media content removal](https://www.awarexone.com/social-media-recovery/social-media-content-removal) service works, and our [Trust Center](https://www.awarexone.com/trust) sets out what we will and will not do. For threats or legal claims, the police and a lawyer remain the right people. ## Frequently Asked Questions ### Is cyberbullying a crime in Malaysia? Yes, in many forms. Since 11 July 2025, Penal Code sections 507B to 507G cover threatening, abusive or insulting communication and doxxing by any means, including online. Whether a specific post is an offence is for the police and courts to decide. ### Can I be charged under the Online Safety Act for what I post? MCMC's ONSA FAQ says the Act does not apply to individual users; its duties fall on licensed platforms. Your posts are still subject to other laws, such as the Penal Code and the Communications and Multimedia Act 1998. ### What is the punishment for doxxing in Malaysia? The Legal Affairs Division says doxxing under the amended Penal Code can carry a prison term of up to three years. In the amending Act, that maximum applies to section 507E, while section 507F carries up to one year. The exact charge and sentence depend on the facts and are decided by the courts. ### Does ONSA cover harassment in WhatsApp or Telegram chats? The Act does not apply to private messaging features sent to a specific and limited group chosen by the user. MCMC still accepts complaints about content circulated on private messaging apps, and a police report is possible under the Penal Code. ### Can MCMC tell me who is behind an anonymous account? Nothing in the Act gives a victim that right. If identifying the person matters for a criminal case, that is for the police to pursue through their own powers. ## Official sources - [MCMC: About ONSA (read 5 October 2026)](https://www.mcmc.gov.my/en/onsa/information-hub/about-onsa) - [MCMC: Online Safety Act 2025, ONSA home (read 5 October 2026)](https://www.mcmc.gov.my/en/onsa/home) - [MCMC: Frequently Asked Questions, the Online Safety Act 2025 (read 5 October 2026)](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/ONSA-FAQ-English.pdf) - [Laws of Malaysia: Online Safety Act 2025, Act 866 (read 5 October 2026)](https://www.mcmc.gov.my/skmmgovmy/media/General/pdf2/Online-Safety-Act-2025-Act-866.pdf) - [MCMC: ONSA Reporting and Support (read 5 October 2026)](https://www.mcmc.gov.my/en/onsa/information-hub/reporting-support) - [MCMC: What are the steps required for me to lodge a complaint regarding online content? (read 5 October 2026)](https://www.mcmc.gov.my/en/faqs/online-content-problems/what-are-the-steps-required-for-me-to-lodge-a-comp) - [Attorney General's Chambers: Penal Code (Amendment) Act 2025, Act A1750 (read 5 October 2026)](https://lom.agc.gov.my/ilims/upload/portal/akta/outputaktap/2731052_BI/Penal%20Code%20(Amendment)%20Act%202025%20A1750.pdf) - [Legal Affairs Division, Prime Minister's Department: Enforcement of the Penal Code (Amendment) Act 2025 and Criminal Procedure Code (Amendment) Act 2025 on cyberbullying, 11 July 2025 (read 5 October 2026)](https://dmedia.penerangan.gov.my/upload/sm/11072025.1277949580.pdf) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.