191 Malaysian privacy notices. 36% are in both languages the Act names. The exempt group does better than the bound one.

01 / The findingThe finding

Two more numbers, because a study that will not tell you what it divided by is not worth reading:

• 429 .com.my sites were on the list to check. Only 329 answered us and gave us something we could read.
• 107 of those 329 (33%) had no privacy notice we could find this way, in any language at all.

And here is the number that changes how you read all the others:

02 / The lawThe law, verbatim

Here is the piece of law the whole study is about, printed word for word: first in English, then the same subsection in Bahasa Melayu, as the Act itself prints them.

The line under it is the way lawyers point at a law. Read it as: section 7, subsection 3, of the Personal Data Protection Act 2010, which also carries the number Act 709.

Personal Data Protection Act 2010 (Act 709), s.7(3):

[read: UNDANG-UNDANG MALAYSIA_AKTA_PERLINDUNGAN_DATA_PERIBADI_2010_709_MALAY_AND-ENG_V2022.pdf, pp. 18 (BM) and 19 (EN), published by the Personal Data Protection Department (JPDP) at pdp.gov.my @ 2026-09-02]

In plain words, that says two things. One: if you have to give people a privacy notice, it has to be written in Malay and in English, both of them. Two: where a person has a choice to make, they must be given a clear and easy way to make it, and that too must be in Malay and in English.

Four points about how those words are read, and they decide what this study is allowed to claim.

1. The subsection has two halves, and only one of them comes with an escape clause. Lawyers call each half a limb.

The notice half reads "shall be in the national and English languages". Nothing softens it. There is no "if", no "where possible", no "where practical". The choice half is the one carrying "where necessary" / "jika perlu", which is the same phrase in Malay. So the escape clause belongs to the choice half. It does not reach the notice half.

The half we counted is the half with no escape clause. We did not measure the second half: consent tick boxes in both languages, preference pages, opt-out keywords. So a site counted as passing above may still fail s.7(3) on the half nobody tested.

2. The rule is still in force, and the 2024 changes did not water it down. The Act was amended by a law called A1727. We read the whole of it and listed every section it changes: ss. 4, 5, 9, 16, 21, 48, 67, 129 and 136 of the original Act, and no others. Section 7 is not on that list. It stands exactly as printed above. [read: full-text scan of Akta A1727 for every "Pindaan seksyen" heading, pdp.gov.my @ 2026-09-02]

3. It has teeth, through a chain of sections most summaries skip. Section 7 is what the Act calls the Notice and Choice Principle. s.5(1)(b) says a data controller must obey that principle, and a data controller is whoever decides what happens to the personal data. s.5(2) makes breaking it an offence. A1727 raised the maximum from RM 300,000 and 2 years to RM 1,000,000 and 3 years. [read: Akta A1727 "Pindaan seksyen 5" s.4(b)(ii) @ 2026-09-02]

4. Government is let out, and the Act says so in as many words. s.3(1): "This Act shall not apply to the Federal Government and State Governments." There is nothing to interpret there. Government bodies do not owe this duty at all.

That is why .gov.my sites appear here only as something to measure against, and why they are labelled all the way through as owing nothing. It is also what makes the comparison interesting rather than accusing.

So who does owe it? A data controller handling personal data as part of "commercial transactions". Section 4 of the Act defines those as "any transaction of a commercial nature, whether contractual or not, which includes any matters relating to the supply or exchange of goods or services, agency…".

Read plainly: if you are doing business with people and you hold their personal details, this is about you. Note the words "whether contractual or not". Nobody has to have signed anything.

03 / MethodWhat we measured, and what we had to change to measure it

We did not measure the group of sites we set out to measure, and the reason matters. The plan was to use Malaysia's official registers: private clinics, private schools, licensed hotels, registered valuers. Every one of those registers gives you a name, an address and a phone number. Not one of them gives you a URL.

The Ministry of Health's private clinic lists are PDFs, one per state, last updated in December 2020. Both MOTAC register links in our own notes now answer 404, which means the page is no longer there.

Turning a line in a register into a working web address is the step that kills studies like this one. Every cheap way of doing it was shut to us by a robots.txt we had already promised to obey. A robots.txt is a short file a website leaves at its own front door, listing which parts of it automated visitors may read. Tranco says no to /list/, Overpass says no to /api/, Common Crawl says no to /, meaning the whole site, and Bursa Malaysia will not even hand over its robots.txt, answering with a 403.

So what we measured instead is every site in the Majestic Million whose registered name ends in .my. There were 1,233 of them.

We then sorted them by the word sitting in front of the .my, which in Malaysia is not a free-for-all: MYNIC, which sets the rules for Malaysian web addresses, keeps those levels apart on purpose. .com.my is the business one and it carries the headline. .gov.my is the one we compare against. The rest are reported on their own.

How we decided a page was in Malay, and why we did not use a language detector. A Malaysian privacy page written entirely in English is still full of Malay words, because the names are Malay: Jalan Bukit Bintang, Wilayah Persekutuan, Sdn Bhd, Petaling Jaya. Feed that page to an off-the-shelf language detector and it reports some Malay on a page that does not contain one Malay sentence.

So we did it another way. We counted only the small joining words that a language cannot do without: yang, dan, untuk, dengan, adalah, kepada, tidak, atau, anda, kami, boleh, oleh, daripada, hendaklah. Those turn up constantly in real writing and never in a street address or a company name. Linguists call them closed-class function words.

A language counts as present only at ≥30 occurrences and ≥3.0% of tokens: at least 30 of those words on the page, and at least 3.0% of all the words on the page. Real Malay writing sits far above 3%, so that bar is deliberately low, and it is low on purpose: every borderline call was set to favour the site. The number being published is a failure rate, so the tool that produces it has to be tilted against our own headline rather than towards it.

Where a notice is split over two pages, we followed it. Plenty of Malaysian sites do it that way: one page in English, another in Malay, each linking to the other. A test that only ever looked at one page would call those sites English-only, and that would be a false accusation. On 256 sites we fetched the second page as well and counted the two together.

Where we measured from: Petaling Jaya, Selangor, Malaysia (AS9930). A Malaysian study, measured from a Malaysian internet connection. Some sites serve different pages to visitors from different countries. Run this from abroad and the numbers would have been telling you where we were sitting, not what is on their websites.

04 / The numbersThe numbers

.com.my, the business group. All 429 of them, including the ones we never managed to read.

Now every group side by side, counting only the notices we found and read:

05 / Three surprisesThree things in the data that we did not expect

1. Being a bigger site does not help. Our list is the most linked-to end of the Malaysian web. Before running anything we wrote down what we expected: that these sites would do better than the rest of the Malaysian web, which would make the result a lower bound, the best case rather than the middle. They do not. Sort them by how linked-to they are and the result barely moves:

That is our own expectation failing its own test, so it is printed as loudly as the headline is. Among these sites, being bigger and better resourced does not predict whether the notice is in both languages. It also means the "lower bound" claim is not supported by this data, and we are not making it.

2. The Malay version of the site exists. The Malay version of the notice does not. Several English-only sites in the hand audit run a fully working language switcher. Following it does nothing. Three of them serve a Malay-labelled URL, one of them under a /ms/ path and two under an explicit language parameter, and every one returns the identical English text, scoring zero Malay function words on the same lexicon used for the whole study. On one of the three, the Malay page and the English page are the same length to the token. The infrastructure for a Malay notice is already built and paid for. The notice was simply never translated into it.

3. The group that is let off does better than the group that is bound. Government sites sit outside the Act completely, and 49% of them carried both languages, against 36% of the business sites.

They probably did not do it to follow the privacy law. They did it out of an older habit: a different law, the National Language Act, has government bodies publishing in Bahasa Melayu first. It shows. 39% of government notices were Malay only. If s.7(3) bound them, that would be a fail, for the missing English. It does not bind them.

06 / Instrument errorHow wrong our own measuring could be

Does it give the same answer twice? We checked, twice over. Every site was scanned a second time. Across 1,233 domains measured in both runs, 23 outcomes differed (1.9%) and exactly one language verdict changed (0.1%). Every other disagreement was a site that answered us on one run and not on the other. That is the internet having a bad minute, not our counting changing its mind.

The headline number barely moved between the two runs:

Then, by accident, we got a second test of the same thing. A bug in our own script made 544 domains get measured twice inside run 1, minutes apart, by two separate copies of the program running the same locked-down code: 543 of 544 identical (99.8%), zero language verdicts changed. So two separate checks of whether the tool repeats itself, and they agree with each other.

Checking it by hand. We took 40 of the tool's verdicts, spread across every kind of outcome, picked at random by the computer from a fixed starting number so the same 40 can be drawn again. Then a person went back to each live page and judged it again: 40 of 40 correct, including 16 of 16 in the PRIVACY_EN_ONLY group the headline rests on.

Before the run we had written down the rule that would make us pull the headline: if more than 10% of the sites we called non-compliant turned out to be compliant, the number comes down. That did not happen, so the number stands.

The honest problem with that check: it was not independent. The people who judged those pages again are the same people who built the tool. So it rules out the mistakes we thought to look for. It cannot rule out a mistake we are all making together and none of us can see. A second pair of eyes, from outside, would be worth more here than checking more sites ourselves.

07 / Blind spotsWhat this method cannot see

We wrote this list before the run, not after seeing the results.

1. A language switch that only works once the page runs its own code. Some sites change language without ever putting out a real link: there is no <a href> for us to follow and no hreflang tag announcing that another language exists. If that is the only route to a site's Malay notice, we score that site English-only. This is the largest weakness we know of, and the way we measured cannot tell you how big it is.
2. A notice sitting on a subdomain, or on a parent company's site, that nothing we followed ever pointed us to.
3. Anything behind a login, behind a cookie box you have to accept first, or behind a block on visitors from other countries. We never log in to anything.
4. Sites that are really an app, where the page arrives nearly empty and fills itself in afterwards. 55 domains (4.5%) sent us under 400 characters of readable text. We left those out of the sum altogether, out of the top of it and out of the bottom of it, rather than counting them as failures.
5. A real notice in both languages that falls under our bar for length. This happened, and the hand check caught it. One site's /privasi page is a genuine Malay notice of 666 characters, carrying 23 of our joining words. The floor we fixed before the run was 30. So that page is recorded as unscoreable, not as passing.
6. How good the Malay is. We measured that Malay writing is on the page. We did not measure whether it is complete, whether it is accurate, or whether it says the same thing as the English rather than being a shorter, different document.
7. The whole second half of s.7(3): the clear and easy way to make a choice, in both languages. We did not test a single site for it.
8. Whether a site with no privacy page gives notice some other way. s.7(1) asks for a written notice at the moment the details are collected, and a form can carry that notice on itself, right there. NO_PRIVACY_PAGE_FOUND means we could not find a published notice. It does not mean no notice was given.
9. Whether the business behind the site is a Malaysian data controller at all, which is who this duty falls on. A .com.my address is a strong hint, not proof. MYNIC's rules about who is allowed one were not verified for this run.

08 / Prior workPrior work, honestly

We searched on 2026-09-02 and did not find anyone who had published this number: how many sites, in a named group you can count, meet s.7(3). That is a much narrower thing to say than "nobody has studied this", and the narrow one is the true one.

Work close to this does exist, and it has been through academic review. It includes Legal Compliance Assessment of the Malaysian Health Sector Through the Lens of Privacy Policies and Compliance to personal data protection principles: A study of how organizations frame privacy policy notices. We could not get hold of the full text of either.

We treat "nobody has done this before" as a claim that has to be traced back to a source, exactly like any other statistic. That is our own rule, in Claim Provenance Register.

09 / Crawl postureCrawl posture: how we behaved while doing this

We set this out because in Malaysia it is part of the legal position, not good manners.

The Computer Crimes Act 1997, s.2(5)(b), catches a person who "exceeds any right or consent" to get at a computer. Read that phrase twice. It is not only about breaking in. Going further than you were allowed to go is enough on its own.

And s.8 puts a reverse onus on anyone holding data they are not authorised to hold. A reverse onus means the usual burden is flipped: they have to show they were allowed the data, instead of someone else having to show they were not.

Evidence of good behaviour is worth almost nothing if you assemble it after a complaint arrives. So we produced it while the crawl was running.

• A user agent, which is the name a program gives when it asks a site for a page, that said Systems Ninjas and linked to the method page.
• 8,174 requests, about 6.6 per domain. Zero carried an Authorization header, which is the part of a web request that would carry a login. That is recorded on every line of the request log.
• robots.txt obeyed absolutely, reading only the rules a site addresses to everybody, the * group. We never claimed to be Googlebot to get a friendlier set of rules. Where it was unclear we took the strict reading: a 401, a 403 or a 5xx server error on robots.txt was treated as being told to stay out of the whole site. 173 domains (14.0%) were skipped on that basis, and they are reported here, not quietly dropped.
• A 403 is an answer. A 403 means the site refused us. We never asked again, and never went back under a different name.
• We never logged in anywhere, and we never made an account.
• At least 1.5 seconds between requests to the same site, and longer than that wherever a site's own Crawl-delay setting asked for longer.
• Personal details were removed on the way in, not on the way out. Emails and phone numbers were blanked out of the page text before any of it was written to disk. Cloudflare scrambles email addresses on some pages, and we never unscrambled one. /wp-json/wp/v2/users, the address that lists a WordPress site's user accounts, is blocked in our own code.

The Act has something to say about research as well. Under s.45(2)(c), handling personal data "for preparing statistics or carrying out research" is exempted "provided that such personal data is not processed for any other purpose and that the resulting statistics or the results of the research are not made available in a form which identifies the data subject" [read: Act 709 p. 140 @ 2026-09-02].

In plain words, that exemption comes with two conditions attached. Use the data for the research and for nothing else. And do not publish anything that lets a reader work out who an individual is.

Both conditions are built into how this study works: no business measured in this study enters any Systems Ninjas sales list, and nobody is contacted off the back of it.

We name no business as failing, and we never will. Think about what naming one would mean. Every blind spot listed above turns, the moment it is attached to a company's name, into a false statement of fact about that company.

And this is Malaysia. Nobody has to show the statement did them serious harm before they sue: the damage is presumed. On top of that civil case sits a criminal one, carrying RM 500,000.

So reporting only the totals is not us being cautious. It is the only way a tool with our error rate can be published at all. We name a site only where the finding about it is neutral or good, and only where anyone could go and see the same thing again from a record we kept.

10 / What to doWhat a Malaysian operator should take from this

Of everything the Act asks of you, putting the notice in both languages is the cheapest to do. It is also the thing most often missed.

If your site already has a Malay version, your notice is very likely still in English. That was true of every site in our hand check that had a working language switch on it.

And doing it does not finish the job. The second half of the subsection wants the consent tick box, the preferences page and the opt-out keyword in Bahasa Melayu too. That is the half we did not measure, and almost nobody builds it.

Where we stand ourselves, said out loud rather than left to be guessed at: systemsninjas.com passes this test. Our own scan scores it PRIVACY_BOTH, with 177 Malay joining words on the page.

It passes because a script we built writes the Malay section every time, not because anybody remembered to. That is the real lesson here. A rule that has to be remembered reaches about a third of the sites that owe it.