On 13 July 2026 Malaysia Finally Tabled a Freedom of Information Bill. It Says the Official Secrets Act Still Wins.

On 13 July 2026, Datuk Seri Azalina Othman Said tabled the Freedom of Information Bill 2026 for its first reading in the Dewan Rakyat. Malaysians had been waiting years for it.

Within hours, the Centre for Independent Journalism, ARTICLE 19 and the C4 Center put out a joint statement calling for it to be withdrawn.

The reason is in the Bill's own text. Information protected under the Official Secrets Act 1972 stays exempt. The FOI Bill does not override the OSA — it explicitly gives way to it. And the Ombudsman the Bill creates to review refusals is stripped of jurisdiction over exactly the categories of information most likely to involve abuse of secrecy, including OSA material. ARTICLE 19 also noted that the Bill refers to an Ombudsman established under a law that does not exist.

By 14 July the government had agreed to refer the Bill to a Parliamentary Select Committee.

So the honest state of play in July 2026 is this: Malaysia has a Freedom of Information Bill in Parliament, and the Official Secrets Act still sits on top of it.

1. "Official secret" means whatever the government says it means

This is the part that surprises people. The OSA does not define official secrets by reference to national security, harm, or sensitivity. It defines them by reference to who did the classifying.

Section 2 defines an official secret as any document in the Schedule plus any information or material relating to it, and includes any other official document, information or material classified as Top Secret, Secret, Confidential or Restricted by a Minister, the Menteri Besar or Chief Minister of a State, or a public officer appointed under section 2B.

Read that again. "Any other official document, information or material." No qualifier. No limiting principle.

The Schedule itself covers Cabinet documents and records of Cabinet decisions and deliberations, including Cabinet committees, and the state-level equivalents. Under section 2A, the Minister can add to, delete from or amend the Schedule by order published in the Gazette.

Concrete Malaysian examples of things that have been classified: the Auditor-General's report on 1MDB. Highway and water concession agreements. Air Pollution Index readings.

The classification does not even have to be done properly for the material to be protected. In Lim Kit Siang, the Malaysian High Court held that classification is purely for administrative purposes, and wrong classification by the government does not stop the information being protected.

The C4 Center's position paper on the OSA puts the structural point clearly: the Act has neither a harm test nor a public interest exception, and its wide net over all classes of official information means it is not simply a tool to protect national security but also shields officials and public servants from public scrutiny.

2. Section 16A: the certificate no court can look at

If there is one provision to remember, it is this one.

Section 16A says that a certificate by a Minister, by a public officer charged with responsibility in a Ministry or department or public service, by a Menteri Besar or Chief Minister, or by the principal officer in charge of a State's administrative affairs, certifying that a document, information or material is an official secret, shall be conclusive evidence of that fact and shall not be questioned in any court on any ground whatsoever.

What that means in a courtroom:

• Your lawyer cannot argue the document was wrongly classified.
• Your lawyer cannot argue it was classified in bad faith or to cover up wrongdoing.
• Your lawyer cannot argue it contains nothing sensitive.
• The judge cannot look behind the certificate. Not on any ground.

The prosecution produces the certificate. The document is an official secret. Move on.

Malaysian legal commentary has long argued that section 16A sits uneasily with the definition in section 2 itself, and that a mere certification rendering something conclusively secret is internally inconsistent. That argument has not dislodged the provision.

There is a declassification power, and it is the other side of the same coin. The same officials who can classify can, at any time, declassify — and on declassification the material ceases to be an official secret. It is entirely discretionary. Nobody can compel it.

3. The penalties, and why they are unusually harsh

The 1986 amendment, which took effect on 1 January 1987, introduced the mandatory minimum. This is what makes the OSA bite.

No fine option under section 8. A conviction means prison unless an appellate court substitutes something else.

The burden of proof is partly reversed. As the Centre for Independent Journalism has noted, the Act allows arrest and detention without a warrant, and provides that until the contrary is proven, the proscribed activities are presumed to have been undertaken for a purpose prejudicial to the safety or interests of Malaysia.

There is a collateral consequence that matters enormously in politics: Article 48 of the Federal Constitution disqualifies a person from being an MP for five years if they are jailed for more than one year or fined more than RM2,000. Since the OSA minimum is exactly one year, an OSA conviction is very close to a career-ending event for a politician.

4. What an actual OSA prosecution looks like: Rafizi Ramli and page 98

The best-documented Malaysian OSA case of the modern era.

March 2016. Then-Pandan MP Rafizi Ramli held a press conference at the Parliament lobby and disclosed the contents of page 98 of the Auditor-General's report on 1MDB. He said he was showing links between Lembaga Tabung Angkatan Tentera and 1MDB. The report was classified under the OSA and had not been tabled to Parliament.

April 2016. Arrested at the Parliament gates. Remanded three days. Charged on 8 April under section 8(1)(c)(iii) (unauthorised possession) and section 8(1)(c)(iv) (disclosure). Bail RM3,000 with one surety.

November 2016. Sessions Court: guilty on both. 18 months on each charge, to run concurrently.

August 2017. High Court (Justice Azman Abdullah): set aside the possession conviction, upheld the disclosure conviction. The 18 months stood. Stay granted pending further appeal.

GE14 (May 2018). Rafizi did not contest. The unresolved conviction was the reason.

1 June 2018. Court of Appeal (Ahmadi Asnawi, Kamardin Hashim, Abdul Karim Abdul Jalil): set aside the 18-month sentence and substituted a two-year good behaviour bond of RM10,000 with one surety. His counsel argued the sentence was excessive, that the disclosure was not for personal gain, and that by then the 1MDB report had been declassified so there was no continuing threat to national security. The prosecution did not object, and withdrew its cross-appeal against the acquittal on the possession charge.

Note what happened and what didn't. He withdrew his appeal against conviction and appealed only sentence. The conviction stands. He avoided prison. He missed an entire general election.

Rafizi later became Minister of Economy. The material he was prosecuted for revealing was subsequently declassified and the 1MDB scandal became the defining political fact of the decade. That sequence is the single strongest argument the reform lobby has, and it is why the OSA debate in Malaysia is not academic.

5. Why journalists and public servants are the ones actually at risk

Foreign spies are not the OSA's main customers.

Public servants are exposed because the offence attaches to possession and communication, not to intent to harm. If a document you handle at work is classified and you send it to the wrong person, forward it on WhatsApp, or fail to take reasonable care of it, you are within section 8(1). No malice required.

The enforcement environment is real. After a 2018 leak of government documents, the Chief Secretary said the leaker had been identified with MCMC forensic assistance and would lose their job and face punishment under the Act. Departmental discipline runs in parallel with prosecution — the Public Services Commission has its own powers, and losing your job does not require a conviction.

The July 2025 Judicial Appointments Commission minutes leak is a good example of how quickly the OSA gets invoked. A purported excerpt of JAC minutes from May 2025 circulated on Reddit and other platforms. Communications Minister Fahmi Fadzil said that if the document was authentic and classified, the OSA applies. Note the structure of that statement — authenticity plus classification, not sensitivity.

Journalists are exposed at both ends: receiving classified material can constitute wrongful possession, and publishing it can constitute wrongful communication. There is no journalistic privilege in the Act. Academic analysis of the OSA has long noted that an author or journalist searching for material can commit the offence in the ordinary course of their work.

The C4 Center makes a further point that is easy to miss: the OSA does not operate alone. It is reinforced by the Sedition Act, section 203A of the Penal Code (disclosure of information obtained in the performance of official duties), the PPPA and the Communications and Multimedia Act. A single leak can attract several charges.

6. Where the reform actually got somewhere: the whistleblower amendment

The one genuine advance in this area came in 2025, and it is narrower than the headlines suggested.

The Whistleblower Protection Act 2010 had a proviso in section 6(1) which meant that if a disclosure was prohibited by any other written law, the whistleblower got no protection. Since the OSA prohibits disclosure of anything classified, the practical effect was that the WPA never protected the disclosures most worth protecting. Bangi MP Syahredzan Johan put it plainly in July 2025: if you uncover improper conduct in a ministry but the information is classified under the OSA, then even reporting it to an enforcement agency left you unprotected.

The Whistleblower Protection (Amendment) Bill 2025 was tabled by Azalina Othman Said on 6 March 2025, passed unanimously by the Dewan Rakyat on 22 July 2025, and passed by the Dewan Negara on 10 September 2025. It:

• removes the section 6(1) proviso, so a disclosure can be protected even if it is prohibited by another written law such as the OSA
• adds "wilfully" to section 11(1)(a), so protection is revoked only where the whistleblower deliberately participated in the misconduct
• inserts section 11(1A), giving enforcement agencies discretion to maintain protection on public interest grounds
• creates a Whistleblower Protection Committee under a new section 5A
• extends protection through the Witness Protection Act 2009

Two important caveats, and please treat them as caveats rather than footnotes.

First, commencement. Legal commentary published in mid-2026 was still describing the amendment in terms of what it will do "once it comes into force." We have not been able to confirm a commencement date from an official source. Under Article 66(5) of the Federal Constitution, a law does not operate until published, and commencement of an amendment Act is typically set by a separate ministerial order. Check lom.agc.gov.my before relying on the amendment.

Second, more amendments are coming. In December 2025 the Prime Minister announced that further amendments to the WPA would be tabled. Transparency International Malaysia welcomed the stated aim of preventing abuse of whistleblower protections by people evading accountability, while warning that reform focused too narrowly on exclusion risks deterring good-faith reporting. TI-M and the C4 Center have both said the 2025 amendments, while historic, leave gaps: disclosure channels remain restricted to enforcement agencies rather than including civil society, MPs or the media, and there is no obligation on government to provide legal, psychological or social support to whistleblowers.

What the amendment does not do: it does not amend the OSA. It does not create a public interest defence to an OSA charge. It changes whether you get WPA protection; it does not change whether the OSA offence was committed.

7. The FOI push, and why the 2026 Bill disappointed people

Until July 2026, freedom of information in Malaysia existed only at state level — Selangor (2011) and Penang (2012) each have their own FOI Enactments. Both have always been hemmed in by the same problem: a state enactment cannot override a federal Act, so anything classified under the OSA is beyond reach regardless of what the state law says.

The Freedom of Information Bill 2026 was meant to fix that at federal level. On the civil society reading, it does not.

The criticisms, from the CIJ/ARTICLE 19/C4 joint statement and subsequent commentary:

• It is purely procedural — it sets out how to make a request rather than establishing a right to information
• It fails to specify the primacy of the right to information and omits the presumption of maximum disclosure
• OSA-protected information stays exempt, along with other protected documents
• The Ombudsman it creates cannot review refusals in the categories most likely to involve abuse of secrecy, including OSA material
• It refers to an Ombudsman established under a law that does not exist
• Critics argue it would be ineffective in delivering the right to information they say is guaranteed by Article 10(1)(a) of the Federal Constitution

The government's position is different and worth stating fairly. Azalina said referring the Bill to a Parliamentary Select Committee was consistent with the government's approach to major institutional reform — building a comprehensive and balanced framework rather than passing a single law — and that the government had noted CSO concerns and would hold engagement sessions with stakeholders and MPs from both sides before the second and third readings.

Whether the right to information is constitutionally guaranteed under Article 10(1)(a) is itself contested. Article 10(1)(a) protects freedom of speech and expression. Whether that necessarily includes a right of access to government-held information is an argument civil society advances; it has not been established by a Malaysian court, and we are not going to pretend otherwise.

8. The repeal debate: where the two sides actually stand

This has been running since at least the 1980s. Set out plainly:

The case for repeal or major reform:

• No harm test means trivial and serious disclosures are treated identically
• No public interest defence means exposing corruption is legally identical to selling secrets to a foreign power
• Section 16A ousts judicial review entirely, which sits awkwardly with the courts' constitutional role
• Mandatory minimum imprisonment removes judicial discretion even where the disclosure caused no harm
• The classification power is effectively unlimited and its exercise is unreviewable
• The 1MDB sequence shows the Act protecting officials rather than the nation

The case for retention, or for reform rather than repeal:

• Cabinet confidentiality is a genuine requirement of collective ministerial responsibility in a Westminster system
• Genuine national security, defence and diplomatic material needs statutory protection with real deterrence
• A harm test requires the harm to be proved in open court, which can compound the original disclosure
• Malaysia is not unusual in having an official secrets regime; the UK, Singapore and others have comparable statutes with colonial roots
• Declassification and improved classification discipline can address over-classification without dismantling the Act
• Whistleblowing is better handled through a properly functioning WPA than by weakening the OSA

We are not going to adjudicate that. It is a live political argument in Malaysia with serious people on both sides, and where you land depends on how much you weight government effectiveness against public accountability.

What to actually do

If you're a civil servant:

• Assume any document marked Rahsia Besar, Rahsia, Sulit or Terhad is caught by the Act, and treat unmarked internal material with the same care — wrong or absent classification is not a defence.
• Do not forward classified material on WhatsApp, personal email or any personal device. Failing to take reasonable care is itself within section 8(1).
• Departmental discipline is separate from prosecution. You can lose your job without ever being charged.
• If you believe you have found improper conduct, get legal advice before disclosing anything. The WPA route and the OSA exposure are different questions and the answer to one does not answer the other.

If you're a journalist:

• Receiving classified material can be wrongful possession. There is no journalistic privilege in the OSA.
• The Act can be charged alongside section 203A of the Penal Code, the Sedition Act, the PPPA and the CMA.
• Take legal advice before publication where classified material is involved. Not after.
• Publish the story, not necessarily the document, where the story can be told without reproducing classified material — though be aware this is risk reduction, not immunity.

If you want to see a government document:

• Check whether Selangor or Penang state FOI applies — those enactments are real and usable for state-held information.
• Federally, watch the Freedom of Information Bill 2026 through its Select Committee stage. It is not law yet.
• Parliamentary questions remain a practical route: an MP can ask, and answers are on the record.
• The Auditor-General's reports that have been tabled are public. Ones that have not been tabled generally are not.

If you are considering blowing the whistle:

• Read section 6 and section 11 of the Whistleblower Protection Act 2010 as amended, and verify whether the 2025 amendment is actually in force at lom.agc.gov.my.
• Under the WPA as it stands, protected disclosure channels are enforcement agencies — MACC, police and the like. Disclosure to the media or an MP does not attract the same protection.
• Get independent legal advice first. This is the one situation on this page where doing it wrong can put you in prison.