191 Malaysian privacy notices. 36% are in both languages the Act names. The exempt group does better than the bound one.

01 / The findingThe finding

Two supporting numbers, because a study that hides its denominator is not worth reading:

• 429 .com.my domains were in the frame. 329 were reachable and readable at all.
• 107 of those 329 (33%) had no privacy notice discoverable by static fetch in any language.

And the number that reframes the whole thing:

02 / The lawThe law, verbatim

Personal Data Protection Act 2010 (Act 709), s.7(3):

[read: UNDANG-UNDANG MALAYSIA_AKTA_PERLINDUNGAN_DATA_PERIBADI_2010_709_MALAY_AND-ENG_V2022.pdf, pp. 18 (BM) and 19 (EN), published by the Personal Data Protection Department (JPDP) at pdp.gov.my @ 2026-09-02]

Four points of construction, and they decide what this study is allowed to claim.

1. There are two limbs, and only one of them is qualified. The notice limb, "shall be in the national and English languages", carries no qualifier at all. The choice limb carries "where necessary" / "jika perlu". The qualifier sits with the choice limb. So the thing counted here is the unqualified one. We did not measure the second limb (bilingual consent checkboxes, preference centres, opt-out keywords), and a site counted compliant above may still fail s.7(3) on the half nobody tested.

2. The requirement is live and it was not softened in 2024. Act A1727 amends ss. 4, 5, 9, 16, 21, 48, 67, 129 and 136 of the principal Act, and no others. s.7 is untouched. [read: full-text scan of Akta A1727 for every "Pindaan seksyen" heading, pdp.gov.my @ 2026-09-02]

3. It is enforceable, through a chain most summaries skip. s.7 is the Notice and Choice Principle. s.5(1)(b) requires a data controller to comply with it. s.5(2) makes contravention an offence, and A1727 raised that ceiling from RM 300,000 / 2 years to RM 1,000,000 / 3 years. [read: Akta A1727 "Pindaan seksyen 5" s.4(b)(ii) @ 2026-09-02]

4. Government is exempt, by express words. s.3(1): "This Act shall not apply to the Federal Government and State Governments." That is why .gov.my appears here only as a contrast group, labelled throughout as owing no duty. It is also what makes the comparison interesting rather than accusatory.

Who owes it: a data controller processing personal data in respect of "commercial transactions", defined in s.4 as "any transaction of a commercial nature, whether contractual or not, which includes any matters relating to the supply or exchange of goods or services, agency…".

03 / MethodWhat we measured, and what we had to change to measure it

The population is not the one we set out to use, and the reason matters. The plan was Malaysia's professional registers: private clinics, private schools, licensed hotels, registered valuers. Every one of them hands over a name, an address and a phone number, not a URL. The Ministry of Health's private clinic lists are per-state PDFs last updated December 2020. Both MOTAC register URLs in our own backlog now return 404. Resolving a register entry to a website is the step that kills these studies, and every cheap way to do it was closed to us by a robots.txt we had already committed to honouring: Tranco disallows /list/, Overpass disallows /api/, Common Crawl disallows /, and Bursa Malaysia answers robots.txt itself with a 403.

So the frame is every domain in the Majestic Million whose registrable name ends in .my, 1,233 of them, split on MYNIC's structured second level. .com.my is the commercial level and carries the headline; .gov.my is the contrast; the rest are reported separately.

How Malay was detected, and why not with a language identifier. A Malaysian English privacy page is full of Malay-looking proper nouns: Jalan Bukit Bintang, Wilayah Persekutuan, Sdn Bhd, Petaling Jaya. An off-the-shelf language identifier scores those as Malay and reports partial Malay on a page containing no Malay prose whatsoever. So Malay is scored on closed-class function words only (yang, dan, untuk, dengan, adalah, kepada, tidak, atau, anda, kami, boleh, oleh, daripada, hendaklah), which appear in running prose and never in an address or a company name. A language counts as present at ≥30 occurrences and ≥3.0% of tokens. Real Malay prose runs far above 3%, so the bar is deliberately low: every ambiguous call was set to favour the site, because the number being published is a non-compliance rate and the instrument must be biased against its own headline.

Two-page notices are followed. The common Malaysian pattern is one page per language, linked to each other. A single-page test would call that English-only, which would be a false accusation. On 256 domains a second-language page was fetched and folded into the verdict.

Vantage: Petaling Jaya, Selangor, Malaysia (AS9930). A Malaysian study measured from a Malaysian IP. Run from anywhere else, geo-gated content would have made the numbers a property of our egress address rather than of their sites.

04 / The numbersThe numbers

.com.my, the commercial stratum (n = 429)

Every stratum, notices found and read:

05 / Three surprisesThree things in the data that we did not expect

1. Being bigger does not help. The frame is the most-linked end of the Malaysian web, and we pre-registered the expectation that this would bias toward compliance, making the result a lower bound. It does not. Split by Majestic rank, compliance is flat:

That is our own framing failing its own test, so it gets reported at the same prominence as the headline. Within this frame, resources do not predict compliance. It also means the "lower bound" claim is not supported by this data and we are not making it.

2. The Malay version of the site exists; the Malay version of the notice does not. Several English-only sites in the hand audit run a fully working language switcher. Following it does nothing. Three of them serve a Malay-labelled URL, one of them under a /ms/ path and two under an explicit language parameter, and every one returns the identical English text, scoring zero Malay function words on the same lexicon used for the whole study. On one of the three, the Malay page and the English page are the same length to the token. The infrastructure for a Malay notice is already built and paid for. The notice was simply never translated into it.

3. The exempt group does better than the bound group. Government sites are outside the Act entirely, and were bilingual at 49% against commercial 36%. The likeliest explanation is not diligence about the PDPA but the National Language Act habit of publishing in Bahasa Melayu first: 39% of government notices were Malay only, which under s.7(3) would fail for the missing English if they were bound by it, which they are not.

06 / Instrument errorHow wrong is the instrument

Repeatability, measured twice over. The whole population was scanned a second time. Across 1,233 domains measured in both runs, 23 outcomes differed (1.9%) and exactly one language verdict changed (0.1%). Every other disagreement was a site that was reachable on one pass and not the other. Network weather, not measurement.

The headline is materially unmoved between passes:

Separately, a scripting fault caused 544 domains to be measured twice within run 1, minutes apart, by two independent processes running identical frozen code: 543 of 544 identical (99.8%), zero language verdicts changed. Two independent repeatability checks, agreeing.

Hand audit. A seeded random sample of 40 classifications was drawn across outcomes and each was re-adjudicated by re-fetching the live pages: 40 of 40 correct, including 16 of 16 in the PRIVACY_EN_ONLY category the headline rests on. The pre-registered falsification rule (withdraw the point estimate if false non-compliance exceeds 10%) is not triggered.

The honest caveat on that audit: it is not independent. It was adjudicated by the same party that built the instrument. It rules out the errors we thought to look for and cannot rule out a shared blind spot. A second pair of eyes would be worth more than a larger sample.

07 / Blind spotsWhat this method cannot see

Declared before the run, not after.

1. A language toggle implemented purely in JavaScript. If a Malay notice is reachable only through a client-side switcher emitting no <a href> and no hreflang, we score the site English-only. This is the largest known weakness and static fetch cannot bound its size.
2. A notice on a subdomain or a group portal we never linked to.
3. Anything behind a login, a cookie wall, or geo-gating. We never authenticate.
4. Client-rendered applications: 55 domains (4.5%) served under 400 characters of readable text and are excluded from the numerator and denominator rather than counted as failures.
5. A short bilingual notice below threshold. This fired in the audit: one site's /privasi page is a genuine Malay notice of 666 characters with 23 function-word hits, under the pre-registered floor of 30, so it is recorded as unscoreable rather than as compliant.
6. Translation quality. We measured that Malay prose is present, not that it is complete, accurate, or a translation of the English rather than a shorter different document.
7. The second limb of s.7(3) entirely.
8. Whether a site with no privacy page gives notice anyway. s.7(1) requires a written notice at the point of collection, and a form can carry it inline. NO_PRIVACY_PAGE_FOUND means we could not find a published notice; it does not mean no notice is given.
9. Whether the operator is a Malaysian data controller at all. .com.my is a strong proxy, not proof. MYNIC's eligibility rules for .com.my were not verified for this run.

08 / Prior workPrior work, honestly

We did not find a published figure for s.7(3) bilingual compliance across a defined, enumerable population, in a search on 2026-09-02. That is a narrower claim than "nobody has studied this", and the narrower claim is the true one: adjacent peer-reviewed work exists, including Legal Compliance Assessment of the Malaysian Health Sector Through the Lens of Privacy Policies and Compliance to personal data protection principles: A study of how organizations frame privacy policy notices. Neither was retrieved in full. Per Claim Provenance Register, a novelty claim gets traced like any other statistic.

09 / Crawl postureCrawl posture

Because in Malaysia it is part of the legal position, not a courtesy. Computer Crimes Act 1997 s.2(5)(b) reaches a person who "exceeds any right or consent" to access, and s.8 puts a reverse onus on someone holding data they are not authorised to hold. That evidence is worth almost nothing if assembled after a complaint, so it was produced during the crawl.

• A user agent naming Systems Ninjas and linking the method page.
• 8,174 requests, ~6.6 per domain. Zero carried an Authorization header, recorded on every line of the request log.
• robots.txt honoured absolutely, matched on the * group only. We never claimed to be Googlebot. Ambiguity resolved strictly: 401/403 or 5xx on robots.txt treated as a full disallow. 173 domains (14.0%) were skipped on that basis and are reported, not hidden.
• A 403 is an answer. Never retried, never with a different user agent.
• Never authenticated, never created an account.
• ≥1.5 s between requests to the same host, honouring longer Crawl-delay.
• Identifiers stripped at ingestion, not publication: emails and phone numbers redacted in the page body before it touched disk. Cloudflare's email obfuscation was never decoded. /wp-json/wp/v2/users is blocklisted in code.

Under s.45(2)(c) of the Act itself, processing "for preparing statistics or carrying out research" is exempted "provided that such personal data is not processed for any other purpose and that the resulting statistics or the results of the research are not made available in a form which identifies the data subject" [read: Act 709 p. 140 @ 2026-09-02]. Both conditions are design constraints here: no business measured in this study enters any Systems Ninjas sales list, and nobody is contacted off the back of it.

No business is named as failing, and none will be. Every blind spot above would become, if attached to a named company, a false statement of fact about it, in the jurisdiction with no serious-harm threshold, damage presumed, and a criminal overlay at RM 500,000. Aggregate reporting is not caution here; it is the only mode in which this instrument's error rate is survivable. Named examples appear only where the finding is neutral or positive and the observation is reproducible from a retained artefact.

10 / What to doWhat a Malaysian operator should take from this

The notice limb is the cheapest statutory requirement in the Act to satisfy and the most commonly missed. If your site already has a Malay version, the notice is very likely still English, and that was true of every switcher-bearing site in our audit. And satisfying it does not finish the job: the second limb wants the consent checkbox, the preference centre and the opt-out keyword in Bahasa Melayu too, and that is the half we did not measure and almost nobody builds.

Our own position, stated rather than implied: systemsninjas.com passes this test (PRIVACY_BOTH, 177 Malay function-word hits), and it does so because a purpose-built script writes the Malay section rather than because anyone remembered. That is the actual lesson. A compliance rule that depends on being remembered reaches roughly a third of the sites that owe it.