Legal Insight by HHQ

Cybercrime has evolved far beyond traditional hacking. From ransomware and identity theft to AI-enabled threats and attacks on critical systems, Malaysia’s legal framework is evolving with it.

In this episode of The Legal Insight Podcast, our Technology Practice Group Partners, Ong Johnson and Lo Khai Yi, together with Principal Associate Winn Wong, join host Nicole Goh to unpack the Cyber Crimes Bill 2026 and what the new framework could mean for businesses.

💡 The discussion covers why the Bill is being introduced, the key cyber activities it seeks to criminalise, new enforcement powers, and how incidents such as unauthorised access and data breaches may trigger multiple legal considerations at the same time.

The team also explores how the Bill sits alongside Malaysia’s existing Personal Data Protection Act and Cyber Security Act 2024, particularly where personal data or National Critical Information Infrastructure (NCII) is involved.

For in-house legal, compliance and technology teams, the message is simple: cyber incidents rarely involve just one area of law. Understanding how these frameworks work together is becoming an increasingly important part of incident preparedness and response.

🔔 Don’t forget to like, subscribe and turn on notifications to stay updated with the latest episodes of The Legal Insight Podcast.

Buy Now, Pay Later (BNPL) has become a familiar part of how consumers pay. With the Consumer Credit Act 2025 now in force, the rules governing BNPL providers in Malaysia have changed significantly.

 

In this episode of The Legal Insight Podcast, our Technology Practice Group Partners, Ong Johnson and Khai Yi Lo, together with Principal Associate Winn Wong, join host Nicole Goh to break down the new regulatory framework and what BNPL providers need to know.

 

💡 The discussion covers the transitional period for existing providers, how BNPL differs from money lending, key licensing and operational requirements, and new expectations around advertising, pricing and customer disclosures. The team also explores what these requirements mean for customer onboarding and the wider BNPL journey.

 

For BNPL providers, the message is clear: compliance needs to be reflected not just in policies, but in how the business operates and engages with consumers every day.

 

Stay tuned for Part 2 as we continue the conversation on the Consumer Credit Act and its impact on the BNPL industry.

 

🔔 Don't forget to like, subscribe and turn on notifications to stay updated with the latest episodes of The Legal Insight Podcast.

Many organisations only start thinking about personal data protection after a new system has been launched or, worse, after a data breach has occurred. By then, the damage may already have been done.

The newly issued Data Protection by Design (DPBD) Guideline encourages a different approach: embedding privacy into systems, products and business processes from the very beginning.

In the final instalment of our PDPA Guidelines Series, our Technology Practice Group Partners, Ong Johnson and Khai Yi Lo, join host Zach Shaw to unpack the DPBD Guideline and discuss what it means in practice for organisations.

💡 The conversation explores how businesses can integrate the seven Personal Data Protection Principles into every stage of the personal data lifecycle, from collection and disclosure to retention and disposal. It also highlights why effective governance, senior management commitment and cross-functional collaboration are essential to making privacy part of everyday decision-making, rather than a compliance exercise.

🔔 Don’t forget to like, subscribe and turn on notifications to stay updated with the latest episodes of The Legal Insight Podcast.

As organisations increasingly adopt AI and automated technologies to support decision-making, questions around transparency, accountability and individual rights are becoming more important than ever.

What exactly is Automated Decision-Making and Profiling (ADMP)? How does it relate to AI? When does it become high risk, and when will it trigger a Data Protection Impact Assessment (DPIA)?

In this second instalment of our PDPA Guidelines Series, our Technology Practice Group Partners, Ong Johnson and Khai Yi Lo, join host Zach Shaw to unpack the newly issued ADMP Guideline and discuss how organisations should assess the risks arising from AI-powered decision-making and profiling activities.

💡 From automated CV screening and insurance underwriting to AI-driven risk assessments, organisations must understand when ADMP may significantly affect individuals and the additional transparency obligations that may follow.

🔔 Don’t forget to like, subscribe and turn on notifications to stay updated with the latest episodes of The Legal Insight Podcast.

Following the release of the new Data Protection Impact Assessment (DPIA) Guidelines by the Department of Personal Data Protection, organisations are now expected to take a more structured and risk-based approach towards personal data processing.

But what exactly is a DPIA, when is it required, and how should organisations approach it in practice?

In this episode of The Legal Insight Podcast, our Technology Practice Group Partners, Ong Johnson and Lo Khai Yi, join host Zach Shaw to unpack the practical implications of the new DPIA Guidelines and what organisations should be paying attention to moving forward.

💡 As regulatory expectations continue to evolve, organisations will need to move beyond compliance on paper and focus on practical implementation, risk management and accountability in data governance.

🔔 Don’t forget to like, subscribe and turn on notifications to stay updated with the latest episodes of The Legal Insight Podcast.

In this Part 2 of our discussion on Corporate Liability under Section 17A of the MACC Act 2009, we move beyond the fundamentals and focus on what directors and senior management must do to protect their organisations from corporate liability.

As enforcement under Section 17A continues to evolve, companies can now be held liable for corrupt acts committed by employees or associated persons. This makes governance, oversight and compliance more critical than ever. The discussion highlights the statutory defence of “adequate procedures” and why policies, trainings, monitoring and enforcement must go beyond paper compliance.

We sit down again with:

• Mr Ankit Sanghvi, Partner and Head of ESG at Halim Hong & Quek
• Ms Cynthia Gabriel, founder of Cynthia Gabriel & Associates, and award-winning anti-corruption and human rights advocate

Corporate liability is no longer just a legal risk. It is a call for stronger governance, accountability and integrity across organisations operating in Malaysia.

Following Part 1, where we explored the fundamentals of tokenised money, the focus now shifts to where real value can be unlocked and how financial institutions can position themselves within this evolving ecosystem.

While the concept is gaining traction, the key question remains: where are the practical opportunities, and how can they be implemented?

In this episode of The Legal Insight Podcast, our Technology Practice Group Partners, Ong Johnson and Lo Khai Yi, join host Zach Shaw to examine how tokenised money moves beyond theory into real-world application.

In this discussion, we explore:
✅ Why cross-border payments and remittance are widely viewed as key use cases
✅ How tokenised money enables near real-time (T+0) settlement across jurisdictions
✅ The legal and regulatory considerations involved in cross-border transactions
✅ The growing role of digital asset custody and its importance in risk management
✅ How tokenisation extends into capital market products such as bonds and sukuk
✅ The role of regulatory sandboxes in shaping Malaysia’s future framework

💡 Tokenised money is not just about issuing tokens. It is about solving real inefficiencies in today’s financial system and supporting a more efficient and connected financial ecosystem.

🔔 Don’t forget to like, subscribe, and turn on notifications to stay updated with the latest episodes of The Legal Insight Podcast.

For decades, corruption was seen as a crime committed only by individuals inside a company. But with the introduction of Section 17A of the Malaysian Anti-Corruption Commission Act 2009, the landscape has shifted dramatically. Corporations themselves can now be held criminally liable for bribery. The only defence? Proving that “adequate procedures” were in place.

This episode explores why Section 17A is a gamechanger for boards and directors by transforming anti-corruption from a compliance add-on into a survival imperative.

We sit down with:

• Mr Ankit Sanghvi, Partner and Head of ESG at Halim Hong & Quek
• Ms Cynthia Gabriel, founder of Cynthia Gabriel & Associates, and award-winning anti-corruption and human rights advocate

They unpack:

• Why corporate liability under Section 17A changes the rules of the game in Malaysia’s anti-corruption landscape
• How the TRUST principles provide a practical framework for boards to operationalize compliance and protect themselves against liability
• What the Pristine Offshore case revealed about corporate vulnerability and why failure to anticipate bribery risks can trigger liability
• Why directors and boards must recognize that Section 17A makes anti-corruption oversight a non-negotiable responsibility, with personal liability and reputational damage at stake.

Expect clarity, candour and real talk about what Section 17A means for corporations, directors and future of governance in Malaysia.