Whistleblowing policy Malaysia: the 2010 Act, its limits and a speak-up channel that works

What the Whistleblower Protection Act 2010 covers

The Whistleblower Protection Act 2010 (Act 711) received Royal Assent on 2 June 2010. It lets any person disclose improper conduct to an enforcement agency when they reasonably believe someone has engaged, is engaging or is preparing to engage in it (section 6).

• Improper conduct is any conduct which, if proved, would be a criminal offence or a disciplinary offence. A disciplinary offence includes a breach of a code of conduct, code of ethics, circular or contract of employment in a public or private body.
• An enforcement agency is a government ministry, department or body, or a body set up by law, that has investigation and enforcement functions. Examples are the MACC, the police, DOSH and other regulators.
• The disclosure can be oral or in writing, can be made even if the reporter cannot name the person involved, and can cover conduct that happened before the Act started.
• Any term in an employment contract that tries to stop a person making a disclosure is void (section 6(5)).

Once the agency receives the disclosure, the whistleblower gets three protections under section 7: protection of confidential information, immunity from civil and criminal action, and protection against detrimental action. The protection does not lapse just because the report leads to no disciplinary action or prosecution.

The limits every employer should understand

The Act is narrower than many staff assume. A good policy explains these limits honestly rather than promising protection the law does not give.

Two features help reporters. Detrimental action includes discharge, demotion, suspension, harassment, intimidation and threats, and it is an offence to take it, or to incite or permit someone else to take it, in reprisal for a disclosure. And in proceedings, the burden is on the defendant to prove that the action was not a reprisal (section 10(7)).

The 2025 amendments: what changes and where they stand

The Whistleblower Protection (Amendment) Bill 2025 was tabled for first reading on 6 March 2025 and passed by the Dewan Rakyat on 22 July 2025. Reported changes include:

• Removal of the section 6(1) proviso, so a disclosure is no longer excluded only because another written law prohibits it, provided it is made responsibly and meets the conditions in the Act.
• A new section 11(1A) giving enforcement agencies discretion to keep a whistleblower’s protection on public interest grounds.
• A Whistleblower Protection Committee to make implementation more systematic.
• Physical protection through the Witness Protection Act 2009 for whistleblowers who are threatened, subject to conditions.

An amendment takes effect only once it is gazetted and brought into force. In December 2025, Transparency International Malaysia said the 2025 amendments had yet to come into force, and the Prime Minister told the Dewan Negara that further amendments would be tabled in 2026. We could not confirm a commencement date or a 2026 bill at the time of review, so check the Federal Gazette and the Legal Affairs Division (BHEUU) before relying on the new provisions.

Governance expectations: MACC s17A and Bursa listing rules

Even where the Act does not apply, other rules expect a working speak-up channel:

• MACC Act section 17A. The government’s Guidelines on Adequate Procedures list a confidential reporting channel that can be used anonymously, with no retaliation, as one of the control measures that support the adequate procedures defence. For a small organisation, the Guidelines say this can be as simple as a dedicated e-mail address. See our guide to section 17A of the MACC Act.
• Bursa Malaysia listing rules. Since 1 June 2020, paragraph 15.29 of the Main Market Listing Requirements (Rule 15.28 for the ACE Market) requires a listed issuer and its board to establish and maintain whistle-blowing policies and procedures for the group, review them at least once every three years and publish them on the company website.

Unlisted companies are not bound by the listing rules, but lenders, customers and auditors increasingly ask for the same evidence: a written policy, a channel people use, and records of how reports were handled.

What a good whistleblowing policy contains

1. Scope. What can be reported (bribery, fraud, safety breaches, harassment, data misuse, breaches of law or the code of conduct) and who can report: employees, contractors, suppliers and the public.
2. Channels. At least two routes, one of which bypasses line management, for example a dedicated e-mail or web form and a named independent director or audit committee chair. Allow anonymous reports.
3. Confidentiality. Who sees the reporter’s identity, and that it is shared only when needed and with consent where possible.
4. No retaliation. A clear statement that retaliation is a disciplinary offence, with examples, and a route to report it.
5. External route. Tell people they can also disclose to an enforcement agency such as the MACC, and that statutory protection under Act 711 attaches to that route.
6. Process and timelines. Acknowledgement, assessment, investigation, outcome and feedback to the reporter as far as confidentiality allows.
7. Grievances are different. Personal employment complaints go through the grievance procedure. Say so, and route them there without dismissing the person.
8. Oversight and review. Who reports statistics to the board, and when the policy is reviewed.

Protecting reporters and investigating fairly

Most whistleblowing programmes fail at the handling stage, not the policy stage. A few habits make the difference:

• Triage fast. Acknowledge within a few working days. Decide whether the matter needs urgent action, such as preserving evidence or stopping unsafe work.
• Keep the investigator independent. Nobody named in the report, and nobody in their reporting line, should run or oversee the investigation.
• Limit who knows. Share the reporter’s identity on a need-to-know basis. Watch for indirect identification, such as quoting a detail only one person could know.
• Watch for retaliation. Check in with the reporter during and after the case. Review any transfer, appraisal or dismissal affecting them for a link to the report.
• Hear both sides. The person accused is entitled to know the substance of the allegation and to respond before findings are made.
• Record decisions. Keep a case log of what was received, what was done, findings and actions. Report anonymised numbers and themes to the board.
• Know when to go external. If the facts suggest a criminal offence, such as bribery, take legal advice on reporting to the relevant enforcement agency.

Training staff and managers to speak up

A channel nobody trusts is a channel nobody uses. Staff need to know what to report, where to go and what will happen. Managers need to know what to do when someone raises a concern informally, because that first conversation decides whether the person ever speaks up again.

In the WorkQuest2U Speak Up & Whistleblowing lesson, learners move through a 3D scene with a quiet room, a speak-up kiosk, a manager’s office and an investigation room, and choose how to raise or handle a concern. How to Raise a Grievance shows the difference between a personal complaint and a whistleblowing report, and Code of Conduct & Values and Anti-Bribery & Corruption cover what kinds of conduct people should report. These are awareness lessons with completion records, not legal advice or a substitute for your own policy.

This guide is general information, not legal advice. For a specific case, speak to a lawyer who handles employment and corporate governance matters.