Malaysia's new refugee registration system raises privacy and rights concerns, HRW warns

Malaysia has launched a new refugee registration system that human rights advocates say lacks adequate protections for privacy and refugee rights, deepening fears among the hundreds of thousands of displaced people living precariously in the country.

Human Rights Watch issued the warning on 5 May 2026, urging the Malaysian government to suspend the programme until a proper legal framework is established.

New system replaces UNHCR's registration role

The Malaysian government began rolling out the Dokumen Pendaftaran Pelarian (Refugee Registration Document, DPP) in January 2026, with the stated aim of replacing the current registration system managed by the United Nations High Commissioner for Refugees (UNHCR).

Developed by MIMOS Berhad, Malaysia's national applied research and development centre, the DPP system will collect biometric data and other personal information to build a comprehensive refugee database.

Home Minister Saifuddin Nasution Ismail said in parliament in January that the DPP would serve as the sole mechanism for managing refugees and their only recognised documentation, with UNHCR's role henceforth limited to resettlement referrals.

More than 210,000 refugees and asylum seekers are registered with UNHCR in Malaysia. Approximately 190,000 are from Myanmar, including around 125,000 ethnic Rohingya. The remainder come from more than 50 countries, including Pakistan, Yemen, Syria, Afghanistan, and Palestine.

Rights concerns and inadequate safeguards

Human Rights Watch said Malaysian authorities have not indicated whether the DPP system will comply with basic standards for refugee status determination, including nondiscrimination, procedural integrity, strict confidentiality, data protection, and access to appeal.

"Malaysia's new registration system lacks adequate safeguards for privacy and refugee rights, allowing increased surveillance and control of people who have been forced to flee their homelands," said Shayna Bauchner, Asia researcher at Human Rights Watch.

Bauchner called on Malaysian authorities to work with UNHCR to improve asylum procedures.

Human Rights Watch wrote to the Home Affairs Ministry about the DPP system on 21 April 2026 but had not received a reply at the time of publication.

The principles of data protection require that individuals be informed about what personal data is collected, by whom, for what purpose, how long it will be retained, and what measures are in place to protect it. Human Rights Watch said Malaysia must clarify how its collection of biometric data will comply with these standards.

Launched under an unpublished security directive

The DPP programme is being implemented under National Security Council (MKN) Directive No. 23, a policy that permits refugees registered with UNHCR to remain in Malaysia on humanitarian grounds. The directive has never been made public.

The government revised the policy in 2023, ostensibly to grant refugees the right to work, but the directive's continued confidentiality has deepened uncertainty over its content and implementation.

SUHAKAM, Malaysia's human rights commission, described the private directive as an inexplicably opaque measure and characterised the revised policy as "a too late and too little approach," rather than a sustainable, rights-based solution.

Human Rights Watch called on the authorities to make Directive No. 23 public and to suspend the DPP programme until a transparent legal framework with international safeguards is in place.

Intensifying enforcement and climate of fear

The launch of the DPP comes amid what officials themselves described as Malaysia's "year of enforcement" in 2025, during which authorities carried out large-scale raids on migrant workplaces and residences and ran a parallel migrant repatriation programme.

Malaysian authorities arrested approximately 92,000 irregular migrants in 2025, compared with around 12,000 in 2021. Officials have stated that operations targeting enforcement hot spots will intensify in 2026.

Police, immigration, and customs officers possess broad powers to search, arrest, and interrogate people. About 21,000 migrants, refugees, and asylum seekers are currently held in immigration detention centres, with no legal limit on the length of detention.

The government has denied UNHCR access to immigration detention centres since 2019, leaving the agency unable to review asylum claims or provide protection to registered refugees held there.

Refugees described living in a state of constant anxiety. "I live in fear," said a Myanmar activist based in Kuala Lumpur. "They'll arrest anyone. They detain people with UNHCR cards. They say, 'The card is just a card, we can break it any time we want.'"

Reports of extortion by authorities during raids are also growing. Refugees told Human Rights Watch that bribes demanded by officials to avoid arrest or secure release ranged from 100 to 7,000 ringgit (approximately US$25 to US$1,750). Refugees' lack of legal status leaves them additionally vulnerable to scams, forced labour, exploitation, and sexual assault.

Resettlement pathways collapse amid US ban

Human Rights Watch noted that only 1,970 refugees were resettled from Malaysia in 2025, a sharp decline from 8,627 in 2024, following the US government's suspension of its refugee admissions programme.

The DPP system permits refugees to remain in Malaysia only "while awaiting resettlement," according to the immigration director-general, a condition that now offers diminishing practical relief given the collapse in available resettlement places.

Previous registration attempt also fell short

The DPP is not Malaysia's first attempt to introduce its own refugee documentation system. In 2022, the government launched the Tracking Refugees Information System (TRIS), which issued MyRC identity cards.

Refugees told Human Rights Watch they had been encouraged to register under TRIS with promises of legal work and residence rights, but that MyRC cardholders continued to be arrested and deported.

In January 2026, the initial phase of the DPP rollout began with Rohingya refugees held in immigration detention centres. The first group was transferred to a processing centre in Bidor, Perak, for interviews. Two refugee registration committees are reviewing interview findings to determine refugee status.

Malaysia lacks a domestic legal framework for refugee status determination and has not ratified the 1951 UN Refugee Convention or its 1967 Protocol. Malaysian law treats all irregular entry and stay as a criminal offence.

Calls for legal reform and international support

Human Rights Watch reiterated its call for Malaysia to ratify the 1951 Refugee Convention and its 1967 Protocol, enact domestic refugee legislation consistent with the convention, and establish safe and fair asylum procedures with access to basic rights.

It also called on Malaysia to amend the Immigration Act to remove criminal penalties for irregular entry and stay.

Addressing third countries, Human Rights Watch urged Canada, Australia, and others to increase resettlement opportunities for refugees in Malaysia and to create alternative visa pathways for work or study.

"As long as it's not safe for refugees to return home, Malaysia should ensure they can work, go to school, and move freely," Bauchner said. "Until the government does this, no state-run registration system will be able to provide genuine protection."

The intensified crackdown is partly a response to the surge in Myanmar nationals who have fled to Malaysia following the military coup of February 2021, among the millions who have sought refuge in neighbouring countries since that date.

Many undocumented migrants have curtailed their movement and outside contacts. One activist told Human Rights Watch she had reduced her work supporting other Myanmar nationals facing arrest or medical emergencies after receiving what she believed were suspicious requests designed to set her up for arrest or harassment.

Several refugees said they were either unaware of the DPP system or deeply sceptical of it. "It doesn't seem safe," said one who had read about it online. "It doesn't seem legitimate."