Is Your Location Data Safe? Why Malaysia Has Restricted Waze for Civil Servants
Waze has become a familiar navigation app for many Malaysians, helping drivers avoid traffic jams, find alternative routes and reach their destinations more easily. However, the app is now at the centre of a national discussion about data security and privacy following a recent government decision.
On 21 October 2026, Malaysia announced a restriction prohibiting civil servants from using Waze while carrying out official duties. The decision was made following concerns about government information, users’ location data and the legal jurisdiction governing the application.
The announcement has raised an important question: how can a navigation app, designed to make travelling easier, also become a concern for national information security?
Why Has Malaysia Restricted Waze?
The restriction followed a meeting of the National Cyber Security Committee chaired by Prime Minister Datuk Seri Anwar Ibrahim on 20 October 2026. The directive was subsequently issued to government departments for immediate implementation.
One of the main reasons behind the decision is the legal status of Waze Mobile Ltd., the company identified in Waze’s terms of service as operating under Israeli law. According to the government, this raises concerns about the protection of users’ information and the legal jurisdiction that applies to the service.
The government is particularly concerned about the possible exposure of sensitive information involving public officials and their movements. Civil servants may travel to government offices, official meetings and other locations connected to their responsibilities. Protecting information related to these activities is therefore an important consideration.
It is important to clarify that this is not a nationwide ban on Waze for everyone. The restriction applies to civil servants when performing official duties, although the government has also encouraged the public to consider local navigation alternatives.
How Can Location Data Become a Security Concern?
Most people use navigation apps without thinking much about the information they share. When users search for destinations, follow routes or allow location access, the app may collect information needed to provide its services.
Depending on the app’s privacy policy, device settings and permissions, this information may include location details, travel routes, GPS data, timestamps and device-related information.
Individually, these details may appear harmless. However, when location information is collected repeatedly and combined over time, it could potentially reveal a person’s daily routine, frequently visited places or movement patterns.
For example, repeated visits to the same government building could reveal a person’s regular workplace. Information about travel to particular locations could also create concerns when it involves officials handling sensitive responsibilities.
According to the government’s explanation, these potential risks are among the reasons for reviewing the use of Waze in official duties. However, the government’s FAQ also states that there is no evidence that Waze has conducted this type of analysis on its users. The concern is about what the collected data could potentially reveal or expose, rather than proof that such misuse has occurred.
This distinction matters because data security decisions should consider both the information an application collects and the actual evidence available about how that information is used.
Why Does the Company’s Legal Jurisdiction Matter?
Another factor highlighted by the government is the legal framework under which Waze operates.
An application’s legal jurisdiction can affect which laws apply to its services, how disputes are handled and what legal protections may be available to users. For organisations handling sensitive information, these considerations can form part of a wider assessment of digital security risks.
The government has expressed concern that Waze Mobile Ltd. operates under Israeli law and that its terms of service refer to Israeli jurisdiction for relevant disputes.
This does not automatically mean that every application operating under foreign laws is unsafe. Instead, the issue highlights the importance of understanding how data is managed, where it is processed, which parties may access it and what legal safeguards apply.
For government agencies, these questions are especially important when selecting digital tools for official work.
Why Is the Decision Important Beyond Government Offices?
Although the restriction directly affects civil servants, the issue also provides a wider reminder for businesses and individuals who rely on digital applications every day.
Businesses, for example, may use navigation apps to coordinate deliveries, manage field teams, plan service visits and track travel schedules. If location information is linked to employees, customers or business operations, it should be handled carefully.
Organisations can take several practical steps to improve their data protection practices:
- Review app permissions: Check whether an application needs access to location data all the time or only while it is being used.
- Understand privacy policies: Learn what information an app collects, how long it may be retained and whether it is shared with third parties.
- Assess business risks: Identify whether information collected through digital tools could expose sensitive operations, staff movements or customer details.
- Follow workplace policies: Use applications approved by the organisation, particularly when handling confidential information or carrying out official responsibilities.
- Review alternatives carefully: Consider data protection, reliability, usability and security measures before switching to another digital service.
These steps can help organisations make more informed decisions without relying on convenience alone.
TuJu and the Move Towards Local Navigation Technology
As part of its response, the government has encouraged the use of locally developed navigation applications, including TuJu, developed through cooperation between the Malaysian Highway Authority (LLM) and Prosignal Consortium Sdn. Bhd.
TuJu offers road navigation and highway-related information, including estimated travel times, traffic updates, toll information, rest and service areas, and access to available highway CCTV feeds. The application is intended to support drivers travelling on Malaysian roads.
Encouraging local technology could create opportunities for Malaysian developers to improve their products and meet the needs of local users. It may also support the development of digital services that are better suited to Malaysia’s road network and transport information.
However, being locally developed does not automatically guarantee that an application is free from privacy or security risks. Users and organisations should still examine its data collection practices, privacy protections and overall reliability.
For a local alternative to gain users’ trust, it needs to provide both useful features and clear information about how personal data is protected.
What Happens Next?
Malaysia’s restriction on Waze for civil servants highlights the growing importance of data protection in an increasingly connected world. Digital applications offer convenience and efficiency, but they can also collect information that deserves careful consideration.
For the government, the challenge is to protect sensitive information while ensuring that public servants have access to reliable tools for their work. For technology developers, the situation creates an opportunity to demonstrate that local applications can meet users’ expectations for security, performance and convenience.
For individuals and businesses, the key lesson is to become more aware of the information shared through everyday digital services. Understanding app permissions and privacy policies is a practical first step towards making safer technology choices.
Ultimately, the discussion surrounding Waze is about more than navigation. It raises important questions about digital trust, data protection and how Malaysia can balance technological convenience with the need to safeguard sensitive information.
