On 5 October 2026, at the International Digital Economy Conference Sarawak (IDECS) in Kuching, Sarawak showed its state digital ID, SarawakPass, working with Malaysia's national MyDigital ID. Dayak Daily reports that SarawakPass users can scan a MyDigital ID QR code to reach participating federal web services. MyDigital ID users can scan a SarawakPass QR code to reach participating Sarawak services. The integration follows a memorandum of understanding between the Sarawak government and the National Cyber Security Agency (NACSA), signed on 28 November 2025, per Newswav.
The design is sound. The weak point is the legal frame around it.
The case for a single national credential
The strongest argument for centralisation is that identity systems are only as trustworthy as their weakest link. If every state and agency ran its own login, citizens would juggle dozens of passwords. Each system would be a separate target for phishing and credential theft. A single, well-secured national credential concentrates security investment in one place. It also gives NACSA, the national cyber agency, one system to audit. That is a serious argument, and Malaysia's federal government has acted on it. According to NST, a Chief Secretary directive of 14 January 2025 pushed federal bodies toward MyDigital ID single sign-on.
What Sarawak did differently
Sarawak did not simply hand its login over to Putrajaya. It kept its own credential and made it interoperable with the national one. That is federation rather than consolidation. Citizens get one route into either layer of government. Sarawak keeps control of its own identity stack, including the integrations it has added with local utilities and services. Dayak Daily reports single sign-on with SEB Cares, Sarawak Water and AirBorneo. It also says the link will extend to selected MyDigital ID-enabled mobile apps in the coming months.
For a country with a federal structure and a state with its own digital ambitions, this is a better model than forced migration to one app. It avoids a single point of failure and a single point of political leverage. It also lets states innovate on the user experience without breaking national compatibility. Other jurisdictions in the region building digital public infrastructure should note the pattern.
Adoption is fast, and mostly state-driven
The adoption numbers are strong. Biometric Update reports that MyDigital ID has about 14.1 million users and 203 integrations. It has logged 82 million logins since August 2025 and targets 17 million accounts by the end of 2026. The pace is notable. MyDigital ID's CEO said at an April 2026 event that the platform had passed 11 million users, according to Bernama. The July 2026 parliamentary figure was 12 million registrations as of 30 June.
Part of that growth comes from compulsion rather than preference. NST reports that Deputy Prime Minister Ahmad Zahid Hamidi told Parliament, in a written reply, that 114 federal online services were integrated as of 25 June 2026. He said 19 state-level applications were live and another 28 were in development. When a government service makes one credential the only login, usage numbers reflect the mandate as much as the product. Mandated adoption is legitimate for tax and licensing, but it makes the safeguards matter more. Users cannot walk away from a system they have no alternative to.
The accountability gap
The official line on privacy is reassuring. MyDigital ID's own site says it does not store users' personal data and verifies identity against government databases. These are the operator's own claims, and no independent audit has been published that we could find. The harder problem is legal. The Personal Data Protection Act 2010 regulates personal data in commercial transactions, as the Personal Data Protection Department describes it. Section 3(1) provides that the Act does not apply to the Federal Government and State Government. Law firm Azmi & Associates notes this exemption, and notes that government-owned companies likely fall outside it.
That creates an odd asymmetry. A private app that accepts MyDigital ID is bound by the PDPA. The government identity layer underneath it, and the state and federal portals behind it, are not directly covered by the statute. Linking a state credential to a national one widens the flow of authentication events across more systems. It also increases the value of getting oversight right.
What proportionate safeguards look like
The answer is not to slow the rollout. Digital public infrastructure that lets citizens renew a licence or pay a fine without queuing is a real gain. It also supports a competitive digital economy. Proportionate regulation would instead fix the legal gap and leave the technology alone:
- Extend data-protection duties to public-sector identity systems. Breach notification, purpose limitation and a right of redress should apply to government as they do to a ride-hailing app.
- Publish independent security audits. NACSA's role in the Sarawak MoU is a start. Publishing summary findings would turn assurance into evidence.
- Keep a non-digital fallback. MyKad and in-person channels should remain for those who cannot or will not use an app.
- Limit logging. Authentication logs across state and federal services should be minimised and retained only as long as needed.
Sarawak's demonstration shows that a federated model can scale without forcing everyone onto one platform. The next step is to make sure the law protects citizens as well as the technology serves them. Malaysia can have fast, interoperable identity and enforceable privacy together, and it should not have to pick one.