Introduction
Part 1 covered occupational safety and health risks under the Occupational Safety and Health Act 1994, the strengthened enforcement framework following the 2024 amendments, and the growing personal liability of directors and senior management. Part 2 turns to environmental law risks.
The thread running through Part 2 is one recurring distinction: planning permission, Environmental Impact Assessment (“EIA“) approval, and ongoing environmental compliance are separate regulatory questions – and satisfying one does not discharge the others. The One-Stop Centre (“OSC“) is an administrative coordination mechanism within the development-approval process; it does not itself grant planning permission or environmental clearance.
The Kota Damansara case (“Kota Damansara“) illustrates how a procedural deficiency at an earlier stage of the planning process, namely, compliance with the public objection requirement under the Town and Country Planning Act 1976 (“TCPA“), can attract sufficient scrutiny to cause an application to be withdrawn before it reaches OSC coordination.
The OSC/EIA framework then illustrates why obtaining or progressing through the planning process does not answer whether a project triggers a mandatory EIA under the Environmental Quality (Prescribed Activities) (Environmental Impact Assessment) Order 2015 (“EIA Order“), or whether it satisfies ongoing obligations under the Environmental Quality Act 1974 (“EQA“).
The Elmina campus case (“Elmina Campus“) illustrates proactive environmental management in practice. The penalties that follow demonstrate the consequences when these distinct requirements are conflated.
Case Study: Kota Damansara and the Planning Process Under Scrutiny
According to media reports, residents in Kota Damansara, Petaling Jaya, objected to a proposed commercial data centre, citing traffic, road safety, environmental impact and proximity to homes.[1]
The reports recorded that the residents were given only seven days to lodge their objections, notwithstanding the 21-day period prescribed by section 21(6) of the TCPA. The Petaling Jaya City Council (“MBPJ“) required the developer to correct the notice and extend the objection window accordingly.
Media reports also indicated that the local Member of Parliament objected, called for public engagement, and indicated that he would raise the matter at Cabinet level, before the developer’s consultant withdrew the planning permission application.[2]
The seven-day objection period was not a technical irregularity: it deprived the residents of their statutory rights to object, attracted regulatory and public scrutiny, and ultimately preceded the reported withdrawal of the application before it reached the OSC. The case therefore illustrates that procedural compliance at the planning stage can have substantive consequences for the viability and progression of a development proposal.
Why an OSC Approval Is Not an Environmental Clearance
Kota Damansara illustrates the point at the planning stage, but the same distinction runs through the entire regulatory pathway for a data centre. A developer must first obtain planning permission from the local planning authority under the TCPA, a land-use approval that says nothing about environmental impact.
Where a project falls within a prescribed activity under the EIA Order, the developer must separately secure the requisite environmental approval under section 34A of the EQA (“section 34A“) before the prescribed activity may be carried out. Whether an EIA is required turns on whether the project falls within a prescribed activity under the EIA Order, rather than simply on the size or scale of the development. Further, obtaining planning permission and EIA approval does not mark the end of the developer’s environmental obligations. Throughout the operational life of the project, the developer remains subject to applicable environmental requirements, including licensing conditions, emission and discharge controls, and obligations governing the management of scheduled waste.
The OSC sits alongside, not above, these requirements. It coordinates the administrative process among the relevant agencies, but it does not itself grant planning permission, EIA approval or environmental licences – each remains a separate approval obtained from the body responsible for it.
The distinction has practical consequences. Where an EIA is required, the prescribed activity cannot be carried out without the approval required under section 34A, and any conditions of that approval must be complied with. Carrying out a prescribed activity without the required approval is an offence, carrying a fine of RM100,000 to RM1 million and imprisonment of up to five years. Similar statutory exposure applies to contraventions of a Department of Environment (“DOE“) stop-work order.
The point is therefore straightforward: progress through the OSC process is not environmental clearance. Each regulatory requirement must be satisfied independently.
Case Study: Elmina Campus and the Water Question
The operator’s first Malaysian data centre is located at Elmina Business Park, Selangor, as part of its announced US$2 billion investment in a data centre and operator’s cloud region in Malaysia. RHB Investment Bank research estimated the first phase at approximately 100MW, with a further 200–250MW potentially accommodated in a second phase.[3]
The project also illustrates how environmental considerations can extend beyond formal regulatory approvals. Media reports indicate that residents of Elmina Green raised concerns about water availability in Selangor and the potential implications of data-centre cooling systems for local water resources.[4]
The wider figures illustrate the scale of the issue. National Water Services Commission (SPAN) reported that, as of 2024, it had received 101 data-centre applications across Johor, Selangor and Negeri Sembilan, representing more than 808 million litres per day of requested water supply. Of these, 45 applications had been approved, representing approximately 142.06 million litres per day of approved water-supply demand. These figures concern applications and approved demand, rather than actual consumption or the total water-supply capacity of the States.[5]
The operator has responded with measures aimed at improving water efficiency and replenishing freshwater resources. It has committed to replenish 120% of the freshwater it consumes, on average, across its offices and data centres by 2030. In Malaysia, its first water-replenishment initiative is being undertaken with the Global Environment Centre and the MBPJ through the rehabilitation of Taman Aman Lake in Petaling Jaya.[6] These measures do not replace applicable regulatory requirements, but illustrate how a developer can identify a material resource constraint early and support it with targeted mitigation and stakeholder engagement.
For data-centre developers, water availability should therefore be considered at the outset of project planning and environmental risk assessment, rather than treated solely as an operational issue. The Elmina Campus example demonstrates the value of identifying resource constraints early and supporting the project with appropriate mitigation measures and stakeholder engagement.
Penalties at a Glance: The Environmental Exposure under the EQA
Breach | Fine (RM) | Imprisonment | Potential Director's Liability |
|---|---|---|---|
| Operating a prescribed activity without approved EIA (section 34A) | 100,000 - 1 million | Up to five years | Yes |
| Breaching a DOE stop-work/prohibition order (section 34AA, EQA) | 100,000 - 1 million | Up to five years | Yes |
| Unlicensed discharge into inland waters (section 25, EQA) | 50,000 - 10 million | Up to five years | Yes |
| Unlicensed air emissions (section 22, EQA) | 10,000 - 1 million + daily fine | Up to five years | Yes |
| Non-compliant diesel generators Environmental Quality (Clean Air) Regulations 2014) | Up to 100,000 | Up to two years | Yes |
| Unlawful handling, storage, treatment, disposal or recovery of scheduled wastes (section 34B, EQA) | 100,000 - 10 million | Up to five years | Yes |
| General catch-all EQA offence (section 41) | 5,000 - 250,000 | Up to two years | Yes |
The applicable penalty depends on the offence charged. The RM10 million maximum, for example, applies to specific offences, including those under sections 25 and 34B of the EQA, rather than uniformly across the EQA. The question of mens rea under the EQA must be considered offence by offence. Many EQA offences are framed by reference to the prohibited act or state of affairs without expressly requiring proof of intention, knowledge or another mental element, and may therefore operate on a strict-liability basis. Whether mens rea must be proved ultimately depends on the wording and proper interpretation of the particular offence.
Section 43 of the EQA separately addresses liability where an offence is committed by a company or other body corporate. A director, chief executive officer, manager, partner or similar officer may be deemed guilty unless he proves that the offence was committed without his consent or connivance and that he exercised the diligence required having regard to his functions and the circumstances. Section 43 therefore does not make every director automatically liable for every environmental offence committed by the company; liability depends on the statutory deeming provision and whether the officer can establish the matters specified in the section.
The Proactive Path: Sustainable Data Centre Guidelines
The Ministry of Investment, Trade and Industry (“MITI“) Guidelines for Sustainable Development of Data Centres establish three key sustainability metrics: Power Usage Effectiveness (“PUE“), Water Usage Effectiveness (“WUE“) and Carbon Usage Effectiveness (“CUE“). For hyperscale data centres, the guideline sets a design PUE target of 1.4 or below and a design WUE of 2.2 m³/MWh or below. CUE is calculated by reference to annual carbon emissions and information technology equipment energy demand.[7]
These metrics also have a direct bearing on the Digital Ecosystem Acceleration Scheme (“DESAC“). The MITI Guidelines provide the sustainability framework applied to data-centre applications for DESAC incentives. In particular, applications received by the Malaysian Investment Development Authority (“MIDA“) up to 31 December 2027 are subject to the conditions set out in the MITI Guidelines.[8] DESAC therefore links the availability of fiscal incentives to compliance with specified sustainability standards. For qualifying new companies, the scheme provides an Investment Tax Allowance (ITA) of up to 100% of qualifying capital investment for five or ten years, subject to the applicable tier and conditions.[9]
Malaysia’s Third Nationally Determined Contribution (NDC 3.0), submitted in October 2025, adopts an absolute emissions-reduction target for the first time. Malaysia aims to reduce emissions by 15-30 million tonnes of carbon dioxide equivalent (“MtCO₂e“) from its projected emissions peak by 2035, comprising an unconditional reduction of up to 20 MtCO₂e and a further conditional reduction of 10 MtCO₂e. Malaysia’s emissions are projected to peak between 2029 and 2034, with an ambition to peak by 2030 subject to enabling conditions. Malaysia continues to pursue its national ambition of achieving net-zero emissions by 2050.
PUE, WUE and CUE are becoming the language by which regulators, financiers and communities will judge data centre operators. DESAC is not a single full tax exemption; failure to satisfy applicable conditions may affect eligibility for, or the availability of, the relevant incentive rather than automatically forfeiting a full tax benefit.
Key Takeaways for the Board
The cases discussed above point to a common lesson: environmental and planning compliance should be addressed before development begins, not after problems arise. The board should ensure that the project’s regulatory pathway is identified at the outset, including whether it constitutes a prescribed activity requiring an EIA. Planning procedures should be followed strictly, and any approved EIA and its conditions should be treated as continuing obligations. Water, dust, scheduled waste and e-waste controls, together with any required licences, should be addressed before operations commence.
The board should also understand where personal exposure may arise. Section 43 of the EQA may impose deemed liability on directors and other specified officers for offences committed by a company, subject to the statutory requirements. The board should therefore ensure that appropriate environmental responsibilities, reporting lines and compliance controls are in place, rather than treating environmental compliance as solely an operational matter.
Water availability is also emerging as a material constraint for data-centre development. Reported data-centre applications have sought substantially more water than the amount approved in several key states. Those figures reflect applications and approved demand, however, and should not be treated as measures of actual consumption or total state water-supply capacity. Operators should assess water availability, together with other environmental constraints, at the project-planning stage.
Finally, the board should treat sustainability metrics such as PUE, WUE and CUE as part of the project’s broader compliance and risk-management framework, regardless of whether DESAC incentives are being pursued. The objective is not simply to avoid prosecution, but to identify regulatory and environmental risks early enough to manage them effectively.
The contrast between the withdrawn Kota Damansara application and Elmina Campus’ approach illustrates the practical difference between reactive compliance and planned compliance. For a data-centre project, that difference is best addressed at board level, before the project reaches the point where correction becomes more costly than prevention.
Our next issue, Part 3, will cover civil liability from neighbouring landowners.
*This article is for general information only and does not constitute legal advice. The accounts of specific incidents described in this article are drawn from public reporting cited in the footnotes and have not been independently verified by the authors; they should be read as reported accounts rather than as findings of fact.
Please click on the following link to read Part One of this series:
This article is for general information only and does not constitute legal advice. For specific guidance on data centre regulatory compliance in Malaysia, please contact our team set out on this page.
For regional data and digital economy matters, please see Rajah & Tann Asia’s Data & Digital Economy Practice for more information.
Contribution Note:
Written by Partner Shannon Rajan of Christopher & Lee Ong.
[1] New Straits Times, July 2026; The Malaysian Reserve, 15 July 2026.
[2] Free Malaysia Today and the Sun, both dated 17July 2026.
[3] New Straits Times, “RHB research almost doubles target price for SD Property on RM2b [the Operator] data centre“, 11 June 2024.
[4] Malay Mail, “Thirsty for tech? Can Selangor’s water reserves support the data centre boom?“, 27 August 2025
[5] The Straits Times, “Malaysia water regulator to set strict water rules for data centres as number grows“, 10 February 2025; and Free Malaysia Today, “Only 18% of data centres’ request for water approved last year“, 10 February 2025.
[6] Media Selangor, “[the operator] targets 120 pct water replenishment to restore Taman Aman lake“, 21 August 2026.
[7] MITI, “Guideline for Sustainable Development of Data Centre” (December 2024), paras 2.1.1–2.1.3 and Appendix 1.
[8] Ibid, para 3.1.
[9] MIDA, “Guidelines and Procedures for the Application of Digital Ecosystem Acceleration (DESAC) Scheme” (December 2024).
Disclaimer
Rajah & Tann Asia is a network of member firms with local legal practices in Cambodia, Indonesia, Lao PDR, Malaysia, Myanmar, the Philippines, Singapore, Thailand and Vietnam. Our Asian network also includes our regional office in China as well as regional desks focused on Brunei, Japan and South Asia. Member firms are independently constituted and regulated in accordance with relevant local requirements.
The contents of this publication are owned by Rajah & Tann Asia together with each of its member firms and are subject to all relevant protection (including but not limited to copyright protection) under the laws of each of the countries where the member firm operates and, through international treaties, other countries. No part of this publication may be reproduced, licensed, sold, published, transmitted, modified, adapted, publicly displayed, broadcast (including storage in any medium by electronic means whether or not transiently for any purpose save as permitted herein) without the prior written permission of Rajah & Tann Asia or its respective member firms.
Please note also that whilst the information in this publication is correct to the best of our knowledge and belief at the time of writing, it is only intended to provide a general guide to the subject matter and should not be treated as legal advice or a substitute for specific professional advice for any particular course of action as such information may not suit your specific business and operational requirements. You should seek legal advice for your specific situation. In addition, the information in this publication does not create any relationship, whether legally binding or otherwise. Rajah & Tann Asia and its member firms do not accept, and fully disclaim, responsibility for any loss or damage which may result from accessing or relying on the information in this publication.
