Introduction
Part One of our three-part advisory series on data centres, titled “Data Centres and the Law: What Every Director Needs to Know – Occupational Safety, Construction Risk and the Real Cost of Getting it Wrong“, covered the Occupational Safety and Health Act 1994 (“OSHA“) exposure and the Zdata Gelang Patah stop-work order (“Gelang Patah“). Part Two of this series turns to environmental law risks.
The thread running through Part Two of this series is a single distinction that recurs in each of the cases discussed below: obtaining planning permission through a One-Stop Centre (“OSC“) answers only the land-use question and says nothing about whether a project is entitled to operate under environmental law. The Kota Damansara case shows how a flawed planning process alone can unravel an approval. The OSC and the Environmental Impact Assessment (“EIA“) framework explain why clearing planning permission is legally irrelevant to environmental lawfulness. Google’s Elmina campus case illustrates what proactive environmental management looks like in practice. The penalties for non-compliance underscore just how severe the consequences can be when the two gates are treated as one.
Case Study: Kota Damansara and the Approval Shortcut that Backfired
In July 2026, residents across Jalan Istana Kota Section 9, Damansara Residency Section 9, and Kota Damansara Section 9 objected to a proposed commercial data centre, citing traffic, road safety, environmental impact and proximity to homes.[1]
The critical detail: Petaling Jaya City Council (“PJCC“) gave residents only seven days to object. The Town and Country Planning Act 1976 allows 21 days.[2] That is not a technicality – it is a breach of the statutory process governing planning permission.
Sungai Buloh MP R. Ramanan submitted a formal objection to the PJCC mayor and received no response. The local assemblyperson demanded a public engagement session and full technical document review. The matter was escalated to Cabinet.[3]
Securing planning permission through an OSC is not the same as environmental compliance. If the process is flawed, the whole approval is vulnerable.
The lesson is procedural rather than academic: a seven-day objection window, set against the statutory 21 days, gave residents a clean legal grievance that escalated the dispute to Cabinet level. It also illustrates the theme running through this article, because planning approval and environmental approval are two separate legal gates, and a flaw in one is not cured simply because the other has been cleared.
Why an OSC Approval is Not an Environmental Clearance
A data centre needs two entirely separate approvals: planning permission from the local authority, and for larger projects, a full EIA approved by the Department of Environment (“DOE“) under section 34A of the Environmental Quality Act 1974 (“EQA“).
An EIA is a formal study of environmental impact, prepared by a qualified person and submitted to DOE before construction begins. A project can clear the OSC and still be operating illegally if the EIA has not been approved or its conditions are not being met.
Carrying out a prescribed activity without an approved EIA attracts a penalty of imprisonment of up to five years and a fine of RM100,000 to RM1 million. Breaching a DOE stop-work order carries the same exposure.
The distinction matters because OSC approval addresses land use and density, while EIA approval addresses environmental impact, and the two operate as different gatekeepers under different statutes. A developer that has cleared the OSC but not the EIA, or that is not meeting the EIA’s conditions, is nonetheless operating unlawfully, and doing so is a criminal offence carrying up to five years’ imprisonment.
Case Study: Google’s Elmina Campus and the Water Question
Google’s first Malaysian data centre – a US$2 billion campus at Elmina Business Park, Selangor – is designed for 100 megawatt (“MW“) (Phase 1), with 200-250MW potentially following.[4] That is hyperscale by any measure.
Residents of Elmina Green 4 & 5 raised the obvious concern: Selangor already experiences water shortages, and data centre cooling systems consume enormous volumes.[5]
The National Water Services Commission (“SPAN“) confirms that data centre projects across Johor, Selangor and Negeri Sembilan have requested roughly 808 million litres/day, but only around 142 million litres/day (under 20%) can realistically be supplied.[6]
Google’s response included making available water-cooling technology, a global pledge to replenish more water than it consumes by 2030 and funding a lake-restoration project with the Global Environment Centre and PJCC.[7] Regardless of whether these measures fully answer residents’ concerns, they constitute a documented, public mitigation strategy, precisely the kind of record a director would want to point to when responding to regulatory scrutiny.
Water has consequently become a genuine deal-breaker for Malaysian data centre projects, given that SPAN can realistically supply under a fifth of the volumes requested by developers. Google’s proactive model of documented pledges, partnerships and published commitments is the standard other boards should now be targeting, precisely because it creates the kind of record a director wants to point to when a regulator comes asking.
Breach of Environmental Legislation | Statutory Provision | Fine (RM) | Imprisonment | Director Liability |
|---|---|---|---|---|
| Operating a prescribed activity without an approved EIA | section 34A, EQA | 100,000 - 1 million | Up to five years | Yes |
| Breaching a prohibition or stop-work order issued by the Director General of DOE | section 34AA, EQA | 100,000 - 1 million | Up to five years | Yes |
| Unlicensed discharge of environmentally hazardous substances, pollutants or wastes into inland waters | section 25, EQA | 50,000 - 10 million | Up to five years | Yes |
| Unlicensed emission of air pollutants exceeding prescribed limits | section 22, EQA | 10,000 - 1 million + continuing fine up to RM1,000 / day | Up to five years | Yes |
| Failure to comply with requirements relating to fuel-burning equipment (including diesel generators) | Environmental Quality (Clean Air) Regulations 2014 | Up to 100,000 (depending on specific regulation breach) | Up to two years | Yes |
| Unlawful handling, storage, treatment, disposal or recovery of scheduled wastes (including e-waste) | section 34B, EQA | 100,000 - 10 million | Up to five years | Yes |
| General offence where no specific penalty is provided. | section 41, EQA | 5,000 - 250,000 | Up to two years | Yes |
All of the offences set out above are strict liability offences, meaning that DOE does not need to prove intent. Under section 43 of the EQA, directors and C-suite officers are personally deemed guilty unless they can establish that they exercised genuine due diligence.
Given that these offences are strict liability offences, with maximum exposure running to a ten-million-ringgit fine, five years’ imprisonment and personal director conviction under section 43, and that they are offences of strict liability such that directors are deemed guilty unless they can demonstrate genuine due diligence, the table above is not merely a checklist. It is the sharp end of the same planning-versus-environmental-compliance gap illustrated by the preceding case studies.
The Proactive Path: Sustainable Data Centre Guidelines
The Ministry of Investment, Trade and Industry and Malaysian Investment Development Authority’s Guidelines for Sustainable Development of Data Centre prescribe three metrics that must be met in order for data centre operators to be eligible for tax incentives under the Digital Ecosystem Acceleration Scheme (“DESAC“). These are: (i) Power Usage Effectiveness (“PUE“)[8] – target 1.4 or below for hyperscale; (ii) Water Usage Effectiveness (“WUE“)[9] – 2.2 m³/MWh or lower; and (iii) Carbon Usage Effectiveness (“CUE“)[10] (measured annually). Meeting these is a precondition for Malaysia’s Third Nationally Determined Contribution (October 2025) moves to an absolute emissions target for the first time, peaking by 2030, achieving net-zero by 2050. Regulators and communities will increasingly measure data centre operators against this benchmark.
PUE, WUE and CUE are becoming the language by which regulators, financiers and communities will judge data centre operators, and non-compliance with these requirements now carries a direct financial cost, since it forfeits the full DESAC tax exemption.
Avoiding Prosecution: What the Real Cases Teach
The real cases examined above point to a consistent set of lessons for avoiding prosecution, each tracing back to the same planning-versus-environmental gap.
Audit and objection timing: Auditing environmental standards before breaking ground (Gelang Patah) and never shortcutting statutory objection periods (Kota Damansara).
EIA and mitigation: Treating EIAs as live documents with monitored conditions, and building in water and dust mitigation early, following Google’s approach.
Licensing and governance: Scheduling waste/e-waste licensing before going live and briefing boards on personal liability under the OSHA and the EQA.
- Regulatory engagement and metrics: Proactive engagement with the Department of Occupational Safety and Health (DOSH) and DOE, drawing on the Gelang Patah townhall, and tracking PUE, CUE and WUE regardless of DESAC eligibility.
Key Takeaways for the Board
Standing back, the board should take four points from this article.
Gelang Patah was Malaysia’s first data centre protest, and it will not be the last.
Planning permission and environmental approval remain two separate legal gates that must each be cleared on their own terms.
Water is now a genuine deal-breaker, with SPAN able to supply under 20% of demand.
- The ultimate exposure – a RM10 million-fine, five years’ imprisonment, and potential personal liability for directors – is the price of conflating the two gates traced in this article.
Whether your project ends up resembling like Gelang Patah’s crisis, Kota Damansara’s stand-off, or Google’s proactive model is largely a choice your board makes now.
Part Three covers civil liability from neighbouring landowners.
Please click on the following link to read Part One of this series:
This article is for general information only and does not constitute legal advice. For specific guidance on data centre regulatory compliance in Malaysia, please contact our team set out on this page.
For regional data and digital economy matters, please see Rajah & Tann Asia’s Data & Digital Economy Practice for more information.
Contribution Note
Written by Partner Shannon Rajan of Christopher & Lee Ong.
________________________________________________________________
[1] New Straits Times, July 2026; The Malaysian Reserve, 15 July 2026.
[2] The Rakyat Post, 16 July 2026; The Malaysian Reserve, 17 July 2026.
[3] FreeMalaysiaToday, 17 July 2026; The Sun, 17 July 2026.
[4] Data Center Dynamics; Bernama/Garasi, ‘Can Selangor Handle the Data Centre Boom?’
[5] Bernama/Garasi feature, quoting resident Mohd Faris Mohd Razali.
[6] The Edge Malaysia, February 2025; CERT/ISIS, June 2026.
[7] Data Center Dynamics, Google Malaysia groundbreaking coverage.
[8] PUE is the ratio of a data centre’s total facility energy consumption to the energy consumed by its IT equipment; a lower figure indicates that less energy is lost to non-IT overheads such as cooling and power distribution.
[9] WUE is the ratio of water consumed by a data centre’s cooling and other operations to the energy consumed by its IT equipment, typically expressed in litres or cubic metres per unit of energy.
[10] CUE is the ratio of carbon dioxide equivalent emissions attributable to a data centre’s total energy consumption to the energy consumed by its IT equipment.
Disclaimer
Rajah & Tann Asia is a network of member firms with local legal practices in Cambodia, Indonesia, Lao PDR, Malaysia, Myanmar, the Philippines, Singapore, Thailand and Vietnam. Our Asian network also includes our regional office in China as well as regional desks focused on Brunei, Japan and South Asia. Member firms are independently constituted and regulated in accordance with relevant local requirements.
The contents of this publication are owned by Rajah & Tann Asia together with each of its member firms and are subject to all relevant protection (including but not limited to copyright protection) under the laws of each of the countries where the member firm operates and, through international treaties, other countries. No part of this publication may be reproduced, licensed, sold, published, transmitted, modified, adapted, publicly displayed, broadcast (including storage in any medium by electronic means whether or not transiently for any purpose save as permitted herein) without the prior written permission of Rajah & Tann Asia or its respective member firms.
Please note also that whilst the information in this publication is correct to the best of our knowledge and belief at the time of writing, it is only intended to provide a general guide to the subject matter and should not be treated as legal advice or a substitute for specific professional advice for any particular course of action as such information may not suit your specific business and operational requirements. You should seek legal advice for your specific situation. In addition, the information in this publication does not create any relationship, whether legally binding or otherwise. Rajah & Tann Asia and its member firms do not accept, and fully disclaim, responsibility for any loss or damage which may result from accessing or relying on the information in this publication.
