Constitutionalizing cybersecurity: Indonesia–Malaysia regulatory convergence through a maqasid al Sharia framework

Abstract

Purpose – This article examines the evolving regulatory architectures of cybersecurity and cyber resilience in Indonesia and Malaysia and proposes harmonization strategies that are both responsive to escalating cyber risks and normatively fair, using maqasid al-Sharia as an evaluative lens.
Methodology – This study employs a qualitative doctrinal approach combined with a comparative legal analysis. Primary materials (statutes, regulations, policy documents, and case law where available) are systematically interpreted and contrasted, and are triangulated with recent high-impact international scholarship on cyber security law, digital constitutionalism, and Islamic legal theory.
Findings – The analysis shows that Indonesia is moving towards cyber resilience through incremental institutional strengthening and the coordination of fragmented sectoral regimes, while Malaysia adopts a more centralized model via dedicated cybersecurity legislation focused on the National Critical Information Infrastructure. These divergent trajectories shape risk allocation, incident reporting and accountability mechanisms. This study identifies a set of functionally equivalent harmonization strategies: baseline obligations, mutual recognition of standards and certification, interoperable incident reporting, and institutional interoperability, and demonstrates how maqasid al-Sharia reframes these as instruments to protect life, intellect, property, dignity, and social order.
Implications – The findings offer concrete guidance for regulators and policymakers in designing cybersecurity frameworks that enhance resilience without legitimizing disproportionate state power in the digital domain and provide a normative benchmark for Muslim-majority jurisdictions.
Originality – This study is among the first to integrate digital constitutionalism, comparative public law, and maqasid al-Sharia into a single analytical framework to assess and harmonize cybersecurity regulations in Indonesia and Malaysia.