WHEN Prime Minister Datuk Seri Anwar Ibrahim urged Malaysians on 20 October to embrace TuJu over Waze, the homegrown app was already nearly a year old. The Malaysian Highway Authority (LLM) rolled it out in November 2025, developed by Prosignal Consortium Sdn Bhd.
Almost overnight, an application tailored for tolled expressways was thrust into the national spotlight to serve the entire country—and users quickly found it wanting. Reviews surfaced showing raw code bleeding into turn-by-turn prompts.
LLM and the developer apologised for the disruption, while Communications Minister Datuk Seri Fahmi Fadzil confirmed on 23 October that both parties had been summoned to explain the shortcomings and present a roadmap for fixes. Netizens have had their share of laughs, but the episode demands we confront harder questions.
The first is user privacy. Open TuJu on iOS, and you are greeted by a blanket permission prompt. It states that the app tracks location, motion, and usage behaviour that “may be shared with Malaysian Government Body for Road User analysis and product enhancement.”
The catalog of data requested that follows is astonishingly broad: payment information, physical address, device ID, phone number, email address, advertising data, and even “Credit and Fraud” details.
Why would a highway navigation tool ever require credit and fraud data? Does that satisfy the necessity test under the Personal Data Protection Act 2010 (PDPA), which dictates that personal data collection must be directly relevant and not excessive to its declared purpose?
The prompt is equally vague on who actually receives this harvest. Section 7 of the PDPA mandates that data subjects be informed of the class of third parties receiving their information, with regulatory guidelines recommending that third parties be identified by name.
A sweeping reference to a generic “Malaysian Government Body” offers no transparency. Furthermore, on iOS, this notice appears solely in English, failing Section 7’s statutory requirement to provide disclosure in the national language as well.
The deeper apprehension lies in where that data lands. Section 3(1) of the PDPA expressly exempts federal and state governments—an immunity left untouched by the 2024 amendments. Once personal information crosses into a government database, citizens hold no statutory entitlement under the PDPA to access, correct, or delete it.
Given that TuJu is the hybrid product of a statutory agency and a private contractor, does the PDPA fully govern its custody? The Personal Data Protection Department (JPDP) and the Ministry of Works must clarify this publicly. LLM and Prosignal must account for who holds this data and how much of it reaches government servers.
The prime minister acknowledged TuJu’s teething pains, reiterating that domestic software can be refined and that national security must come first. The sovereignty argument carries merit.
Yet, when the state actively steers an entire population toward a domestic platform, the public is entitled to ask how thoroughly that platform was vetted and stress-tested before receiving executive endorsement.
What stings most is the squandered opportunity. Malaysia possesses the talent, institutions, and capital to engineer a premier digital ecosystem. TuJu itself relies on Google’s mapping layers while drawing toll, CCTV, and live incident telemetry from LLM’s traffic management centre.
The foundational parts exist, but what went missing was inter-agency coordination to forge a world-class national product capable of going toe-to-toe with Waze.
A coherent national initiative would have leveraged defined roles across key agencies:
- The Ministry of Digital, driving the Malaysia Digital 2030 agenda, should establish the overarching governance architecture and ironclad data protection standards.
- MIGHT, under the Prime Minister’s Department, could provide strategic technology foresight and systems architecture advisory.
- MDEC could identify, mobilise, and integrate elite local engineering talent into the development pipeline.
Funding models matter just as much. A project of strategic national importance should not depend on commercialising private user data or ad-tracking to sustain itself. The KL20 Action Plan established a blueprint for venture support; Khazanah Nasional unveiled an initial RM1 billion National Fund-of-Funds at the KL20 Summit, while Cradle Fund continues to back homegrown innovation. Strategic sovereign capital should be deployed to underwrite civic software of this magnitude.
TuJu’s stumbling start is not an indictment of Malaysian engineering talent. Rather, it illustrates the hazard of state agencies operating in silos on initiatives that demand multi-sector alignment.
If TuJu is ever to mature into a genuine alternative to global platforms, it needs institutional foresight, rigorous data ethics, top-tier engineering, and sustainable funding untethered from user tracking.
Public trust cannot be retrofitted through an app update. The next national digital project must begin with transparent rules, accountable governance, and a unified effort across all digital agencies—from day one. – October 27, 2026
K V Soon is an ICT strategist, technology commentator, and a Scoop reader.