PETALING JAYA: A technology lawyer has urged the government to disclose how TuJu protects users’ location data and provide evidence that the locally developed navigation app is secure.
Foong Cheng Leong said TuJu continues to raise privacy concerns, pointing to its privacy policy, which states that the app collects users’ location data and shares it with companies providing mapping services.
“Although TuJu’s privacy policy states that such information is anonymised and aggregated, we should know exactly what information is shared with these providers, where the information is stored and who has access to it,” he told FMT.
According to Foong, the Personal Data Protection Act 2010 (PDPA) requires companies to keep personal information safe and sets rules on sending it overseas.
“However, enforcing our laws against foreign companies may be difficult, especially when the data is stored overseas. Further, the PDPA may not necessarily prevent foreign governments from obtaining access to such data under their own laws,” he said.
Foong also said the app’s Malaysian origins do not necessarily mean users’ personal data is stored locally or shielded from access by foreign entities.
Universiti Sains Malaysia cybersecurity expert M Selvakumar called on the government to disclose what tests were conducted on TuJu to establish that it is secure.
“If you're saying that it is more secure, prove it,” said Selvakumar, who heads USM's cybersecurity research centre.
He said the concern was not limited to whether hackers could break into an app, but also who could access information about people’s whereabouts and track their movements.
To protect such data, Malaysia would need control over the entire system, including the app, the technology behind it, the servers storing the information and how it is handled, he said.
Launched in Nov 2025, TuJu is developed by the Malaysian Highway Authority and Prosignal Consortium Sdn Bhd. It reportedly uses Google mapping data and technology supported by Maybank.
Its introduction has come under scrutiny following the government’s decision to prohibit civil servants from using Waze while performing duties due to security concerns linked to the app’s Israeli origins, while encouraging the public to switch to local alternatives such as TuJu.
However, TuJu has drawn complaints from app review platforms and users on social media, with some reporting inaccurate route guidance, glitches and a lack of real-time traffic information.
Foong said the government was right to take precautions rather than wait for personal information to be accessed or misused.
He said Waze’s privacy policy names Waze Mobile Ltd, an Israeli company, as responsible for users’ personal data.
As it is subject to Israeli law, he said, the company could be required to hand such information to Israeli authorities.
“There is a basis for concern about any government having access, or the possibility of access, to our data, especially foreign governments. We do not know what they will do with it, and they are not accountable to us,” he said.