Can I post the runaway tenant's IC, photo, or passport online to warn other landlords?
Reviewed by Lim Jia Hui, Advocate & Solicitor (Malaya), Messrs. Lim & Partners, updated 24 June 2026.
For the section on “Can I post the runaway tenant's IC, photo, or passport online to warn other landlords?”, What Documents Can a Landlord Ask a Tenant for in Malaysia? clarifies which personal data can be collected, how it may be used and where disclosure crosses the line.
No. Posting a tenant's IC, photo, or passport online — on any social-media listing channel, group chat, or "name and shame" page — breaches Malaysia's Personal Data Protection Act 2010 and can expose you to a civil defamation claim even if the debt is real. The lawful route is a written demand, then court action, and a credit-agency report only with the tenant's signed consent.
On SPEEDHOME's managed platform, the average time from a tenant's first rental default to recovery action is about 31 days where the tenancy agreement is properly stamped and includes a credit-agency consent clause — cases without those protections in place typically take meaningfully longer and recover less.
When a tenant disappears owing rent, the impulse to warn other landlords is understandable. But publishing someone's identity documents is the single act most likely to flip you from creditor to defendant. This page covers why each of the common shortcuts is unlawful, what tenants worried about their own data can do, and the lawful path that actually recovers your money. For the broader question of what landlords can and cannot do, see blacklisting a tenant in Malaysia — what landlords can actually do.
Why posting an IC, photo, or passport online is unlawful
Posting a tenant's IC, photo, or passport breaches PDPA 2010 — you collected that data for the tenancy, not to publish or punish. It is a data-protection breach even when the arrears are real.
Before deciding how to handle “Why posting an IC, photo, or passport online is unlawful”, use Tenant Not Paying Rent in Malaysia (2026): Lawful Recovery Steps; it adds the local rent, commute and viewing checks needed for a defensible shortlist.
The same act can trigger a second, separate liability: defamation. If the post labels the tenant a "cheat", "scammer", or "runaway" before a court has established the debt, the tenant can sue for damages even when some of the underlying claim is true, because public accusation without due process is the harm the law targets.
| Online action | PDPA risk | Defamation risk | Recover your rent? |
|---|---|---|---|
| Post the tenant's IC image | High — unconsented secondary use of personal data | Possible — identifies and labels a person | No |
| Post the tenant's passport page | High — passport data is especially sensitive | Possible | No |
| Post the tenant's photo with a "cheat" label | Medium-to-high depending on consent | High — accusatory publication | No |
| Share a name and IC number in a group chat | High — still a public disclosure | Possible | No |
| Send the IC only to a licensed credit agency, with the TA consent clause | None | None | Yes — the lawful reporting route |
The pattern to notice: every shortcut in the first four rows carries legal risk and recovers zero ringgit. Only the last row both protects you and advances recovery.
What a landlord can lawfully do instead
Lawful recovery runs through a documented process: written demand, evidence preservation (signed TA, arrears ledger, handover photos), then court action or — only with a signed consent clause in the TA — a verified default report to a licensed credit reporting agency (CRA). A CRA report with TA consent IS one of the lawful steps, sitting alongside court action as an alternative recovery route, not a replacement for the demand letter.
Self-help is off the table. Under the Specific Relief Act 1950 s.7(2), a landlord cannot recover possession by locking the tenant out, removing doors, or disconnecting water or electricity. Those acts are unlawful no matter how much is owed, and they give the runaway tenant a counter-claim that erases your moral and legal high ground.
The lawful sequence, with the forum for each step:
| Step | Action | Forum / mechanism |
|---|---|---|
| 1 | Issue a formal written demand for the arrears | Private letter or lawyer's letter — sets the paper trail |
| 2 | Preserve evidence — signed TA, stamping receipt, arrears record, condition photos | Your own file; needed for any later claim |
| 3 | Lodge a verified default report with a licensed credit agency | Only if the TA contains an explicit consent/default clause — never without it |
| 4 | File for rent arrears | Writ of Distress to seize movable goods, or a court claim |
| 5 | Recover the unit | Writ of Possession enforced by the court bailiff |
Sample written demand (Step 1) — keep it short, dated, and sent by registered post or hand-delivered with a witness:
[Date] To: [Tenant's full name] Unit: [Property address] Re: Outstanding rent arrears of RM [amount] for [month(s)]
You are in arrears of RM [amount], broken down as RM [rent] rent + RM [utilities] utilities, for the period [dates]. Please pay the full sum within 14 days of this letter to [payment details / bank account]. If payment is not received by [date], I will file a court claim for the arrears and apply for a Writ of Possession to recover the unit.
Signed, [Landlord name + IC last 4 digits]
If the tenant won't pay and won't leave, court action typically runs several months before a Writ of Possession is enforced, and legal-fee costs vary by counsel and case complexity — get a quote from a lawyer once the claim is filed. Most small-balance disputes (≤RM5,000) can use the Magistrates' small-claims procedure (Order 93 of the Rules of Court 2012) with no lawyer required.
For the court route, the tier depends on the amount and forum: claims up to RM5,000 use the Magistrates' small-claims procedure (no lawyer needed, Order 93 of the Rules of Court 2012); larger civil claims go to the Magistrates' Court (civil jurisdiction up to RM100,000) or the Sessions Court (civil jurisdiction up to RM1,000,000). The Sessions Court also has unlimited jurisdiction for landlord-and-tenant and distress actions under the Courts of Judicature Act 1964 and the Rules of Court 2012. Malaysia has no dedicated residential tenancy tribunal, so these disputes stay in the ordinary civil courts.
The consent clause is the linchpin. A standard TA drafted without a default-reporting clause gives you no lawful basis to report to a credit agency, and you cannot add the clause after signing. For future tenancies, have a lawyer or a platform whose standard TA already carries the clause include it before the tenant signs. For how to vet the next tenant so you do not repeat the cycle, see how to screen tenants the right way.
If you are a tenant: what if a landlord posts your details?
You have the right to demand removal and to complain to the Department of Personal Data Protection. If the post is accusatory, you may also have a defamation claim. Keep screenshots, the URL, and the date — evidence matters more than anger.
The same PDPA that constrains landlords protects you. Your IC, photo, and passport were collected to run a tenancy, not to be republished. Practical steps:
- Request removal in writing first — a dated message creates a record of the landlord's refusal.
- Lodge a complaint with the Department of Personal Data Protection (JPDP) under the PDPA 2010 if the post stays up.
- For accusatory posts, consult a lawyer on a defamation demand letter; truth of the debt is a partial defence, not a licence to publish.
- Pull your own Experian report to check whether an unauthorised default has been lodged against you without a consent clause — if it has, you can dispute it.
This is also why it pays to rent through a platform that verifies owners and ties every listing to a real, eKYC-checked landlord. See verified SPEEDHOME listings for homes where the owner's identity is already confirmed before you ever pay a deposit.
The SPEEDHOME angle: consent built in, doxxing engineered out
On a managed platform, the standard TA carries the consent/default clause at sign-up, arrears are evidenced through platform records, and a verified default can be reported to a licensed credit agency — not a social post.
If this issue moves to the next stage, How to Screen Tenants in Malaysia: DIY vs Platform Screening explains what to verify and what to do next.
That structure is the real fix. The reason landlords reach for naming-and-shaming is that a self-managed tenancy gives them no other lever once a tenant vanishes. The platform's value is the evidence file: every payment, every late notice, every handover is timestamped and exportable, so a CRA report or a court claim carries the documents a self-managed landlord cannot produce. For landlords who want to stop firefighting defaults one at a time, SPEEDHOME landlord plans set that up from the first tenancy.
If you need to warn other landlords about a tenant who vanished, there is a lawful path that does not require posting any personal document. You can report the fact pattern — unpaid rent, fictitious references, absconded — to a licensed credit reporting agency under an existing TA consent clause, or share non-identifying case details (no name, no IC, no unit number) with landlord communities such as the Association of Licensed Money Lenders' landlord networks. The point is to share the pattern, not the person.
Frequently asked questions
Can I post the tenant's IC in a private group chat of landlords?
No. A private group chat is still a disclosure of personal data to others who have no tenancy purpose for seeing it. Under the PDPA 2010 the lawful purpose is the one you collected the IC for — verifying the tenant and running the tenancy — not circulating it to warn other owners. The risk of a data-protection complaint and a defamation claim is the same as a public post.
Is it legal if I blur the face but keep the IC number?
No. An IC number on its own is personal data, and combining it with a location or "runaway tenant" label still identifies the person. Blurring the face does not cure a PDPA breach or a defamation claim when the rest of the post points to one individual.
What if the tenant really cheated me — surely I can warn people?
You can pursue the debt lawfully — written demand, Writ of Distress, court claim, and a credit-agency report if your TA has the consent clause. What you cannot do is publish the tenant's identity documents or label them a cheat online before a court has established the debt. Public accusation is the harm the law restricts, even against a genuine debtor.
Can a tenant sue me for defamation if they actually owe me money?
Yes. Truth is a defence to defamation, but the defence has to be proven in court, and you carry the burden. Meanwhile the tenant can also file a PDPA complaint for the unconsented use of their IC and photo. You may win the rent argument and still lose a separate action for how you handled the documents.
Does my tenancy agreement let me report the tenant to a credit agency?
Only if it contains an explicit consent or default-reporting clause that the tenant signed before the tenancy started. Without that clause you have no lawful basis to report, and you cannot add it after the fact. The clause names the licensed credit reporting agency, the data to be reported (name, IC, tenancy default), and the tenant's signed acknowledgement — that signed acknowledgement is the lawful basis under the PDPA 2010. If your current TA has no such clause, your recovery options are the written demand and the court route. See running a CCRIS or CTOS check on a tenant for how the credit-check side works.
What is the fastest lawful way to recover rent from a tenant who ran?
Issue the written demand immediately and preserve your evidence file (signed and stamped TA, arrears record, handover photos), then file for a Writ of Distress against the tenant's movable goods or a court claim for the arrears. Recovery is a process, not a post — but it is the only route that actually returns money to you.