Malaysia's decision to restrict Waze for civil servants created an immediate, understandable headline:
Stop using Waze. Use a local alternative.
But once I looked under the hood, the issue became more complicated.
The important question is not whether a navigation app collects location data. Every useful navigation app needs location data to calculate a route, estimate arrival time and respond to traffic.
The real question is:
Who controls that data, where does it flow, which law applies, and what can the government actually enforce?
What the government directive actually says
This is not a nationwide ban on Waze for every Malaysian.
According to the National Cyber Security Agency (NACSA), the directive dated 20 October 2026 applies to public-service personnel while carrying out official government duties. Civil servants are also encouraged to uninstall Waze and use a suitable local navigation alternative.
NACSA says the decision considers the collection of location, movement, journey and device information. It also points to Waze's terms, which apply Israeli law and Israeli court jurisdiction to relevant disputes.
That gives the restriction a clear policy basis: location data generated during official work can reveal more than a destination. At scale, movement patterns can expose routines, facilities, operational behaviour and relationships between locations.
The concern is reasonable.
The harder question is whether replacing one app automatically solves it.
A local app can still depend on a global stack
TuJu is presented as a Malaysian navigation platform developed through Lembaga Lebuhraya Malaysia and Prosignal Consortium.
It has useful local features: toll information, highway facilities, live traffic information, CCTV access and emergency support. Building a local alternative also creates room for Malaysian agencies to shape the product around local roads and public-sector needs.
But local branding does not automatically mean the entire technology stack, data flow and legal exposure are local.
At launch, automotive publication Paultan reported that TuJu used Google's mapping and point-of-interest data. TuJu's published privacy policy says the app may collect GPS data, Wi-Fi access-point and cell-tower information, navigation routes, preferences and other usage data. Its Google Play disclosure says location data may be shared with third parties and that the app may collect location, personal information and other data types.
None of this proves that TuJu is unsafe.
Navigation apps need mapping providers and location inputs. Sharing data with a contracted mapping service can also be legitimate.
What it proves is that the words “local app” are not enough to answer a data-sovereignty question.
Data collection is only the first layer
People often reduce privacy discussions to one sentence:
“This app collects location.”
That is only the beginning.
Two apps can collect the same GPS coordinate while creating very different risks. The difference depends on the complete system around that coordinate:
- Purpose — Is the data used only to calculate the current route, or also for analytics, advertising and profiling?
- Transmission — Which information leaves the device, and is it sent continuously or only when navigation is active?
- Service providers — Which mapping, cloud, analytics and support vendors receive or process it?
- Storage — Where is the data stored, and for how long?
- Access — Which employees, contractors, government agencies or third parties can retrieve it?
- Jurisdiction — Which country's laws and courts govern the operator and its providers?
- Deletion — Can the user or government require the information to be deleted?
- Assurance — Has anyone independent verified that the real system matches the privacy policy?
This is why “all apps collect data” is technically true but not useful on its own.
The security question is not just collection. It is control and enforceability.
What would make TuJu a stronger sovereign alternative?
A Malaysian navigation app can provide stronger sovereignty even if it uses selected foreign components.
The government may have better contractual leverage over a local operator. It can impose security requirements, demand incident reporting, require audits and specify how official-use data must be handled.
But those advantages should be demonstrated, not assumed.
For TuJu—or any approved navigation platform—the public sector should be able to answer:
- Is official-use location data stored in Malaysia?
- Which third-party services receive coordinates or route requests?
- Are identifiers removed before information reaches a mapping provider?
- How long are raw routes and location histories retained?
- Can data be used for advertising or unrelated analytics?
- What happens when a foreign legal demand reaches a service provider?
- Which independent security assessment has been completed?
- What is the process for reporting and responding to a breach?
- Can a government-managed version disable unnecessary tracking?
A public data-flow diagram would answer more than a hundred slogans.
One standard, applied consistently
If location intelligence is the concern, the policy should not stop at Waze.
Phones, connected cars, fleet-management systems, attendance applications, messaging platforms and many other tools can reveal movement. Singling out one application may reduce one risk, but it does not create a complete security posture.
A stronger approach would establish one public-sector location-data standard covering:
- approved uses and prohibited uses;
- minimum data collection;
- encryption in transit and at rest;
- data residency and cross-border transfer;
- retention and deletion;
- third-party processors;
- legal jurisdiction;
- independent audits;
- incident disclosure;
- managed-device enforcement.
Then every app—local or foreign—can be evaluated against the same rules.
That makes the decision repeatable. It also gives Malaysian developers a clear target instead of asking users to trust a logo.
Supporting local technology and asking hard questions can coexist
Giving TuJu, Pintaz or another Malaysian platform a chance does not require blind trust.
Likewise, questioning TuJu's architecture does not mean rejecting local technology.
A serious local technology ecosystem becomes stronger when its products can answer difficult questions about infrastructure, security and governance. Transparency is not an attack on a local product. It is how a product earns the trust required for sensitive use.
Malaysia should build and support local digital infrastructure.
But data sovereignty is not determined by where the app was launched or whose logo appears on the home screen.
Data sovereignty is control, transparency and enforceability across the whole stack.
That is the standard that should decide which navigation app is suitable for official government work.
