Who Waters the Cloud

Energy and institutional frictions in Malaysia's data centre development

In February 2026, residents of Gelang Patah in Johor gathered outside a data centre construction site with a simple complaint: water pressure has been falling, and this 300-megawatt facility hasn’t even begun operations yet. That same month, Prime Minister Anwar confirmed in parliament that data centre applications unrelated to AI and high technology have been rejected for nearly two years. Together, these two events paint a telling picture: Malaysia is conquering the global compute map on one side, while having to admit that water and electricity may already be running short on the other.

The expansion is visibly aggressive. By end-2025, Johor alone hosted 51 approved projects, 17 operational and 11 under construction. TNB has signed 49 power supply agreements locking in 7.1GW of future data centre demand—roughly 43% of TNB’s total contracted capacity. Yet Johor’s estimated daily water need for cooling stands at 808 million litres, with sustainable supply at only 142 million litres.

But speed of construction is not the same as institutional readiness. Energy investment oversight in Malaysia is fragmented. At federal level, MIDA oversees manufacturing, ST oversees grid connection, SEDA manages renewable energy. State governments hold the keys to land and water, while NETR’s promised “single window” has never acquired legal force. The data centre wave has lit up every gap in this framework.

This analysis follows a consistent approach: not stacking information like an industry report, but asking—who bears the public cost of the electricity and water that data centres consume? What positions do different actors occupy, and do their demands conflict? What negotiation evidence lies behind regulatory language? One sentence: Malaysia’s data centre challenges are not technical—they are institutional.

Section One: “AI-Only”—An Approval Line With No Legal Foundation

On 24 February 2026, Prime Minister Anwar responded in parliament to queries about data centres squeezing power and water resources, stating that data centre applications unrelated to AI and high technology “have been rejected for nearly two years.” This is the highest-level public confirmation on record—but with a conspicuous feature: it is not a law, not a regulation, not even a formal announcement. It is a political statement said out loud.

Tracing the timeline, this informal prohibition began enforcing around mid-2024. Johor established a data centre review committee in June 2024 and rejected approximately 30% of applications over the following five months, citing non-compliance with “sustainable development objectives.” In November 2025, Johor further announced it would no longer approve Tier 1 and Tier 2 data centres, which consume roughly 200 times more water than higher-tier facilities.

Several institutional problems merit careful recognition here.

First, where is the boundary between “AI-related” and “non-AI”? The Prime Minister’s statement is a political statement, not a legal definition. A hybrid data centre hosting both AI training and conventional cloud storage—does it count as AI or non-AI? Who has the power to decide, and by what standard? Currently there is no published review guidance. This means approval authority operates with substantial discretion in practice. Investors face not a clear red line, but a grey zone requiring case-by-case probing.

Second, does approval authority sit with the federal government or the states? Land approval for data centre projects rests with state governments (Malaysia’s Constitution Schedule Nine), while electrical supply permits sit with federal agency ST, and MIDA handles investment promotion in the manufacturing phase. The Johor review committee’s authority to reject projects derives from state planning power, not federal energy law. This mirrors the structure we analysed earlier—“federation controls electricity, states retain land”—except this time, through control of land and water, state government has effectively acquired veto rights over data centre admission, while the federal “AI-only” policy, lacking formal legal documentation, has enforcement power only so long as agencies coordinate on its interpretation.

Third, the durability of political commitments. We noted before that Johor’s “green lane” promises failed to survive a change in state government. The same logic applies to the current “AI-only” policy: it can be harsher than formal regulation (discretion is wide) and also more fragile (change the implementation team, and the standard may shift).

Section Two: 5.9GW Locked In—Grid Capacity and Electricity Price Redistribution

TNB’s figures are sobering. By end-2024, 38 data centre projects had signed power supply agreements, locking in combined peak demand of 5.9GW—around 43% of TNB’s total contracted capacity. By September 2025, that had climbed to 49 agreements, 7.1GW. At the same time, in May 2026, peninsula electricity demand spiked 11.5% year-on-year, partly attributable to data centre expansion and extreme heat.

TNB’s response: sharply increase capital spending. In December 2024, it announced that the fourth regulatory period (RP4) running July 2025 through end-2027 would permit capital expenditure to climb to RM42.8 billion (roughly USD10 billion), double the prior period. Where does this money come from? The answer is in the electricity tariff.

After RP4 took effect in July 2025, the peninsula benchmark tariff rose from 39.96 sen/kWh to 45.62 sen/kWh. But the tariff structure design conveyed a precise signal: low-voltage residential customers saw effective tariffs drop from 55.95 sen/kWh to 45.4 sen/kWh; roughly 71% of medium-voltage users also benefited, while high-voltage large users—including data centres—pay higher, cost-reflective rates.

This is Malaysia’s version of the “public cost allocation” problem we discuss repeatedly. In China’s direct-connection renewable discussions, the core question is: if direct-connection users bear less of the system cost, that cost shifts onto other users staying on the public grid. Malaysia has given a staged answer through RP4: allow data centres and similar large users to pay cost-reflective rates, protecting residential customers from pressure. TNB also notes publicly that data centre and residential power operate at different voltage tiers, so there is no direct competition.

But whether this answer holds long-term depends on two variables. First, will demand growth keep exceeding forecasts? If the 7.1GW locked demand is fully released, grid expansion costs will keep climbing. Second, can renewable penetration keep pace with data centre growth? If incremental power still comes mainly from gas, the gap between data centres’ “green” narrative and actual carbon footprint will become an increasingly sharp public issue.

Section Three: Twenty Million Litres Daily—Johor’s Carrying Capacity Question

If the electricity problem can be eased by technical framing—“different voltage tiers, no direct competition”—water has no such buffer. Water does not distinguish by voltage tier. The water data centres use for cooling and the water flowing from residents’ taps come from the same source.

Johor’s data centre clusters are estimated to need 808 million litres daily for cooling, but sustainable supply is only 142 million litres. Even discounting, these numbers are unambiguous: current water infrastructure cannot support full operation of all approved projects. Sedenak tech park has told prospective tenants it cannot deliver phase two’s water and power commitments until Q4 2026.

The Johor state government has begun taking steps: establishing a special committee to review data centres’ water impact; banning Tier 1 and Tier 2 data centre approvals to limit water consumption from lower-tier facilities; launching an industrial wastewater recycling programme with Indah Water Konsortium supplying up to 12 million litres daily of reclaimed water. But these are remedial measures launched after the boom has already started, not institutional design built in advance.

The Gelang Patah residents’ protest marks the moment this contradiction moved from data tables into reality. It raises a question we are equally focused on in our Vietnam work: social licence is not a soft public relations cost—it is a hard constraint on whether projects can sustain operations. Data centre investors can sign power agreements with TNB and negotiate investment incentives with MIDA, but if local communities believe their water has been taken, the friction no permit can dissolve.

Section Four: Agricultural Land Shrinking 48%—When “Cloud” Falls on Palm Plantations

Beyond water lies land. Malaysia’s data centre boom is consuming substantial agricultural land. Since 2017, livestock acreage has contracted 48%, with portions converted to industrial and commercial uses, including data centre parks.

Under Malaysia’s legal framework, land conversion requires state government approval for use change. We have analysed this before: approval cycles in development-heavy states like Johor can run 12 to 18 months, with no unified timeline across the entire chain. The data centre wave is accelerating every step, but it is also surfacing a deeper policy collision: national agriculture policy demands protection of food security land, while the national digital transformation strategy demands massive land for data centres.

When these two national policy land demands collide on the same palm plantation, the referee sits in the state land office and local planning board—not in a unified federal priority. This returns to the structure we have described: federation manages electricity, states manage land. When these two power systems meet on the same project, there is no statutory coordination mechanism.

Section Five: China’s Position—GDS, Bridge, YTL and Geopolitical Undercurrents

In Malaysia’s data centre investment map, Chinese capital is now impossible to ignore. GDS’s international subsidiary DayOne is investing USD 3.5 billion in Johor, one of Asia’s largest single data centre investments. Chindata’s Bridge Data Centers operates a 600MW park in Sedenak. YTL Power is partnering with GDS to develop a 168MW green data centre cluster in Johor, and YTL previously signed a USD 4.3 billion AI data centre collaboration with Nvidia.

Malaysia’s stance toward Chinese data centre investment is described externally as a “non-aligned shelter”—accepting China’s capital without taking a clear side in US-China geopolitical competition. Anwar’s government has embedded “attracting global technology investment” and “becoming an AI nation by 2030” in national strategy, allocating RM5.9 billion in the 2026 budget for AI and digital infrastructure.

But Chinese enterprises need to read the institutional detail underneath this openness.

First, ST’s hidden discretion in grid connection approvals. We noted before that the Electricity Supply Act (Act 447) says nothing about foreign ownership ratios, but ST may consider national industrial policy, local participation and system stability when deciding on project structure. Under the “AI-only” policy backdrop, ST’s discretionary space only widens, not narrows.

Second, vague “local content” standards. MIDA typically requires 70%+ local employees; SEDA procurement standards have subjective interpretation of “local sourcing” and “local employment”—definitions of “local” (Malaysian citizen? locally incorporated company? bumiputera enterprise?) and metrics (spend ratio? headcount? hours worked?) lack uniform interpretation, relying on case-by-case judgement. When Chinese enterprises scale, these fuzzy standards can become material gatekeeping.

Third, renewable power procurement competition and pathways. DayOne signed a 21-year renewable energy supply agreement with TNB, locking in 1GW+ of green power. Google signed a 21-year PPA with TotalEnergies. GDS signed Virtual PPAs (VPPA) through CGPP (Corporate Green Power Programme). CGPP currently has 800MW of solar allocation with a 30MW per developer cap—clearly insufficient against data centre demand in hundreds of megawatts. Chinese enterprises that do not lock in renewable resources and REC channels early will face rising compliance costs and ESG pressure later.

Section Six: From Five Permits to One ESG Bill—Regulatory Overlay in Data Centres

In our earlier analysis of Malaysia’s energy regulatory structure, a new Chinese renewable project might need approvals from seven agencies and five permit types. Data centre projects face no fewer hurdles.

Layered on top is an increasingly urgent ESG compliance layer. Global hyperscale operators (Google, Microsoft, Amazon) are the world’s largest corporate renewable energy PPA signatories, and when they land in Malaysia they bring RE100 commitments. When these global standards collide with Malaysia’s local renewable supply capacity, REC frameworks and carbon accounting rules, the technical details of compliance alignment—which renewable attributes count for international carbon accounting, whether RECs and carbon credits risk double-counting—mirror the questions we pursue in China’s direct-connection debate.

Section Seven: Several Legal Risks Worth Noting

From a practicing lawyer’s perspective, Malaysia’s data centre buildout faces several legal risks at this stage, worth investors evaluating in advance.

First, admission policy uncertainty risk. The “AI-only” policy has no formal legal backing; approval standards depend on case-by-case discretion. If a project is rejected because AI relevance is deemed insufficient, loss allocation and remedy pathways are unclear for front-end costs, land contracts, or equipment purchase agreements already committed.

Second, power supply agreement performance risk. TNB has locked 7.1GW of data centre demand, but grid expansion timelines and RP4 capex execution speed both risk supply delays. Sedenak phase two’s water and power commitments have already been pushed to Q4 2026. Investors must audit every clause in power agreements for delay liability allocation and remedy.

Third, water security and community risk. Data centre water sources, volume guarantees, dry-season priority—are these law-backed commitments with the state water authority, or merely administrative letters? When residential and industrial water compete, who gets protected first? This is as much a legal question as it is about project social licence and operational continuity.

Fourth, land use change retrospective and compliance risk. Converting agricultural land to data centre use requires state approval. If national agriculture policy later tightens restrictions on land conversion, projects mid-approval risk approval freeze or condition changes. Johor’s green-lane commitments showed political-cycle vulnerability; the same applies to land use changes.

Fifth, renewable power shortfall ESG compliance risk. Data centre operators’ public RE100 and carbon-neutral pledges need sufficient local renewable supply and trustworthy REC frameworks. CGPP’s 800MW solar quota against gigawatt-scale data centre demand creates visible shortfall. If renewable procurement cannot cover actual consumption, operators face not just ESG rating downgrade but “greenwashing” liability risk for misalignment between claims and performance.

Sixth, RP4 tariff adjustment impact on existing contracts. The tariff increase from 39.96 to 45.62 sen/kWh disrupts electricity cost assumptions in existing long-term leases or compute service contracts. Without tariff adjustment pass-through clauses, operators absorb cost increases, damaging project returns.

Section Eight: Will Institutions Catch Up With Speed, or Will Speed Outrun Institutions?

Every problem Malaysia’s data centre buildout faces today traces back to one line: industry expansion speed has outpaced institutional supply.

Grid approval has run ahead of regulatory reform—NETR’s promised “single window” has never acquired legal force, yet 49 power agreements are already signed. Water demand has outpaced water infrastructure—808 million litres daily faces 142 million litres supply. The “AI-only” policy has run ahead of legal definition—the PM said it, but no document wrote it down.

This does not mean Malaysia’s direction is wrong. It has attracted massive capital deployment from tier-one tech companies and sovereign investors—USD 3.5 billion from DayOne, USD 4.3 billion from YTL+Nvidia, RM 5.9 billion in national AI budget. Those numbers themselves say something about market confidence. But as we stress in every article: outcomes depend on mechanism, not technology. Data centre servers can be racked and powered in months, but water, electricity, land and community—these four constraint lines need institutional design to draw them, drawn before industry expands, not after.

For Chinese outbound enterprises, Malaysia’s data centre opportunity is real, but it requires translating “opportunity narrative” into “institutional narrative.” The focus should not only be on how much power TNB can supply and how much land Johor has left, but: How legally binding are these supply commitments? Will public cost allocation rules retroactively rewrite existing projects? Whose calculation do local community water and farmers’ land enter into, and will that “AI-only” line—unwritten in law—stay tight or loosen when the next political cycle turns?

These questions fit directly into the five-dimensional outbound observation model we structured in our Vietnam strategy work—institutional maturity, public cost allocation, actor positioning, power structure, and cycle timing—each worth validating separately. Malaysia is not a simple “good” or “bad” market. It is a market where institutions are racing to catch speed. The investor’s task is to judge how—and at what pace—that catch-up will settle.

Authors: Zhao Shujie (Member of Legal Expert Database, Legal Daily; Partner, Teda Gonghes Law Firm); Liang Wei (Director, Carbon Compliance Research Centre, Teda Gonghes Law Firm)

Factual basis as of July 2026; specific provisions subject to latest official texts.