Before you use an OSINT tool: the law in Singapore and Malaysia

All 33 categories of the public OSINT Framework, in 9 groups · law checked 11 October 2026

How to read this. The free OSINT Framework lists over a thousand tools in 33 categories (counted 11 October 2026) and tells you whether the person you look at can see you. It does not tell you whether you are allowed to look. This page does, for Singapore and Malaysia, by category. Every citation links to the statute or judgment, all 20 were read in the primary text on 11 October 2026, and this page names no tool and gives no instructions. General information, not legal advice. Re-check the statute before you rely on it.

The rule that sits over every category. In Singapore, obtaining and giving information about a person for reward is private investigation, and doing it, or advertising that you will, without a licence is an offence (Private Security Industry Act 2007 ss 5 and 6). Malaysia also licenses the work (Private Agencies Act 1971). Curiosity about your own exposure is not investigation. Charging someone to look into another person is.

Tools aimed at a named person's identifiers and accounts

Framework categories: Username, Email Address, Telephone Numbers, Person search engines, Social Networks, Instant Messaging, Dating, Online Communities, Classifieds

Tools that take a name, handle, email address or phone number and show where it appears.

Singapore	Malaysia
Private Security Industry Act 2007 s 5 (what counts as private investigation) PSIA s 6 (no PI work, and no advertising it, without a licence) PDPA 2012 First Schedule Part 2 para 1 (publicly available data) PDPA s 18 (only for purposes a reasonable person would consider appropriate) Protection from Harassment Act 2014 s 3(1)(c) (publishing identity information to harass) POHA s 5(1A) (publishing identity information that facilitates violence)	Malaysia Penal Code ss 507E, 507F (publishing, circulating or making available identity information) Malaysia Private Agencies Act 1971 ss 2, 3, 6 (licensed agencies; seizable offences go to police) Malaysia Personal Data Protection Act 2010 s 2 (commercial transactions)

Singapore

Malaysia

Private Security Industry Act 2007 s 5 (what counts as private investigation)
PSIA s 6 (no PI work, and no advertising it, without a licence)
PDPA 2012 First Schedule Part 2 para 1 (publicly available data)
PDPA s 18 (only for purposes a reasonable person would consider appropriate)
Protection from Harassment Act 2014 s 3(1)(c) (publishing identity information to harass)
POHA s 5(1A) (publishing identity information that facilitates violence)

Malaysia Penal Code ss 507E, 507F (publishing, circulating or making available identity information)
Malaysia Private Agencies Act 1971 ss 2, 3, 6 (licensed agencies; seizable offences go to police)
Malaysia Personal Data Protection Act 2010 s 2 (commercial transactions)

The red line. Doing this for reward is private investigation in Singapore and needs a licence. Publishing what you find to harass someone, or where it could help someone hurt them, is an offence in both countries. Malaysia's offence also covers circulating or making available the information, with an ought to know test.

The lawful route. If someone is harassing you from an account, report it to the platform and then to the Online Safety Commission, which can ask platforms for the person's details. If you need work done about a person, use a licensed investigator.

Tools that place a person or a thing in space and time

Framework categories: Images / Videos / Docs, Geolocation Tools / Maps, Transportation

Photo and document metadata, map and street imagery, vehicle, vessel and flight trackers.

Singapore	Malaysia
POHA s 7 (unlawful stalking) Protection from Harassment Act 2014 s 3(1)(c) (publishing identity information to harass) PDPA s 18 (only for purposes a reasonable person would consider appropriate) Private Security Industry Act 2007 s 5 (what counts as private investigation)	Malaysia Penal Code ss 507E, 507F (publishing, circulating or making available identity information)

The red line. Using these to work out where a particular person lives, goes or is, and acting on it, can be stalking. Posting the result is the doxxing offence. Checking where a published photo of a public event was taken is a different act from locating a person.

The lawful route. If you fear for someone's safety, call the police. Location work about a person is for a licensed investigator or the police.

Official and commercial registers

Framework categories: Public Records, Business Records, Compliance & Risk Intelligence

Company registers, court records, sanctions and politically exposed persons lists, licensing databases.

Singapore	Malaysia
PDPA 2012 First Schedule Part 2 para 1 (publicly available data) PDPA s 18 (only for purposes a reasonable person would consider appropriate) Private Security Industry Act 2007 s 5 (what counts as private investigation) Copyright Act 2021 s 244 (computational data analysis needs lawful access)	Malaysia Personal Data Protection Act 2010 s 2 (commercial transactions)

The red line. Publicly available data can be collected without consent, but it must still be used for a reasonable purpose, and each register has its own terms of access. Bulk copying a register in breach of its terms can lose the copyright analysis exception, which needs lawful access. A screening hit on a common name is a lead, not an identification.

The lawful route. Use the register's own search and terms; treat every name match as unconfirmed until a second, independent detail matches.

Internet infrastructure and threat intelligence

Framework categories: Domain Name, IP & MAC Address, Cloud Infrastructure, Cyber Threat Intelligence, Malicious File Analysis

Domain and DNS records, certificate logs, scanners, malware and threat feeds.

Singapore	Malaysia
Computer Misuse Act 1993 s 3 (access without authority) CMA s 7 (obstructing the use of a computer)	Malaysia Computer Crimes Act 1997 s 3 (unauthorised access)

The red line. Reading published records about a domain is ordinary. Probing, scanning or testing a system you do not own or have written permission to test is where the Computer Misuse Act begins. The framework marks many of these tools "active", meaning the other side can see them.

The lawful route. Run active checks only on your own systems, or under a written authorisation from the owner.

Leaks, the dark web and crypto tracing

Framework categories: Dark Web, Blockchain & Cryptocurrency

Hidden services, leak sites and blockchain explorers.

Singapore	Malaysia
Computer Misuse Act 1993 s 3 (access without authority) CMA ss 8, 8B (passwords and other people's credentials) Wee Shuo Woon v HT SRL [2017] SGCA 23 (leaked material online can stay confidential) PDPA s 48F (unauthorised re-identification of anonymised information)	Malaysia Computer Crimes Act 1997 s 3 (unauthorised access) Malaysia Private Agencies Act 1971 ss 2, 3, 6 (licensed agencies; seizable offences go to police)

The red line. Using leaked or stolen data, or anyone else's login, is the clearest red line on this page. Singapore's Court of Appeal has held that leaked material posted online can keep its confidential quality. A wallet address shows money moving, not who controls it. In Malaysia, a licensed private agency may not enquire into a seizable offence.

The lawful route. Report fraud and scams to the police and your bank. Leave leaked datasets alone.

Search, archives, translation and decoding

Framework categories: Search Engines, Archives, Language Translation, Encoding / Decoding

Search engines and operators, web archives, translators, encoders and decoders.

Singapore	Malaysia
Copyright Act 2021 s 244 (computational data analysis needs lawful access) Computer Misuse Act 1993 s 3 (access without authority) Evidence Act 1893 s 116A (presumptions about electronic records)	Malaysia Computer Crimes Act 1997 s 3 (unauthorised access)

The red line. Searching is lawful. A search that surfaces exposed files, login pages or open directories is an invitation, not a permission: opening what was not meant to be public can be access without authority. An independent archive copy is useful evidence; a machine translation is never the authoritative text of a law.

The lawful route. Stop at the search result page when it points at something that was clearly not meant to be public.

Verification and evidence capture

Framework categories: Disinformation & Media Verification, Documentation / Evidence Capture

Reverse image search, deepfake checks, screenshot and page-capture tools.

Singapore	Malaysia
Evidence Act 1893 s 116A (presumptions about electronic records) Protection from Harassment Act 2014 s 3(1)(c) (publishing identity information to harass)	Malaysia Penal Code ss 507E, 507F (publishing, circulating or making available identity information)

The red line. Low legal risk, high value. Two cautions: many free verification sites forbid commercial or legal use in their terms, and deepfake detectors are much weaker on real-world material than on test sets, so a detector score is a lead, not proof. Do not re-post the harmful material you are checking.

The lawful route. Save the original, its link and the date; keep an independent copy where the material does not expose a victim.

AI tools

Framework categories: AI Tools

Chat assistants, AI text and image detectors, local models.

Singapore	Malaysia
PDPA s 26 (transfer of personal data outside Singapore) PDPA s 18 (only for purposes a reasonable person would consider appropriate)	Malaysia Personal Data Protection Act 2010 s 2 (commercial transactions)

The red line. Pasting someone's personal data into a hosted AI service is a disclosure to that service and, if it is overseas, a transfer out of Singapore. AI output is a lead, never a finding.

The lawful route. Remove names before asking the question; see the AI assistant comparison for what each vendor says it does with your input.

Toolkits, mobile, privacy and training

Framework categories: Tools, Mobile OSINT, OpSec, Training

Bundled toolkits and virtual machines, mobile app analysis, privacy and opt-out resources, courses.

Singapore	Malaysia
Computer Misuse Act 1993 s 3 (access without authority) PSIA s 6 (no PI work, and no advertising it, without a licence)	Malaysia Computer Crimes Act 1997 s 3 (unauthorised access)

The red line. A toolkit is as lawful as the use it is put to. Privacy and opt-out resources are the safest part of the framework and are worth using on yourself. Training about investigation is not investigation; offering to investigate for a fee is.

The lawful route. Use the opt-out resources to reduce your own exposure.

Three things that are true in every category

Online is not the same as public. Being reachable on the web does not make material free to use.
A name match is not an identification. Common names collide. Two independent kinds of evidence, not two copies of one source, before anyone is named.
Publishing is where most people get into trouble. Looking is regulated; posting what you found about a person is where the harassment and doxxing offences bite, in both countries.

If someone is using these tools against you, the free guide Doxxed, stalked or impersonated? What to do in Singapore sets out the first 24 hours, the law and the Online Safety Commission.

Read the free guide