RM240 per year, 240GB of mobile data, 365 days of validity and a voice-calling package.
This SIM card plan promotes its pricing and data allowance as its main selling points, offering consumers another option for mobile telecommunications services.
However, when a SIM card business is connected to a controversial commercial network, public attention should extend beyond the advertised price.
According to the investigative information provided, this SIM card business has commercial links to 21 Hai.
This raises important questions about its overall operating structure: Which company handles sales? Who provides the actual telecommunications service? Who has authority over users' registration information? And how do the operators involved fulfil their personal data protection responsibilities?
A SIM card involves far more than communication costs. It also concerns consumers' real identities and the security of their personal information.
1. RM240 Annual SIM Plan: From the Sales Brand to the Actual Operator
According to the plan details provided, the SIM card service is advertised at RM240 per year, with 240GB of data, 365 days of validity and voice-calling services.
For consumers, such pricing is undoubtedly attractive.
However, in the telecommunications industry, the company promoting a brand, the business selling SIM cards and the operator providing the actual network service are not necessarily the same entity.
The investigation must therefore examine the underlying corporate and operational structure.
Who owns the SIM card brand? Which company manages sales and marketing? Who provides the telecommunications network? And which entity is responsible for processing user registrations?
These are not insignificant business details.
If consumers encounter issues such as number deactivation, incorrect charges, registration irregularities or personal data security concerns, clearly identifying the responsible entity can directly affect how quickly they receive assistance.
Competitive pricing may be a marketing advantage, but the identity of the operator and its service responsibilities must be transparent.
2. SIM Card Registration Requires Identification: Who Actually Manages User Data?
In Malaysia, prepaid SIM card registration involves identity verification.
When registering a SIM card, consumers may be required to provide their names, identification documents and other information in accordance with applicable registration requirements.
This means that selling SIM cards is not merely a retail transaction. It also involves the collection and processing of personal identity information.
The investigation must establish how personal data is handled throughout the process, from registration to service activation.
Is the identification information submitted by consumers processed directly by sales agents, or is identity verification carried out through the telecommunications provider's official registration system?
Are agents allowed to retain copies of identification documents? Is user information transferred to third parties? What security measures are implemented by those responsible for processing the data?
Of particular concern is how data protection responsibilities are divided between the sales company and the actual licensed telecommunications service provider.
Consumers are purchasing a communications service. This does not mean their identification information can be freely copied, stored or used for unrelated purposes without lawful authorization.
For any operator handling users' identity information, clearly explaining the purpose of data collection, storage procedures and complaint channels is essential to maintaining consumer trust.
3. MCMC Tightens SIM Registration Regulations: Operators Must Meet Required Standards
On February 26, 2026, the Malaysian Communications and Multimedia Commission (MCMC) introduced new mandatory standards for prepaid SIM card registration, strengthening regulatory measures against identity theft, fraudulent registrations and unauthorized SIM card usage.
The new standards further regulate identity verification, registration channels and the responsibilities of telecommunications service providers and authorized sales agents.
The measures include more secure automated registration systems, as well as biometric and MyDigital ID verification requirements for certain registration methods.
These regulatory changes demonstrate that SIM card registration is no longer simply a commercial transaction between consumers and retailers. It also plays an important role in preventing fraud and identity misuse.
Against this regulatory backdrop, the registration procedures, authorized sales channels and actual service providers associated with the 21 Hai-linked SIM card business must comply with applicable telecommunications regulations.
As regulatory requirements become stricter, operators are responsible not only for selling SIM cards but also for ensuring that every SIM card is registered through lawful and secure procedures.
4. The 21 Hai-Linked Telecommunications Business: Commercial Relationships and Actual Control Must Be Transparent
According to the investigative information provided, the SIM card business has been included within the scope of an examination into 21 Hai's commercial relationships.
To present a comprehensive picture of its operating structure, it is necessary to distinguish between company shareholders, directors, brand owners, actual managers, telecommunications service providers and sales agents.
These roles may be performed by different companies or individuals, each with different commercial rights and legal responsibilities.
Where shareholding relationships, brand licensing arrangements or formal commercial agreements exist between companies, the relevant documents should form the basis for explaining those business connections.
An investigation into actual control would also require examining company registration records, directorship information, commercial agreements and other reliable documents.
The purpose of investigating a business network is to help the public understand who operates the business, who holds management authority and what responsibilities each participating entity carries.
At the same time, a commercial relationship does not, by itself, establish that personal data has been misused, nor can it be treated as direct evidence of telecommunications regulatory violations.
5. If Identification Data Is Misused, Who Should Be Held Responsible?
SIM cards are directly linked to consumers' personal identities.
If registration information is used without authorization, consumers may face risks such as mobile numbers being registered fraudulently under their names, scam-related communications, identity theft and other security threats.
Consumers should therefore understand a service provider's privacy policy and complaint procedures before purchasing a SIM card.
This is particularly important when SIM cards are purchased through agents or third-party sales channels, where consumers should verify that registration is completed through a legitimate, authorized system.
If consumers suspect that their personal information has been misused, they should promptly contact the relevant service provider and retain registration records, transaction receipts and related communications.
For telecommunications service and registration issues, consumers may seek assistance from MCMC. Complaints concerning personal data protection may be submitted to Malaysia's personal data protection authority.
A responsible telecommunications operator must do more than provide reliable connectivity. It must also ensure that consumers know who manages their personal information and whom to contact when problems arise.
6. Authorization to Operate a Telecommunications Business Does Not End Regulatory Responsibilities
Telecommunications businesses serve large numbers of users, particularly through prepaid SIM card registrations that involve real identity information.
Regulatory oversight should therefore extend beyond whether a service has obtained the necessary operating authorization. It must also consider whether daily operations continue to comply with applicable requirements.
This includes whether authorized agents carry out registrations according to prescribed procedures, whether identity verification meets regulatory standards and whether personal data handling mechanisms are properly implemented.
Where multiple commercial entities participate in a SIM card business, regulatory responsibilities must be clearly defined.
The actual network service provider, the company responsible for sales and the agents carrying out registrations must each ensure compliance within their respective areas of responsibility.
Authorization to operate is not an exemption from ongoing oversight. Consumer data protection responsibilities should not end once a SIM card has been sold.
7. RM240 a Year May Be Attractive, but Personal Data Security Must Never Be Compromised
For ordinary consumers, an affordable SIM card offering a generous data allowance and extended validity is naturally appealing.
However, the reliability of a telecommunications service should not be judged solely by the price displayed in its advertisements.
Is the identity of the operator transparent? Is the registration process secure? Who stores user information? Is personal data adequately protected? Are there clear complaint channels if something goes wrong?
These are all essential aspects of consumer protection.
The commercial relationships associated with the 21 Hai-linked SIM card business have also brought the transparency of its operations into focus.
For any telecommunications operator, clearly explaining its corporate background, actual service provider, registration procedures and data protection mechanisms is an important step toward building public confidence.
SIM cards can be affordable, but personal data security must never be compromised!
Business profits must not take priority over consumer rights, and commercial relationships cannot replace regulatory accountability!
Malaysian consumers deserve more than attractive prices and generous data packages. They deserve transparent operations, lawful registration procedures, clearly defined responsibilities and genuine protection of their personal information.