The shortage is at the substation

Energy-supply, power-grid and electricity-cost risk for data centres and cloud hosting in Malaysia, with Johor and Selangor in focus, assessed as at 6 November 2026.

On 4 November 2026 the Malaysian government changed the rules for plugging a data centre into the grid. Operators seeking a connection in Peninsular Malaysia must now file ten-year staggered energy projections and sign binding commercial contracts with Tenaga Nasional Berhad (TNB), the national utility. The same day Google announced a RM61 billion (US$15 billion) Malaysian build-out across 2027 and 2028. Its three new campuses will sit in Selangor and Negeri Sembilan. None is in Johor, the country's largest data-centre hub, where colocation vacancy is just 0.7 per cent.

The obvious conclusion is that Malaysia is running out of power. It is not. The country is a net exporter of gas and liquefied natural gas (LNG). No fuel queues, rationing orders or load-shedding were reported anywhere in Malaysia in the week to 6 November.

The risk has not disappeared; it has moved. For a data centre in Malaysia, the binding question is no longer whether the electricity exists. It is whether a campus can be connected at the substation it chose, chiefly in Johor, and at a price that keeps its leases profitable. In November 2026, TheRiskAgent rates the current energy-risk trigger level for Malaysia, assessed for data centres and cloud hosting, as Elevated, the middle of its five levels: Low, Watchlist, Elevated, High and Critical. The shortage is at the substation and on the invoice, not in the gas fields.

Data-centre energy terms, in plain words

Data-centre energy reporting worldwide uses a few measures. Each has a yardstick that separates a normal reading from a risky one. The table sets them out against Malaysia's readings.

The language of data centres and energy, with the yardsticks

Term	What it measures	Yardstick: normal or risky	Malaysia, November 2026
Megawatt (MW) and gigawatt (GW)	Power drawn at any one moment. 1 GW = 1,000 MW.	A typical AI-focused data centre uses as much electricity as 100,000 households (IEA). Above 100 MW is hyperscale.	6.04 GW of data centres operating on the peninsula; 12.3 GW approved for supply
Kilowatt-hour (kWh) and terawatt-hour (TWh)	Energy used over time. 1 TWh = 1 billion kWh.	Data centres used 415 TWh worldwide in 2024, about 1.5 per cent of global electricity (IEA).	Johor's data centres could use close to 30 TWh a year by 2031
Sen per kWh and the fuel surcharge (AFA)	The price of power. 100 sen = RM1. The surcharge moves monthly with coal and gas costs.	A rising surcharge is a rising cost; large users pay it in full.	About 60 sen before surcharge; surcharge +3.60 sen, projected +7.59 sen by January 2027
Reserve margin	Spare generating capacity above peak demand.	The energy ministry projects 25 to 27 per cent through 2035. Only plant actually available counts in a crisis.	25 per cent officially (23.4 on nameplate); about 13 per cent once maintenance is stripped out
Grid connection and substation capacity	Whether the local network can take a new load.	Spare power nationally does not guarantee a connection locally.	Johor's grid about 30 per cent used, yet Sedenak and Nusajaya substations are full
Colocation vacancy	Share of rentable data-hall space standing empty.	Near zero means no room for new tenants.	Johor 0.7 per cent; Singapore 4.9, Jakarta 20.5, Bangkok 23.3
Power usage effectiveness (PUE)	Total site power divided by the power the computers use. 1.0 would be perfect.	Global average 1.54 in 2025; 1.44 at sites of 20 MW and above (Uptime Institute).	Johor no longer approves the less efficient Tier 1 and Tier 2 designs
Tier I to Tier IV	How well a site keeps running through faults and maintenance (Uptime Institute).	Tier III can be serviced without shutting down; Tier IV survives a fault. Tier III is the standard grade for colocation.	Tier III contracts allow very little downtime a year
Backup fuel on site	Hours the diesel generators can run without a delivery.	The Uptime Institute's Tier minimum is 12 hours at full design load.	Typically 24 to 72 hours, refilled by road tanker
National days of fuel cover	How long national stocks last without imports.	The IEA benchmark is 90 days.	30 to 60 days of refined products; no formal strategic reserve

Note. Malaysia's weakest readings are the usable reserve margin, Johor's substations and vacancy, and national fuel cover.

Five energy risks for Malaysian data centres, from most to least serious

1. New data centres in Johor may wait to be connected to the grid. Johor holds about 76 of Malaysia's 187 operational and planned data centres, mostly in Sedenak and Nusajaya. The state's grid is only about 30 per cent used overall, but the substations in those two areas are full. What this means: a campus there can be finished and still wait to be switched on, earning nothing meanwhile.

2. Power bills for large users will keep rising. The monthly fuel surcharge (AFA) is +3.60 sen per kWh in November 2026. TNB projects about +7.59 sen by January 2027. Large users pay it in full; most households are shielded. What this means: a data centre's biggest operating cost rises through 2027, and the rise falls on large users, not on homes.

3. Malaysia has less spare power than the official figure suggests. The reserve margin, the spare generating capacity above peak demand, was officially 25 per cent in 2025. Leave out the power stations shut for planned maintenance and the usable spare is about 13 per cent, half the energy ministry's planning range of 25 to 27 per cent. About 6,400 MW of coal and gas plant closes between 2029 and 2031, before most replacements arrive. What this means: the grid has less room to absorb a power-station failure or a surge in demand, and that room shrinks just as Johor's data centres start drawing power.

4. Backup generators rely on fuel that a crisis would make scarce. Data centres cover power cuts with diesel generators, typically holding 24 to 72 hours of fuel. Malaysia has no formal strategic petroleum reserve. Nearly 40 per cent of its crude oil passes through the Strait of Hormuz. What this means: a long power cut during an oil-supply crisis could outlast the fuel on site.

5. Water shortages and public anger could slow approvals. Cooling uses large amounts of treated water. Data centres now pay their own water tariff. A federal minister has warned states against overcommitting water to them. No household water cut has yet been blamed on a data centre. What this means: the risk is low today but would rise fast in a drought, through tighter approvals and local opposition.

Why Malaysia has the power but Johor lacks the connections

Malaysia does not run one national grid. It runs three separate, unconnected grids: one for the peninsula, one for Sarawak and one for Sabah. Sarawak is rich in cheap hydropower from the Bakun dam. None of it can reach a data centre in Sedenak or Nusajaya, which depends on peninsular generation and its nearest substation.

That wiring funnels the fastest-growing load onto the least redundant corner of the system. As of August 2026 some 45 data centres were operating in Peninsular Malaysia with combined capacity of 6.04 GW. Projects holding approvals for electricity supply had already reached 12.3 GW.

Johor's grid is only about 30 per cent used overall. The problem is how fast firm connections can be delivered in the two corridors operators want. Johor has stopped approving the less efficient Tier 1 and Tier 2 facilities. Its colocation space is effectively sold out against an incoming pipeline of 8,542 MW, the largest in the Asia-Pacific region.

Note. Johor has almost no colocation space left, against far more in Singapore, Jakarta and Bangkok.

Phantom demand and the new grid-connection rules

Part of the queue was never real. As of August 2026 data-centre operators had reserved 2,346 MW of grid capacity but were drawing only 1,374 MW, about 59 per cent of what they held. The government calls the gap phantom demand: capacity booked to hold a place in the queue rather than to run servers.

The rules of 4 November target exactly that gap. An operator seeking a peninsular connection must now evidence its demand year by year for a decade and sign a binding contract with TNB. A new user-pays regime charges for reserved capacity left undrawn. TNB's fast-track mechanism can cut a connection from about 36 months to 12, but only for projects that clear the new tests.

The state now treats grid capacity as a rationed resource and is selecting which data-centre load it will serve. Operators that own their power hold an advantage. YTL Power, which controls generation at its Kulai park, carries more certainty than a pure colocation operator relying wholly on TNB supply.

Note. Operators had booked far more grid capacity than they were using, the gap the new connection rules target.

Where the newest data-centre investment is going

The newest location decisions point away from Johor. Google's three new campuses will sit at the EcoWorld Eco Business Park in Puncak Alam and the UMW High Value Manufacturing Park in Serendah, both in Selangor, and at the Springhill Industrial Park in Port Dickson, Negeri Sembilan. They join its operating campus at Elmina Business Park in Sungai Buloh, Selangor.

The terms matter as much as the map. Google says it will fund all of its power consumption and the direct cost of connecting its campuses to the grid. It will add more than 1 GW of new renewable capacity to the grid. It is also funding RM651 million, about US$160 million, of shared water infrastructure in Negeri Sembilan to serve the Port Dickson site and the local community. Each commitment answers one of the constraints that bind in Johor: the connection, the cost of power and the water.

Johor still draws capital. YTL Power has doubled its Kulai park target to 1.2 GW. Realord signed a non-binding 300 MW memorandum for Johor in October 2026. The 2030 projection of about 4.42 GW of data-centre peak demand in Johor, against 1.48 GW in Selangor, was reported on 20 October 2026, before Google named its sites in Selangor and Negeri Sembilan.

Selangor is not a refuge from the risks. It sits on the same peninsular grid and pays the same tariffs and surcharge. A fault at the Edra power plant in Melaka in October 2025 darkened the Klang Valley as well as Johor Bahru. The Kota Damansara projects that residents have opposed are in Selangor too. The comparison shows that location has become a risk decision, not a land decision. An investor able to bring its own power, connection and water can choose a site with headroom. One that cannot joins the queue in Johor.

Electricity costs for data centres: the bill falls on the biggest users

For a data centre, electricity is not an input; it is the product. Data centres pay around 60 sen per kWh for conventional grid electricity before the surcharge, and every part of that price is moving up.

The base tariff for Peninsular Malaysia was reset to about 45.40 sen per kWh for the 2025 to 2027 regulatory period, up roughly 14 per cent. A new tariff tier applies to consumption above 100 MW, a band only hyperscale campuses reach. On top sits the monthly surcharge, which swung from a rebate of 8.91 sen in November 2025 to +3.60 sen in November 2026. The rise is driven mainly by coal costs.

The burden is concentrated by design. Households using 800 kWh a month or less are shielded from the surcharge until 31 December 2026. Data centres also face higher connected-load charges and a separate water tariff of RM5.30 to RM5.38 per cubic metre in Peninsular Malaysia and Labuan. Data centres are projected to reach 21 per cent of peninsular electricity demand by 2030.

Renewable power bought through the Corporate Renewable Energy Supply Scheme (CRESS), at about 48 to 50 sen per kWh, is roughly 17 to 20 per cent cheaper. It adds no firm capacity at peak, so it does nothing for the connection queue.

Note. The surcharge large users pay in full has swung from a rebate to a projected peak in January 2027.

A power grid with less cushion than it looks

Peninsular demand set a record above 22,000 MW in August 2026. TNB forecasts about 9,000 MW of extra demand over the next five years. Gas is absorbing the growth: gas-fired output rose 50.5 per cent year on year in April 2026 to a record 5.54 terawatt-hours, as data-centre load climbed and coal units tripped offline.

The broker Kenanga models the margin falling from a 3.7 per cent surplus to a 1.3 per cent deficit by 2030 on current demand growth.

The timing is the danger. About 6,400 MW of coal and gas capacity is due to retire between 2029 and 2031, while new gas turbines arrive only from 2029 to 2031. By 2031 Johor's data centres could draw close to 30 terawatt-hours a year, absorbing more than 90 per cent of the net growth in peninsular generation.

A single fault already travels far. In October 2025 an incident at the Edra power plant in Melaka triggered blackouts across the Klang Valley and Johor Bahru. A national blackout remains unlikely; a local one reaching the data-centre belt has already happened.

When the backup generators need the same diesel

Every data centre has a fallback: batteries for seconds to minutes, then diesel generators for hours to a few days. A short power cut is survivable. The weakness is that the shock that stresses the grid can also drain the fuel meant to bridge it.

Malaysia imports roughly half the crude it refines. Its refineries are built for heavier Gulf grades, so replacement cargoes cannot be found inside a quarter. The country holds no formal strategic petroleum reserve; forecourt stocks last about three days, with roughly two months of contracted crude behind them.

The largest refinery sits in the same state as the data centres. The 300,000-barrel-a-day plant at Pengerang in Johor ran at around 50 per cent of capacity in February 2026 after a unit shut. Its crude distillation unit was offline from 21 June to 10 July 2026. A grid outage that coincides with a diesel squeeze in southern Johor is the stacked case that would expose how thin the on-site buffers are.

Water, heat and the politics of the data centre

The sharper public grievance is water, not power. Critics through 2026 framed data centres as foreign-owned users of Malaysian water and electricity. In Kota Damansara residents petitioned their council over one project; another was put on hold when its developer withdrew.

Government has moved early. The plantation and commodities minister, Johari Abdul Ghani, warned states against overcommitting water to data centres. On 13 October 2026 the deputy energy minister said some data centres were not yielding many benefits and should be reviewed.

Heat tightens both constraints. A heatwave raises household air-conditioning demand and the power and water a campus needs for cooling. In a drought, a utility that puts households first could force a campus to cut its computing load before any grid fault occurs. The nearest political trigger is dated: the household surcharge exemption expires on 31 December 2026, and ministers have not said whether it will be renewed.

Costly, rationed and mostly predictable

The most likely future is a bigger bill, not a blackout. The two mildest of five scenarios, in which power keeps flowing and only the cost rises, carry 78 per cent of the probability. The serious ones carry 22 per cent, driven mainly by events Malaysia does not control: a war in the Gulf or a clash in the South China Sea.

Three dates matter for a budget. The monthly fuel surcharge is expected to peak around January 2027. During 2027 the government sets electricity prices for 2028 onward. From 2029 to 2031 old power stations close, just as Johor's committed data centres start drawing power.

For an operator, an investor or a tenant, the national energy balance is the wrong number to watch. The right questions are narrower. Which substation does the campus sit behind? How firm is its connection date? Who owns the power? How many hours of diesel does it hold if the grid and the fuel supply fail together? The open question is whether a given data centre gets its share of the power, on time and at a price that works.

Note. Almost four-fifths of the probability sits on paths where supply holds and only the cost rises.

Figures drawn from TheRiskAgent's country energy risk report on Malaysia, with a Data Centres and Cloud Hosting focus (November 2026): TNB, Energy Commission and ministry statements, regulatory filings, broker research and specialist energy and regional reporting. Produced with AI research tools and reviewed before release. Reference material, not advice. The full analysis is at theriskagent.com.