PDPA and marketing consent in Malaysia, explained for small businesses

Do I need consent to email or WhatsApp a customer?

In most small-business cases, yes. The PDPA is built around the idea that personal data is processed for a purpose the person was told about and agreed to. If someone gave you their number to receive an order, that is not automatically permission to add them to a weekly promotional broadcast.

The practical test is whether a reasonable customer would be surprised. Order updates about their own purchase sit comfortably within why they gave you the number. Marketing a new product line is a different purpose, and that is the one that needs consent.

• Ask at the point of collection, on the form, at checkout, or in the first message.
• Be specific about what they are agreeing to receive, and roughly how often.
• Keep marketing consent separate from the transaction, so agreeing to buy is not treated as agreeing to be marketed to.
• Do not pre-tick the box.

What counts as a good consent record?

Consent you cannot evidence is hard to rely on if it is ever questioned. You do not need a complicated system, you need to be able to answer three questions for any contact on your list.

1. When did this person consent?
2. What exactly were they shown or told at the time?
3. How did they give it, a form, a checkbox, a reply, a signed slip?

A spreadsheet with a date and a source column satisfies this. So does a customer record that stores the source and the date it was created, which is what a CRM gives you without extra effort.

How do I handle opt-outs?

Every marketing message should carry an obvious way to stop receiving them, and a request to stop must actually be honoured. The mechanism matters less than the follow-through: an unsubscribe link that leaves someone on the list is worse than no link at all.

• Put the opt-out in the message itself, not buried on a website.
• Act on it promptly, and across channels if the person asked broadly.
• Keep a suppression record so the same person is not re-added by the next import.
• Do not require someone to log in or call you to get off the list.

This is also simply good marketing. A list of people who want to hear from you performs better than a bigger list that resents you.

What changed with the PDPA amendments?

Malaysia amended the PDPA with changes phased in during 2025. Two are worth knowing about even for a very small business: a duty to notify a personal-data breach, and a requirement for some organisations to appoint a data protection officer. Obligations on data processors were also tightened.

Whether a particular duty applies to you depends on your circumstances, and the detail sits in the official guidance rather than in a summary like this one. If you hold a meaningful amount of customer data, this is worth twenty minutes with the current text or a short conversation with an adviser.

Does local-first software change my obligations?

It reduces how many parties touch the data, which is genuinely useful, but it does not remove your obligations. You are still the one deciding why the data is held and what it is used for.

Where it helps is scope: if the customer list sits on your own machine rather than being copied into several cloud services, there are fewer places to secure and fewer processors to account for. When you send an email the recipient address necessarily reaches your sending provider, which is true of any tool, so that relationship still counts.

What this means for your marketing

• Ask for marketing consent separately, at the moment you collect the contact.
• Store the date and the source alongside every contact.
• Put a working opt-out in every message and honour it quickly.
• Re-check the current PDPA guidance rather than relying on a summary, including this one.