PDPA and SMS marketing:
what actually matters

This is a plain-language summary written by a bulk SMS provider, not a law firm. It is not legal advice. If your campaigns are large or touch sensitive data, get a Malaysian lawyer to look at your process.

The short version

• A mobile number tied to a person is personal data. The PDPA applies.
• You need a lawful basis to process it — in marketing, that is normally consent.
• Consent must be informed. "You gave us your number at checkout" is not the same as "you agreed to receive marketing".
• People must be able to opt out, and you must honour it.
• You must be able to show where a number came from.

What counts as consent

The practical test is whether the person would be surprised to receive your message. A customer who ticked a box saying "send me offers" will not be surprised. Someone whose number you got from a delivery form, a lucky draw run by another company, or a list you bought, will be.

Consent should be specific (marketing, not just "processing"), recorded (you can show when and how it was given), and separable (they can withdraw it without losing the service they signed up for).

Purchased and scraped lists

There is a market for Malaysian phone number lists. Buying one is a bad idea for three separate reasons, and only the first is legal:

1. You have no lawful basis. The seller's consent, if it existed, was not consent to hear from you.
2. Deliverability collapses. Cold lists generate complaints, complaints train operator filters, and filtered senders stay filtered. You can poison your own delivery rate permanently.
3. The data is usually junk. Recycled numbers, duplicates, landlines. You pay per segment to send to numbers that cannot receive anything.

This is the single most common reason a new sender's campaigns stop arriving. See why SMS is not delivered in Malaysia.

Opt-out, done properly

Every marketing SMS should carry a way out. In practice that means putting your own WhatsApp or phone number in the message so recipients can ask to be removed — for example To unsubscribe, WhatsApp 012-345 6789 — and deleting them from a suppression list you actually maintain. Recipients cannot reply to our shared short code 66886 (and we don't receive replies), so "Reply STOP" does not work on it.

Two things people get wrong: they put the opt-out only in the first message of a campaign, and they keep the opt-out list in a spreadsheet nobody checks before the next blast. If someone opts out and hears from you again, that is when complaints happen.

A practical checklist

1. For every number, can you say where it came from and when?
2. Did the person agree to marketing, specifically?
3. Does every campaign include an opt-out instruction?
4. Is your suppression list applied before every send, not after complaints?
5. Do you identify yourself in the message? Anonymous marketing SMS reads as scam and gets filtered as scam.
6. Do you delete numbers you no longer have a reason to keep?

Where our responsibility ends and yours begins

We provide the delivery channel. You are the sender: the content, the list, and the consent behind it are yours, and that is set out in our terms. What we will do is tell you when we think a campaign will get you into trouble — with the regulator, with the operators, or with your own customers — before you pay for it.

Last reviewed: 24 October 2026

Related guides: Why SMS is not delivered · Sender ID in Malaysia · SMS vs WhatsApp · SMS marketing rules · How to send a blast