WhatsApp Marketing Rules in Malaysia: What the PDPA, MCMC and Meta Actually Require

Short answer: a WhatsApp promotion to a customer is direct marketing under Malaysia's Personal Data Protection Act 2010 (PDPA). You need the person's consent, a written privacy notice in Malay and English, and you must stop when they ask: section 43 gives every individual the right to require you to stop processing their data for direct marketing. Since the 2024 amendments, breaching the data-protection principles carries fines of up to RM1 million and up to three years' imprisonment. Separately, the Malaysian Communications and Multimedia Commission (MCMC) has a new offence for unsolicited commercial electronic messages (section 233A of the Communications and Multimedia Act) that, as far as we could find on 26 October 2026, is not yet in force; its draft rules name internet messaging services explicitly. Meta adds its own duties on top: opt-in first, honour every opt-out. This is general information, not legal advice.

Four sets of rules and which ones reach WhatsApp

Malaysian businesses tend to hear "PDPA" and "MCMC" used interchangeably. They are different laws with different regulators, and a third and fourth layer sit on top.

The PDPA in brief

The PDPA applies to personal data processed in respect of commercial transactions, which is almost every business-to-customer WhatsApp conversation. Federal and state governments are outside it. The 2024 amendment renamed the person responsible from "data user" to data controller; older guidance uses the old term.

The principles that matter for messaging

• Consent (the General Principle). Personal data may not be processed without the individual's consent, unless an exception applies. The Personal Data Protection Regulations 2013 require consent to be in a form that can be recorded and kept. Practitioners read this as ruling out pure opt-out consent such as a pre-ticked box.
• Notice and Choice. You must give the person a written notice explaining what you collect, why, where it came from, who you share it with, and how to access or correct it. Section 7(3) requires it in both Malay and English.
• Security, Retention, Data Integrity and Access. Keep the list secure, do not keep it forever, keep it accurate, and let people see what you hold.
• Sensitive personal data. Health information is sensitive data and needs explicit consent; the 2024 amendment added biometric data to the category. An aesthetic clinic that messages "your filler follow-up is due" is processing health data.

Section 43: the right to stop direct marketing

Under section 43, a person may at any time, by written notice, require you to stop (or not to start) processing their personal data for direct marketing, which the Act defines as communicating advertising or marketing material to particular individuals by any means. You must comply within a period that is reasonable in the circumstances. If you do not, the person can complain to the Commissioner, who can order you to comply; ignoring that order is an offence carrying a fine of up to RM200,000, up to two years' imprisonment, or both. A customer replying "STOP" or "jangan hantar lagi" on WhatsApp is, in practice, exactly this kind of notice. Treat it as one.

The General Code of Practice

For sectors without their own registered code, the Commissioner issued a General Code of Practice, effective 15 December 2022. Among other things it repeats the duty to honour written requests not to process data for direct marketing within a reasonable time. Some sectors, including private healthcare, real estate, direct selling, tourism and education, are also classes of data users that must register with the Commissioner under the Class of Data Users Order 2013. Check whether your business is one of them.

What changed in 2025: the PDPA amendments

The Personal Data Protection (Amendment) Act 2024 came into force in three stages. These are the parts that affect a business running WhatsApp campaigns.

Do you need a DPO?

The Commissioner's DPO guideline, issued on 25 February 2025 and effective 1 June 2025, requires a DPO where you process the personal data of more than 20,000 people, the sensitive personal data (including financial information) of more than 10,000 people, or where your activities involve regular and systematic monitoring. The DPO must be proficient in Malay and English and either resident in Malaysia or easily contactable. A Shopify brand with 25,000 WhatsApp subscribers crosses the first threshold; a clinic with 12,000 patient records may cross the second.

Breach notification

Under the breach-notification guideline, if a personal data breach causes or is likely to cause significant harm, you must notify the Commissioner as soon as practicable and within 72 hours, and notify affected individuals without unnecessary delay and within seven days of notifying the Commissioner. Notification is made online through the JPDP portal. An exported contact list left in a shared drive, or a staff member walking off with the WhatsApp Business app phone, are the realistic WhatsApp scenarios.

MCMC: section 233 now, section 233A next

Section 233 is about harmful content

Section 233 of the Communications and Multimedia Act makes it an offence to use network facilities to send content that is obscene, indecent, false, menacing or grossly offensive with intent to annoy, abuse, threaten or harass, and, since the 2025 amendment, content sent with intent to commit fraud or dishonesty. The amended section has been in force since 11 February 2025, with a maximum fine of RM500,000 and/or two years' imprisonment. An ordinary promotion is not what it targets, but misleading "you have won" messages or fake delivery-fee links are.

Section 233A: the anti-spam offence waiting to start

The same amendment inserted a new section 233A prohibiting sending, causing to be sent, or authorising the sending of unsolicited commercial electronic messages. It was expressly excluded from the February 2025 commencement and will start on a date the Minister appoints. In August 2025 MCMC published a public consultation paper on the rules that would sit under it. We found no commencement order or final regulations as of 26 October 2026, so treat the following as proposals, not law:

• Scope: a commercial electronic message includes messages sent by "e-mail, SMS, internet messaging services, or similar communication modes". WhatsApp is squarely inside.
• Malaysian link: covers senders in or incorporated in Malaysia, and messages to people in Malaysia, wherever the sender is.
• Consent: express (an unticked box the person ticks, a form, written or electronic confirmation) or implied from an existing relationship. Implied consent would last up to 24 months after the last transaction, or 6 months after an enquiry with no purchase, and only for related products.
• Sender identity and contact details in every message, kept working for at least 30 days.
• A free, working opt-out in every message. The paper says withdrawals must take effect within 10 working days in one place and that opt-out requests must be processed within 5 business days in another; plan for the shorter.
• An "<ADV>" label at the start of the subject line or, where there is none, the first line of the message.
• No harvested or generated lists: buying, scraping or using lists collected by automated harvesting would be prohibited.
• Records: keep verifiable records of how, when and by whom consent was obtained.

None of this stops you messaging today, but it is a clear picture of where the regulator is heading. A campaign that already meets these proposals will not need rebuilding when 233A starts.

Are there rules on what time I may send?

We found no statutory time-of-day restriction on marketing messages in Malaysia, and the MCMC proposals do not include one. Sensible hours are still a quality issue: a 6 a.m. promotion earns blocks. QuickWA lets you set a sending window in Settings so scheduled broadcasts wait until it opens; it is off unless you switch it on.

Meta's rules: the layer that bites first

Malaysian enforcement under the PDPA is rare compared with the number of campaigns sent. Meta's enforcement is automatic and immediate. The WhatsApp Business Messaging Policy says you may contact people only if they have given you their number and opted in to receive messages from you, that you are responsible for how you collect that opt-in, and that you must respect every request, on or off WhatsApp, to stop. Meta also reviews opt-in flows reactively, often after user complaints.

• Templates and categories. Outside the 24-hour customer-service window you may only start a conversation with an approved template. Meta can move a utility template that carries promotion into marketing, and repeated miscategorisation can lead to restrictions across your portfolio.
• Quality rating. Blocks and reports lower your number's rating; low quality stops your messaging limit growing and can restrict sending.
• No surprises. The policy forbids messages that confuse, mislead, spam or surprise people. Messaging a list you bought at a property fair, or every number in a Facebook group, is exactly that.

Applying the rules to three Malaysian businesses

A clinic in Bangsar

Treatment reminders are health data and need explicit consent; capture it on the registration form, in Malay and English, with a separate tick for promotions. Keep reminders as utility templates with no offers. If the clinic holds more than 10,000 patients' records, check the DPO guideline.

An online seller in Penang

Customers who bought on your Shopify store and ticked "send me offers on WhatsApp" have given consent. Buyers whose details came through a marketplace are a different case: check that marketplace's seller terms before you add them to any WhatsApp list. Put "Balas STOP untuk berhenti" in every promotion, and remove anyone who replies STOP at once.

A property agency in Johor Bahru

Leads from your own Click-to-WhatsApp ads or website forms have opted in to hear about the project they asked about. A spreadsheet of numbers scraped from listing portals has not, and would be squarely caught by the harvesting ban MCMC has proposed. Buyers in Singapore are covered by Singapore's own rules as well as yours.

A practical checklist

1. Collect opt-in in writing, separately for marketing, naming your business and the WhatsApp channel. An unticked box or a "Ya, saya setuju" button both work; record the date and source.
2. Publish a bilingual privacy notice (Malay and English) and link it where you collect numbers.
3. Identify yourself in every promotion, using the name customers know.
4. Give a one-word way out in every marketing template and honour it immediately. In QuickWA, contacts who reply with English keywords such as STOP or UNSUBSCRIBE are opted out automatically; write "Balas STOP" in Malay templates so the keyword matches.
5. Separate utility from marketing templates, both for price and for compliance.
6. Never buy or scrape lists.
7. Check the DPO thresholds (20,000 people, or 10,000 for sensitive data) and appoint one if you cross them.
8. Write a breach plan that can meet 72 hours to the Commissioner and seven days to customers.
9. Restrict access to exported lists and the shared inbox; remove staff accounts when people leave.
10. Watch for section 233A regulations and the <ADV> labelling rule before they start.

QuickWA records consent per contact, keeps opted-out contacts out of broadcasts, and offers a number-quality view so you can see blocks building early. Setup details for Malaysian businesses are on our Malaysia page and in our step-by-step setup guide. For a specific campaign, ask a Malaysian data-protection lawyer.

Sources

• Data Protection Report (Norton Rose Fulbright), "New horizons in data protection: Malaysia's Personal Data Protection (Amendment) Act 2024" (commencement dates and penalties): dataprotectionreport.com (checked 26 Oct 2026)
• DLA Piper Privacy Matters, "Malaysia: guidelines issued on data breach notification and data protection officer appointment" (March 2025): privacymatters.dlapiper.com (checked 26 Oct 2026)
• Department of Personal Data Protection portal (registration, DPO and breach notification services): pdp.gov.my (checked 26 Oct 2026)
• Donovan & Ho, "Direct marketing and personal data protection in Malaysia" (consent form under the 2013 Regulations, section 43 penalty): dnh.com.my (checked 26 Oct 2026)
• MCMC, Public Consultation Paper on Unsolicited Commercial Electronic Messages (13 August 2025): mcmc.gov.my (checked 26 Oct 2026)
• Conventus Law / LAW Partnership, "Key updates to the Communications and Multimedia (Amendment) Act 2025" (section 233 penalties; section 92 excluded from commencement): conventuslaw.com (checked 26 Oct 2026)
• Rahmat Lim & Partners, "MCMC seeks feedback on proposed regulatory framework for unsolicited commercial electronic messages" (18 August 2025): rahmatlim.com (checked 26 Oct 2026)
• WhatsApp Business Messaging Policy: whatsappbusiness.com/policy (checked 26 Oct 2026)
• Meta, template category guidelines and recategorisation: developers.facebook.com (checked 26 Oct 2026)