Malaysia is often the first ASEAN market for the companies we work with, and the first question is usually whether a business may be emailed at all without an existing relationship. There is no single yes or no. The answer depends on whose data is involved, what the message is for and how the sender behaves when someone asks to stop.
This is general information, not legal advice. Laws and official guidance change. Check the current position, and take advice on your own circumstances, before acting.
What the PDPA covers
The Personal Data Protection Act 2010 (Act 709) regulates the processing of personal data in commercial transactions. It is administered by the Personal Data Protection Commissioner and is built around seven principles: General, Notice and Choice, Disclosure, Security, Retention, Data Integrity and Access.
The Act was amended by the Personal Data Protection (Amendment) Act 2024 (Act A1727), which was brought into force in stages during 2025. Among other changes, the amendments introduced mandatory data breach notification, a requirement to appoint a data protection officer, a right to data portability and direct obligations for data processors. If your team last reviewed Malaysian data protection before 2025, it is worth reviewing again.
A company inbox is not the same as a person
The PDPA protects information about individuals. A named person’s work address, such as a purchasing manager’s own mailbox, identifies that person, so it is personal data. A generic inbox that a company publishes for enquiries, such as info@ or sales@, is an address for the organisation rather than for a particular individual.
That distinction does not remove every obligation, and a generic inbox is still read by people. But it changes the analysis, and it is why a published company inbox is the more cautious starting point for a first message. It is often the right route in practice too: a company that publishes an enquiry address has told the market where it wants to be approached.
Direct marketing and the right to say no
The PDPA gives individuals the right to require a data user to stop processing their personal data for direct marketing purposes. For senders, the practical consequence is simple. When someone asks you to stop, stop promptly, and stop across every campaign, not only the one they replied to.
Where a message is direct marketing aimed at a named individual, a consent-based approach is the cautious reading. A first contact that asks a company inbox one narrow business question is a different kind of message from a promotional mailing to a list of named people, and it should be written and handled that way.
What makes a first email easier to defend
| Question | Cautious practice |
|---|---|
| Where did the address come from? | The company’s own website, as a published business inbox. |
| Who is it addressed to? | The company or a role, unless there is a recorded reason to write to a named person. |
| Is the sender clear? | A real sender name, company and contact details in every message. |
| Can the recipient stop it? | A working unsubscribe that takes effect straight away. |
| Is the content accurate? | Only statements the sender can support with its own material. |
None of these steps is exotic. Together they keep the message modest, identifiable and easy to refuse, which is also what most recipients want from a stranger’s first email.
How we apply this
In Outreach Asia, Malaysian contact addresses come only from each company’s own website, and published business inboxes are preferred. Every first message waits in a 24-hour review window before it can send, so the client can read it, edit it or skip the company. Messages carry a one-click unsubscribe. An opt-out stops all further contact immediately and is added to a do-not-contact list shared across every client workspace.
The factual statements an email may use are drawn from the client’s own documents and approved before use, so a message cannot promise what the client has not confirmed. None of this is a legal opinion on a particular campaign. If you plan to contact named individuals at volume, take advice on your own circumstances first.
Before you move on.
- The address was published by the company itself.
- The message is addressed to the company or a relevant role.
- The sender’s identity and contact details are clear.
- An opt-out works immediately and applies to every campaign.
- Every factual statement can be supported.
This is general information, not legal advice. Outreach Asia describes its own rules and practices here; they are not a statement that any particular campaign complies with the law.