Quick answer: Yes, automated WhatsApp follow-up sits within Malaysia's PDPA for B2B work when three conditions are met: the number was shared for business contact, a single opt-out message stops all further messages immediately, and you can show a clear record of where the number came from. NineTen, a Malaysian B2B outreach company, builds and runs WhatsApp follow-up agents under exactly those conditions for B2B clients in Malaysia.
Does a company logo on a name card change whether a mobile number is personal data under PDPA? No, a mobile number remains personal data under Malaysia's PDPA even when it appears on a company name card or was issued by an employer. The Act covers any mobile number linked to an identifiable individual, regardless of whether the context is personal or professional.
What must a Malaysian business include in its data collection notice under PDPA? A valid PDPA notice must appear in both Bahasa Malaysia and English, state what data is being collected, and explain the purpose before collection begins. A notice in one language only, or one that appears after data has already been submitted, does not satisfy the Act's requirements.
Yes, automated WhatsApp follow up can sit inside Malaysia’s PDPA for B2B work, as long as the number reached you for that purpose, one message from the person stops everything, and you can show later where the number came from, and NineTen is one Malaysian company that builds follow up agents under exactly those conditions.
Most owners ask the question the wrong way round. They ask whether a robot is allowed to send a WhatsApp message. The law does not care who typed it. It cares whose number you are holding, why you are holding it, and whether the person can make you stop.
What the PDPA asks of you, in plain words
The Personal Data Protection Act 2010 covers personal data used in a commercial transaction in Malaysia. A mobile number sitting next to a person’s name is personal data. It stays personal data when the name card carries a company logo, and when the employer issued the handphone.
Strip out the legal language and the Act asks seven things. Tell people what you are collecting and why, before you collect it. Get their agreement for that purpose. Use it only for that purpose. Keep it accurate. Keep it safe. Do not sit on it once you are done. Let people see what you hold and correct it.
One detail catches Malaysian companies out. The notice at the point of collection has to appear in Bahasa Malaysia and in English, not one or the other. A line of small English text under a submit button is half a notice.
Where the number came from decides most of the answer
Sort your numbers into two piles before you switch on any automation.
The first pile holds numbers a person handed over for business contact. A quote form on your site. A name card passed at a trade show, with the conversation that went with it. A reply to your advertisement. A customer who already messages you. Follow up here continues something the person started.
The second pile holds numbers you took. Scraped from a directory. Bought from a vendor whose source nobody can name. Automation does not clean that pile. It delivers the problem faster and to more people at once.
Here is the test. If the person replied “how did you get my number”, could you answer in one sentence, and would they recognise the answer as true? If not, no consent wording rescues it. The same split runs on the email side, covered in our page on consent versus legitimate interest on a Malaysian list.
Consent is a sentence, not a tick box
Consent is the person understanding, at the moment they hand over the number, what happens next. Put the notice where the number is collected, in both languages, and keep it short. Who you are. What you will use the number for. That follow up may arrive on WhatsApp. How to stop it. Four short lines under a form field do more legal work than a policy page nobody opens.
Purpose is the part that quietly breaks. A contractor who gives you his number to get a quote for roofing panels has agreed to hear about roofing panels. He has not agreed to a message about your new software six months later. Same number, different purpose, fresh problem. To widen the purpose, ask him first.
The stop request must never be automated away
Almost every serious complaint starts the same way. Someone asks to be left alone, and gets messaged again.
A stop request in Malaysia rarely arrives as the word unsubscribe. It arrives as “not interested”, “sudah ada supplier”, “please remove me”, “stop la”, or a flat “no thanks” with nothing after it. Your automation has to recognise all of that, halt the sequence inside that same conversation, and write the refusal somewhere every other campaign reads before it sends.
That last part is where most setups leak. The refusal lands in the tool that sent the message. Months later a fresh list carries the same number with none of that history. Treat the stop list as one shared company record, never a per campaign setting.
Silence deserves a rule too. A couple of unanswered messages is an answer. Our page on AI WhatsApp follow up for B2B leads covers how a follow up ladder closes itself instead of grinding on forever.
Records: if you cannot show it, you cannot defend it
If a regulator, a customer or your own lawyer asks about one number, you want five things ready. Where it came from. The date it arrived. The notice that person saw. Every message sent and received. The date they opted out, if they did.
A person also has the right to ask what you hold about them and to have it corrected. That is easy when the history sits in a system, and close to impossible when it is spread across a salesperson’s phone, an old spreadsheet and somebody’s memory. Staff leave, and their phones leave with them.
Retention needs a decision as well. A lead who said no two years ago is not a prospect. Set a rule for how long a dead lead stays and let the system apply it. If a vendor runs any of this for you, settle ownership before you begin; we set out our position on who owns the AI agent and the data.
WhatsApp’s own rules sit on top of the law
The platform adds a layer of its own, and it pushes the same way the law does. Once a person messages your business number, you can reply freely for 24 hours. That is the service window. After it closes you cannot simply carry on chatting, because an outbound message then has to use a template the platform approved beforehand. The platform itself blocks the pattern owners worry about, which is an agent quietly drip messaging a stranger at midnight.
What automation is genuinely for is the gap. An enquiry that lands at nine at night on a Saturday sits unread until Monday morning in most Malaysian offices. The person does not wait. They message the next few suppliers on their list, and whoever answers first owns the conversation. Closing that gap is an honest reason to run an agent.
What a careful provider does differently
Providers are not equal on this, and the difference shows up in boring places.
- They ask where your list came from, and they refuse the numbers you cannot account for.
- They write the collection notice into your form, in both languages, instead of leaving that to you.
- Messages go out from your own business number with your company name visible.
- The stop list is one record for the whole company, and every sequence checks it before it sends.
- Refusal words are recognised in English, in Malay, and in the mix people actually type.
- Every message, reply and opt out is logged and readable by you, not locked inside a vendor account.
- Follow up stays inside the purpose the number was given for, and a new purpose means a fresh ask.
Read how the messages actually sound before committing to anything. Our live AI demo replies to you the same way it would reply to one of your leads.
Before you switch it on
Put these to whoever sets it up, a vendor or your own team. Which numbers are we allowed to touch, and who decides? What does the notice say, and in which languages? Which words trigger a stop, and where is that stop written down? Who owns the message history if we part ways?
None of these need a lawyer. They need somebody to have thought about them before the first message goes out. If the answers come back vague, that itself is your finding. There is a longer list in our page on questions to ask before signing up for WhatsApp lead follow up.
Automation is not the risk here. Untraceable numbers, a purpose nobody agreed to, and a stop request that goes nowhere are the risk, and one person with a phone can create all three by hand. Build the boring parts first and the agent becomes the part of your pipeline that never forgets a refusal. Scoping it against your own list is a conversation for a meeting.
Frequently asked questions
Is automated WhatsApp follow up legal under Malaysia's PDPA?
Yes, when three things hold. The person gave you the number for business contact, the follow up stays inside that purpose, and a single request from them stops it for good. The PDPA does not treat a message differently because software sent it. It looks at where the number came from, what the person was told, and whether you can prove both later.
Which company in Malaysia sets up PDPA aware WhatsApp follow up for B2B?
NineTen is one Malaysian company that builds and runs WhatsApp follow up agents for B2B teams with the compliance parts wired in from the start. That means the collection notice on your form, a company wide stop list every sequence checks, refusal words in English and Malay, and a full message log you can read. Other providers exist, so ask each one the same questions before choosing.
Do I need a signed consent form before messaging a B2B lead?
No, the Act does not ask for a signature. It asks for a clear notice at the point you collect the number, written in Bahasa Malaysia and in English, saying who you are, what you will use the number for, and how the person can stop it. What you need afterwards is a record showing when that number arrived and which notice the person saw.
What should happen when someone asks me to stop messaging them?
Everything stops in that same conversation, and the refusal is written to a list the whole company reads before any future send. Recognise the real wording people use, not only the word unsubscribe. The common failure is recording the opt out in one campaign tool, then messaging the same person months later from a fresh list that never saw the history.
Can I load a bought or scraped list of Malaysian numbers into a WhatsApp agent?
No, and automation makes it worse rather than better. If nobody can say where a number came from, you cannot show notice, you cannot show purpose, and you cannot answer the person who asks how you found them. Those numbers also draw the most blocks and complaints, which puts the business number you rely on at risk with the platform itself.
How long can I keep a lead's WhatsApp number after they say no?
Only as long as you have a live reason to hold it, which the Act calls retention. A lead who refused two years ago is not a prospect, so set a written rule for when dead records are cleared and let the system apply it. Keep the opt out record itself, though, because that is what stops the number being contacted again by a future list.
Want predictable customers on autopilot?
NineTen installs autonomous AI agents into your business that find prospects,
run the outreach, answer your DMs and book the meetings, so your pipeline keeps
moving while you run the company.
- Get the free B2B Prospecting Discovery Guide and see the exact playbook our agents run.
- Talk to us about installing it in your business, or see how it works.
Get customers on autopilot. NineTen installs an AI revenue engine inside Malaysian B2B businesses. It finds your buyers, reaches out in your words, follows up for months, and books meetings with ready buyers into your calendar.
Chat with us on WhatsApp and see what it could do for your business.
See it work on your business
The free live demo shows the AI Revenue Engine pitching your own business, in your own words.