Skip to main content

​
Malaysia MCMC Sender & Marketing Rules

Malaysia regulates commercial messaging through the Malaysian Communications and Multimedia Commission (MCMC) under the Communications and Multimedia Act 1998 (Act 588), and personal data through the Personal Data Protection Act 2010 (Act 709), administered by the Personal Data Protection Department (JPDP) and amended by the 2020 MCO. The two regimes split your pre-launch work: the CMA shapes who may originate traffic and which sender identities Malaysian operators will deliver, while the PDPA governs whether you may use a recipient’s number for direct marketing at all. Scope. Your organization owns the lawful basis for each market. Orbit ships tenant-owned controls only — the consent ledger, suppression, keyword aliases, quiet hours, sender-registration tracking, and the send-gate — and defaults them open. You configure them for Malaysia; the MCMC and the JPDP enforce against you, not against a platform toggle. This page is documentation, not legal advice.
Enforcement exposure in Malaysia is two-track: the JPDP fines PDPA breaches, including direct marketing without the prescribed notice and refusal option, and Malaysian operators rewrite or filter sender identities that arrive on their network unregistered. Confirm the current position with Malaysian counsel before you launch.

​
1. Sender IDs: operator-routed registration

Read the live MY row of GET /compliance/country-rules?channel=sms on Country Compliance Requirements before you provision. Malaysia runs no public regulator-held sender registry; registration is routed through the Malaysian operators and the aggregators that connect to them. An alphanumeric sender ID that is not whitelisted for your traffic route is typically rewritten to a short code or filtered at the operator edge, so register the brand name you intend to display before the first send.
File the alphanumeric sender through Sender-ID Registration and keep MY traffic in rehearsal until the entry reports approved. Where the live row reports registration: required for your sender type, the send-time gate holds MY traffic until an approved entry exists — that hold is intended behavior, not a fault. One sender’s approval does not establish approval for another; file each brand name separately.

​
2. PDPA 2010: notice-and-choice direct marketing

The PDPA’s direct-marketing provisions are a notice-and-choice (opt-out) regime: before or at collection you must tell the person their data will be used for direct marketing, name the channels and the classes of third-party recipients, and offer a free, simple means to refuse that processing. A number collected to complete an order does not carry marketing rights with it; record the purpose at capture on the consent ledger. The 2020 amendments moved practice toward documented consumer consent, and the JPDP now expects you to produce the notice wording and the refusal record on complaint. Most tenants therefore operate MY marketing as recorded opt-in with a standing opt-out path — the stricter posture satisfies both readings. Keep per-recipient evidence: collection source, date, notice version, and any later refusal. Honor every refusal on the channel and purpose it covers, and keep opt-outs effective across imports and campaigns via Opt-Out & Suppression Lists. Absence of a refusal does not replace the notice duty: the PDPA asks for both the disclosure and the working refusal path.

​
3. STOP vocabulary

English STOP is the working keyword on Malaysian networks. Malay speakers will reply in kind, so publish the Malay term your consent text references and extend the Opt-Out Keyword Alias Table with a MY-targeted alias such as BERHENTI; the matcher’s case-folding and normalisation write the same suppression row for either reply. Route MY revocations at scope all so a contact who stops your SMS is not then voice-dialed by the same program.

​
4. Marketing-window posture

Malaysia has no codified national no-send window for marketing SMS; the MCMC’s consumer codes expect contact at reasonable hours, and operators treat persistent overnight campaigning as spam behavior. Set tenant quiet hours to cover the recipient-local evening and overnight hours (21:00–08:00 recipient-local is the conservative convention) on Quiet-Hours Configuration, and validate the +60 timezone resolution with Quiet-Hours Preview before you go live. Malaysia runs fixed UTC+8 with no daylight saving, so the window applies the same offset all year.

​
5. Obligations → Orbit surface table

​
6. Launch checklist

  1. Distinguish promotional from service traffic; the PDPA’s marketing notice applies to the promotional lane.
  2. Read the live MY row for each channel: accepted sender types, registration level, and stop requirement.
  3. File the alphanumeric sender through Sender-ID Registration and wait for approved before sending under it.
  4. Publish the direct-marketing notice — who sends, for what purpose, how to refuse — and record acceptance on the consent ledger.
  5. Publish the opt-out keyword in English and Malay and confirm both write suppression rows.
  6. Set tenant quiet hours over the recipient-local overnight window and validate the resolution.
  7. Test sender rendering, opt-out handling and delivery reporting with a small audience first.

​
Frequently asked questions

Does Orbit register my sender ID with the MCMC? No — the registration is filed through your aggregator and the Malaysian operators, as in every market. Orbit tracks the MY entry to approved and gates send-time traffic on it. Is Malaysian direct marketing opt-in or opt-out? The statute is notice-and-choice: disclose the marketing use and honor refusals. Because the 2020 amendments expect documented consumer consent, operating recorded opt-in with a standing opt-out path is the posture that satisfies both readings. Will a dynamic alphanumeric sender ID just work on +60? Do not assume so. Unregistered alphanumerics are rewritten or filtered at the operator edge; read the live MY row and register the name before you depend on it.