> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Malaysia MCMC Sender & Marketing Rules > Plan Malaysian A2P messaging around the MCMC posture under the Communications and Multimedia Act 1998, PDPA 2010 direct-marketing notice-and-choice, operator-routed sender-ID registration, and the tenant-owned controls that carry each obligation. # Malaysia MCMC Sender & Marketing Rules Malaysia regulates commercial messaging through the **Malaysian Communications and Multimedia Commission (MCMC)** under the **Communications and Multimedia Act 1998 (Act 588)**, and personal data through the **Personal Data Protection Act 2010 (Act 709)**, administered by the Personal Data Protection Department (JPDP) and amended by the 2020 MCO. The two regimes split your pre-launch work: the CMA shapes who may originate traffic and which sender identities Malaysian operators will deliver, while the PDPA governs whether you may use a recipient's number for direct marketing at all. **Scope.** Your organization owns the lawful basis for each market. Orbit ships tenant-owned controls only — the consent ledger, suppression, keyword aliases, quiet hours, sender-registration tracking, and the send-gate — and defaults them open. You configure them for Malaysia; the MCMC and the JPDP enforce against you, not against a platform toggle. This page is documentation, not legal advice. Enforcement exposure in Malaysia is two-track: the JPDP fines PDPA breaches, including direct marketing without the prescribed notice and refusal option, and Malaysian operators rewrite or filter sender identities that arrive on their network unregistered. Confirm the current position with Malaysian counsel before you launch. *** ## 1. Sender IDs: operator-routed registration Read the live `MY` row of `GET /compliance/country-rules?channel=sms` on [Country Compliance Requirements](/compliance/country-requirements) before you provision. Malaysia runs no public regulator-held sender registry; registration is routed through the Malaysian operators and the aggregators that connect to them. An alphanumeric sender ID that is not whitelisted for your traffic route is typically rewritten to a short code or filtered at the operator edge, so register the brand name you intend to display before the first send. ```bash theme={null} curl "https://api.orbit.devotel.io/api/v1/compliance/country-rules?channel=sms&country=MY" \ -H "Authorization: Bearer $ORBIT_API_KEY" ``` File the alphanumeric sender through [Sender-ID Registration](/compliance/sender-id-registration) and keep `MY` traffic in rehearsal until the entry reports `approved`. Where the live row reports `registration: required` for your sender type, the [send-time gate](/compliance/send-gates) holds `MY` traffic until an approved entry exists — that hold is intended behavior, not a fault. One sender's approval does not establish approval for another; file each brand name separately. *** ## 2. PDPA 2010: notice-and-choice direct marketing The PDPA's direct-marketing provisions are a **notice-and-choice (opt-out) regime**: before or at collection you must tell the person their data will be used for direct marketing, name the channels and the classes of third-party recipients, and offer a free, simple means to refuse that processing. A number collected to complete an order does not carry marketing rights with it; record the purpose at capture on the [consent ledger](/compliance/consent-management). The 2020 amendments moved practice toward documented consumer consent, and the JPDP now expects you to produce the notice wording and the refusal record on complaint. Most tenants therefore operate `MY` marketing as recorded opt-in with a standing opt-out path — the stricter posture satisfies both readings. Keep per-recipient evidence: collection source, date, notice version, and any later refusal. Honor every refusal on the channel and purpose it covers, and keep opt-outs effective across imports and campaigns via [Opt-Out & Suppression Lists](/compliance/opt-out-suppression). Absence of a refusal does not replace the notice duty: the PDPA asks for both the disclosure and the working refusal path. *** ## 3. STOP vocabulary English `STOP` is the working keyword on Malaysian networks. Malay speakers will reply in kind, so publish the Malay term your consent text references and extend the [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) with a `MY`-targeted alias such as `BERHENTI`; the matcher's case-folding and normalisation write the same suppression row for either reply. Route `MY` revocations at scope `all` so a contact who stops your SMS is not then voice-dialed by the same program. *** ## 4. Marketing-window posture Malaysia has no codified national no-send window for marketing SMS; the MCMC's consumer codes expect contact at reasonable hours, and operators treat persistent overnight campaigning as spam behavior. Set tenant quiet hours to cover the recipient-local evening and overnight hours (21:00–08:00 recipient-local is the conservative convention) on [Quiet-Hours Configuration](/guides/quiet-hours-configuration), and validate the `+60` timezone resolution with [Quiet-Hours Preview](/compliance/quiet-hours-preview) before you go live. Malaysia runs fixed **UTC+8** with no daylight saving, so the window applies the same offset all year. *** ## 5. Obligations → Orbit surface table | MCMC / PDPA obligation | Orbit surface that carries it | | - | - | | Alphanumeric sender-ID registration before delivery | [Sender-ID Registration](/compliance/sender-id-registration) submit-and-track flow; the [send-gate](/compliance/send-gates) holds `MY` traffic while the row reports `required` without an `approved` entry | | Direct-marketing notice with refusal option at collection | [Consent Management](/compliance/consent-management) — purpose and notice version pinned at capture | | Free, simple refusal, honored across channels | [Opt-Out & Suppression Lists](/compliance/opt-out-suppression) at scope `all` | | English + Malay STOP handling | [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) — add the `MY`-targeted Malay alias; seeded English family already matches | | Reasonable-hours marketing | [Quiet-Hours Configuration](/guides/quiet-hours-configuration) tenant control, validated with [Quiet-Hours Preview](/compliance/quiet-hours-preview) | | Restricted content | [Restricted & Prohibited Industries](/compliance/restricted-industries) — content rules layer on top of every `MY` posture | *** ## 6. Launch checklist 1. Distinguish promotional from service traffic; the PDPA's marketing notice applies to the promotional lane. 2. Read the live `MY` row for each channel: accepted sender types, registration level, and stop requirement. 3. File the alphanumeric sender through Sender-ID Registration and wait for `approved` before sending under it. 4. Publish the direct-marketing notice — who sends, for what purpose, how to refuse — and record acceptance on the consent ledger. 5. Publish the opt-out keyword in English and Malay and confirm both write suppression rows. 6. Set tenant quiet hours over the recipient-local overnight window and validate the resolution. 7. Test sender rendering, opt-out handling and delivery reporting with a small audience first. *** ## Frequently asked questions **Does Orbit register my sender ID with the MCMC?** No — the registration is filed through your aggregator and the Malaysian operators, as in every market. Orbit tracks the `MY` entry to `approved` and gates send-time traffic on it. **Is Malaysian direct marketing opt-in or opt-out?** The statute is notice-and-choice: disclose the marketing use and honor refusals. Because the 2020 amendments expect documented consumer consent, operating recorded opt-in with a standing opt-out path is the posture that satisfies both readings. **Will a dynamic alphanumeric sender ID just work on `+60`?** Do not assume so. Unregistered alphanumerics are rewritten or filtered at the operator edge; read the live `MY` row and register the name before you depend on it. *** ## Related references * [Country Compliance Requirements](/compliance/country-requirements) — the live `MY` row this page expands. * [Sender-ID Registration](/compliance/sender-id-registration) — the submit-and-track flow for the `MY` entry. * [Consent Management](/compliance/consent-management) — the notice and evidence contract. * [Opt-Out Keyword Alias Table](/compliance/opt-out-keyword-alias-table) — the custom-alias path for the Malay term. * [Quiet-Hours Configuration](/guides/quiet-hours-configuration) — the recipient-local window control. * [Regional Posture Hub](/compliance/country-rules-directory) — the index this page is listed in. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.