The PDPA applies to electronic marketing activities that involve the processing of personal data for the purposes of commercial transactions. There are no specific provisions in the PDPA that deal with electronic marketing. However, the PDPA provides that a data subject may, at any time by notice in writing to a data controller, require the data controller at the end of such period as is reasonable in the circumstances to cease or not to begin processing his or her personal data for direct marketing purposes. 'Direct marketing' means the communication by whatever means of any advertising or marketing material that is directed to particular individuals.

Pursuant to PC01/2020, the Commissioner is considering issuing a guideline to data controllers on the mechanism of digital and electronic marketing. The Commissioner has sought feedback on a proposed requirement on data controllers to provide a clear mechanism for data subjects to unsubscribe from online services and the elements to be considered in preparing the guideline on processing personal data in digital and electronic marketing.

The Commissioner is also considering issuing a guideline on the implementation of direct marketing for data controllers. Feedback from the public is sought as to whether a proposed data controller is allowed to make the first direct marketing call to the data subject, the use of the 'opt-out' method, and the important elements to be considered in the preparation of such guideline.

In addition to PDPA, the Malaysian Communications and Multimedia Commission (MCMC) has also launched a Public Consultation Paper on Unsolicited Commercial Electronic Messages (PC MCMC) on August 13, 2025. This is in light of amendments to the Communications and Multimedia Act 1988 which prohibit the sending of spam which is in contravention of the Act. It proposes that the recipient must consent to the sending of the message, either expressly or impliedly, and consent must be recorded. Implied consent may be relied on only where there is an established relationship between the sender and recipient. Furthermore, all messages must include a clear, functional and no-cost mechanism for the recipients to withdraw their consent and unsubscribe from future communications. However, it should be noted that these requirements have not yet come into force.