SMS OTP and PDPA in Malaysia: What Every Business Needs to Know

Before sending a first bulk SMS campaign in Malaysia, there are legal and technical basics worth understanding — both to protect the business and to make sure messages actually get delivered when it matters most.

Table of Contents

• 1. PDPA and Consent
• 2. Transactional vs Marketing SMS
• 3. Why OTP SMS Needs a Reliable Gateway
• 4. Gateway Checklist for OTP Use
• 5. Sender ID: Why It Matters
• Putting This Into Practice
• Frequently Asked Questions

1. PDPA and Consent

Malaysia’s Personal Data Protection Act 2010 (Act 709) governs how businesses collect and process personal data — including phone numbers — in commercial transactions, and is enforced by the Department of Personal Data Protection (JPDP) under the Ministry of Digital (Department of Personal Data Protection Malaysia, pdp.gov.my). The Act was strengthened by the Personal Data Protection (Amendment) Act 2024, which introduced mandatory data breach notification requirements and expanded obligations on data controllers.

For SMS marketing specifically, this means:

• Consent is needed before sending marketing messages to a number
• Numbers should be collected transparently — sign-up forms, in-store registration, checkout opt-ins
• Buying or scraping number lists from third parties carries real compliance risk
• Marketing messages should include a clear way to opt out

2. Transactional vs Marketing SMS

Transactional messages — OTPs, order confirmations, or appointment reminders tied to a service the customer already signed up for — generally sit in a different category from marketing blasts, since they relate to a transaction the customer initiated. Even so, it’s good practice to be transparent about what SMS a customer will receive when they hand over their number, regardless of which category the message falls under.

3. Why OTP SMS Needs a Reliable Gateway

One-time passwords are the most delivery-sensitive type of SMS a business can send. If an OTP arrives five minutes late, the customer has usually already abandoned the login or checkout. This makes gateway reliability — not just price — the most important factor when choosing an SMS provider for OTP flows. SMS open rates as high as 98% have been reported by Gartner Digital Markets, but that figure assumes the message actually reaches the handset promptly in the first place, which depends entirely on the quality of the gateway’s telco routing (Gartner Digital Markets).

4. Gateway Checklist for OTP Use

Key things to verify in an SMS gateway before relying on it for OTP delivery:

• Direct routing to Malaysian telcos, not third-party international relays
• API delivery status callbacks, so failed messages can be detected and retried
• Fast average delivery time — seconds, not minutes
• Sender ID options appropriate for the business
• Clear uptime and support commitments from the provider

5. Sender ID: Why It Matters

An SMS from a random, unrecognized number looks like spam and gets ignored or reported. An SMS from a recognizable sender ID — the business’s actual name — builds trust and improves both open and response rates. Most Malaysian SMS gateways support custom alphanumeric sender IDs for exactly this reason, and it’s worth setting up before the first campaign goes out, not after complaints start coming in.

Putting This Into Practice

Getting SMS compliance and reliability right doesn’t require a legal team on retainer — it mostly comes down to using a provider built for the Malaysian market, with proper telco routing and delivery tracking already in place. Than Institute’s SMS Bulk Messaging service is designed with this in mind: direct local delivery, API integration for OTP and transactional flows, and the kind of dependable routing that time-sensitive messages need. Credit for the reliability that OTP and transactional flows depend on goes to having this kind of dedicated local delivery infrastructure rather than a generic international gateway.

Frequently Asked Questions

Do OTP messages need PDPA consent like marketing SMS?

OTP and transactional messages relate to a service the customer already initiated, which generally places them in a different category from marketing blasts. Businesses should still be transparent with customers about what SMS they’ll receive, and consult the official PDPA guidance at pdp.gov.my or a qualified legal advisor for their specific situation.

Why did my OTP SMS arrive late or not at all?

This is usually a gateway routing issue. Providers that rely on international relays rather than direct Malaysian telco routing tend to have slower or less reliable delivery, especially during peak sending periods.

What is a sender ID and do I need one?

A sender ID is the name or number that appears as the message sender. A recognizable, custom sender ID (like your business name) improves trust and reduces the chance of messages being ignored or reported as spam.

What happens if my business doesn’t comply with PDPA when sending SMS?

Non-compliance with the Personal Data Protection Act 2010 can result in penalties. Businesses should review the official Act and amendments at pdp.gov.my and seek qualified legal advice for their specific data processing activities.

Sources: Department of Personal Data Protection Malaysia (pdp.gov.my); Gartner Digital Markets. This article is for general informational purposes only and is not legal advice. For specific PDPA compliance questions, consult a qualified legal professional.