WhatsApp sales work in Malaysia. Conversion rates run 8–12% higher than SMS, response times sit at 90 seconds, and your buyers already have the app open. But the compliance layer is not optional: opt-in rules exist, PDPA messaging has teeth, stamp duty applies to digital contracts, and the BNM wants audit trails that prove you never harvested a number from a directory or bought a list from a vendor. Run this playbook wrong and you face fines, rejected invoices, and deals that evaporate in email recovery. Opt-in: Consent that holds under audit Malaysia's Personal Data Protection Act (PDPA) requires explicit, documented consent before your first message. "Explicit" means the customer said yes to WhatsApp outreach—not yes to your terms and conditions, not yes to SMS, not yes to email. WhatsApp specifically. The BNM and PDPC have clarified this in enforcement guidance: consent captured through a web form, a booking confirmation, or an in-app toggle counts. Consent scraped from public directories, imported from a purchased list, or inferred from a past purchase does not. How to build it: Capture at point of sale. When a customer books a meeting, completes checkout, or signs a quote, ask them to tick a box: "I consent to receive order updates and sales follow-up via WhatsApp." Store the timestamp, the IP, and the exact text they agreed to. A booking system with consent capture does this automatically—no manual logs. Segment by consent status. Tag every contact in your CRM with the date and method of consent. If consent is missing, automation should block WhatsApp outreach entirely. A CRM with tagging and automation rules prevents accidental broadcast to non-consented numbers. Revocation is easy. Every WhatsApp message should include a simple revocation link or instruction: "Reply STOP to opt out." Process revocations the same day and update your CRM immediately. This is not legal theater—auditors check your opt-out logs first. Archive consent proof. Store the original form submission, email confirmation, or booking record. If a compliance officer asks "did this person consent?", you need to show a screenshot, not a database flag. Consent must be explicit to WhatsApp, timestamped, and stored. Inferred consent fails audit. Purchased lists are prohibited. Opt-out logs are audited first. PDPA messaging: Data minimization in practice The PDPA allows you to send sales messages to consented numbers, but it restricts what data can travel in those messages. You cannot include personal information that is not necessary to complete the transaction or provide the service the customer asked for. This means: Do not send credit card details via WhatsApp. Send a secure link to a payment page instead. The message can say "Your invoice is ready: [secure link]" but the card data stays in an encrypted system. Do not forward customer personal data to team chat. If a sales rep needs to discuss a deal with a colleague, they should use your internal team chat channel, not WhatsApp, and only share the data fields necessary for the conversation (name, phone, order ID). Never paste full contact records or passport numbers into group chats. Use templates for repetitive messages. WhatsApp Business templates are pre-approved by Meta and audited by the PDPC. They sit outside your main message quota and are treated as system notifications, not marketing. Create templates for order confirmations, shipping updates, and invoice delivery. Avoid free-text sales pitches in templates—they lose the exemption. Delete old messages on a schedule. The PDPA requires data minimization: once a transaction is complete and the warranty period (or relevant retention rule) has passed, delete the conversation. WhatsApp does not auto-delete; you must run a monthly purge. Document this process—auditors will ask for it. Stamp duty on digital contracts: E-signature compliance Malaysia treats digital contracts signed via WhatsApp or third-party e-signature platforms as legally binding, but stamp duty still applies. If your contract exceeds RM1,000 in value or duration (sales agreements, service contracts, leases), you must pay stamp duty within 14 days of execution or face penalties. The trap: WhatsApp does not generate a legally compliant audit trail. Screenshots are not enough. If the contract moves into a dispute, a court will ask: "Can you prove this was signed by the customer, not forwarded or fabricated?" WhatsApp's message logs do not meet the evidentiary standard. Use a platform that generates forensic proof: Timestamp and signer identification. The platform must log who signed, from which device, at what exact time, and which version they signed. E-signature tools with audit trails record all of this and produce a report the IRB accepts. File the stamp duty claim within 14 days. Use the Inland Revenue Board's e-Stamp system or pay duty at your nearest Stamp Office. Keep the receipt and attach it to your contract record. Auditors will cross-check execution date