Direct marketing is the smallest category on this site and the one carrying the most regulatory exposure per ringgit spent. The two facts are related: it is a trade people move into quickly, and the obligations are not obvious from the outside.
The duty is yours
The Personal Data Protection Act 2010 gives an individual the right to require that their personal data stops being processed for direct marketing purposes.
The important word is who. That obligation attaches to the data user — the party that determines how and why the data is processed. If you commissioned the campaign, that is you. An agency running it on your instructions is generally acting as a data processor, and outsourcing the work does not outsource the duty.
So “the vendor supplied the list” is an explanation. It is not a defence.
Ask where the list came from
This is the question that gets skipped, because the answer is sometimes uncomfortable and the list is already bought.
- Where was this data collected?
- What were people told at the point of collection?
- Is there a record of that consent, and can it be produced for a specific individual?
A list nobody can account for is not a cheap list. It is an unpriced liability that sits on your side of the table.
Build the opt-out before the campaign
An opt-out mechanism is not a footer link you add later. It needs to work, it needs to be honoured across every channel you are using, and — the part that most often breaks — the suppression has to survive the next list upload.
The classic failure is mechanical rather than malicious: someone unsubscribes, the suppression is recorded in one system, and a fresh import three months later reinstates them.
Practical shape of a defensible campaign
- Know the provenance of every record and keep that documentation.
- Contract explicitly on data protection roles with whoever runs the campaign.
- Keep suppression central, and apply it before send, not after complaint.
- Log the opt-outs. The record is the evidence.
Why this one is different
For most disciplines on this site, a bad decision costs money. Here it can cost money and attract a regulator, and the party the regulator looks at is the one whose product was being marketed.
That is worth an hour of diligence on a list you are about to pay for.