Cold Outreach Compliance in Southeast Asia: Country-by-Country Rules for B2B Teams

By Laurel · Updated Oct 8, 2026

Cold outreach compliance in Southeast Asia means meeting each country's personal-data law and its rules on marketing messages and calls. Singapore exempts business contact details from most PDPA duties but regulates bulk messages and Do Not Call numbers; the other four markets lean on consent or a lawful basis. This is general information, not legal advice, and rules change.

Outbound teams usually start in one market and drift into four more, carrying the first market's habits along. The five laws below disagree on whether a business email address is personal data, whether consent must precede the first message, and whether a WhatsApp ping counts as a call. For the motion around it, see the outbound sales playbook.

Key Facts

• Singapore's PDPA section 4(5) takes business contact information out of Parts 3, 4, 5, 6 and 6A, and the PDPC's Do Not Call guidelines set a Registry check's validity at 21 days.
• Malaysia's PDPA 2010 lets a person stop a company's direct marketing to them by written notice at any time (section 43).
• The Philippines' NPC Circular 2023-04 lets a controller treat direct marketing as a legitimate interest, after an assessment, when only personal information is processed.
• Vietnam's Personal Data Protection Law has applied since 1 January 2026, and Decree 91/2020/ND-CP allows advertising messages, emails and calls only after prior consent.
• Indonesia's Law 27 of 2022 gave controllers at most two years from 17 October 2022 to comply.

Two Layers of Rules: The Data and the Channel

A message has to clear up to two layers. Data protection law asks whether you may hold and use this person's details at all. Channel law covers the message itself: labels, opt-outs, calling hours, registers. Singapore and Vietnam spell out both; the other three rely mostly on the first. The US, EU, UK and Canada are covered in cold outreach laws explained.

Singapore (Spam Control Act section 7), Vietnam (Article 1), Indonesia (Article 2) and the Philippines (section 6) each reach senders abroad when the recipient or the data has a local link, so sending from outside doesn't escape them. Malaysia follows the sender: its Act covers a person established there or using equipment there (section 2).

The Five Markets at a Glance

Sources for each cell are in the country sections below.

Singapore: Business Contact Details Are Carved Out, Messages Aren't

Business Contact Information Under the PDPA

The Personal Data Protection Act 2012 defines business contact information (section 2(1)) as an individual's name, position or title, business phone number, address, email address or fax number, and similar details, "not provided by the individual solely for his or her personal purposes." Section 4(5) says Parts 3, 4, 5, 6 and 6A, the provisions on consent, access, care of data and breach notification, don't apply to it unless it's expressly mentioned.

But the carve-out has limits. A mobile number given for personal reasons doesn't qualify, and the Do Not Call rules sit in Parts 9 and 9A, which section 4(5) doesn't list.

Email and Instant Messages Under the Spam Control Act

The Spam Control Act 2007 covers unsolicited commercial electronic messages to email addresses, mobile numbers and instant messaging accounts (section 2). A message is commercial if its primary purpose is to offer, advertise or promote goods or services (section 3), and unsolicited if the recipient didn't request or consent to it. Publishing an address isn't consent (section 5). The test turns on the message's purpose, not its recipient.

The duties apply to bulk sending: over 100 messages with the same or similar subject matter in 24 hours, 1,000 in 30 days, or 10,000 in a year (section 6). Bulk senders must give an English unsubscribe statement and an address valid for at least 30 days, stop within 10 business days of a request, and put <ADV> before an email's subject title. Remedies are civil: statutory damages up to S$25 per message, capped at S$1 million unless higher loss is proved (section 14).

Calls, Texts and Chat Apps Under the Do Not Call Rules

The PDPC's advisory guidelines, revised 1 February 2021, cover three registers: No Voice Call, No Text Message and No Fax Message. Before sending a specified message to a Singapore number, a sender must check the Registry unless the person gave clear and unambiguous consent in a form that can be referred back to (section 43). A result is valid for 21 days. The rules reach voice calls, SMS and apps such as WhatsApp, iMessage and Viber that use a Singapore number.

Messages to an organization, other than an individual acting in a personal or domestic capacity, for any purpose of the organization are excluded. In the PDPC's example, calling a childcare company's HR manager about a product for its centres is outside the rules, but asking whether she'd like one for personal use brings it back in. The WhatsApp article and cold calling fundamentals cover the practice.

Malaysia: Consent First, With a Right to Stop Direct Marketing

The Personal Data Protection Act 2010 (Act 709), published at pdp.gov.my, regulates processing of personal data in commercial transactions and has no carve-out for business contact details. Under section 6, a data user (a "data controller" since the 2024 amendment) may not process personal data without consent unless an exception applies. The section 6(2) list includes contract performance and steps taken at the person's request before a contract, but no general legitimate-interests basis. Whether a given program fits is a question for Malaysian counsel.

Three details shape outreach:

• Consent must be provable. The Personal Data Protection Regulations 2013 require consent in a form that can be recorded and maintained, with the burden of proof on the data user.
• Notice includes the source. Section 7 requires written notice, as soon as practicable, of the purposes and any available information on where the data came from.
• Direct marketing can be stopped. Under section 43 a person can require a data user, by written notice at any time, to stop or not begin processing their data for direct marketing: communication "by whatever means" of advertising or marketing material directed to particular individuals. Ignoring the Commissioner's requirement to comply is an offence.

The Amendment Act 2024 added data protection officers and breach notification, and raised the maximum penalty on conviction for breaching the data protection principles to one million ringgit, three years' imprisonment, or both. A gazetted notice phased its sections in from 1 January to 1 June 2025.

Philippines: Legitimate Interests Are Available, Opt-Out Isn't Consent

The Data Privacy Act of 2012 (RA 10173) is administered by the National Privacy Commission. Its section 4 carve-out for position-related details covers government officers and employees, not private-sector business contacts, so a prospect's name and work email are personal information. Section 12 lists the lawful bases, including consent and legitimate interests, the latter unless overridden by the person's fundamental rights and freedoms (section 12(f)).

The NPC has issued marketing-specific guidance:

• Circular 2023-04, section 14. When processing is limited to personal information, a controller may treat direct marketing as a legitimate interest after assessing whether it qualifies. Consent is required where processing would significantly affect the person's rights and freedoms, and withdrawn consent can't be replaced by legitimate interests.
• Circular 2023-07. A legitimate interest assessment tests purpose, necessity and balance against the person's rights, with the interest declared to the person and the assessment documented.
• Advisory Opinion 2023-016. A soft opt-in (marketing unless the person opts out) isn't valid consent, but legitimate interests could support marketing to potential customers using only the contact details needed.

The Implementing Rules and Regulations add a right to object to processing, including direct marketing (section 34), and require consent plus a data sharing agreement for private-sector data sharing for commercial purposes (section 20), which matters for purchased lists. Section 25 of the Act penalizes processing without consent or authorization with one to three years' imprisonment and a fine of 500,000 to 2,000,000 pesos.

Vietnam: Consent Before Contact, and the Most Detailed Channel Rules

The PDP Law: Consent Is the Default

The Personal Data Protection Law, No. 91/2025/QH15, was issued on 26 June 2025 and applies from 1 January 2026. Decree 13/2023/ND-CP was the regime before it, and Article 39 lets consent given under that decree stand. The Ministry of Public Security is the focal state agency (Article 36).

Personal data is any data that identifies or helps identify a specific person (Article 2), with no business-contact carve-out. Consent must come before collection unless a law says otherwise (Article 11), and it's valid only if voluntary, informed, given per purpose and not inferred from silence (Article 9). The no-consent cases in Article 19 include emergencies, state work and performing agreements with the person; none of the listed cases is a general marketing basis. Article 7 prohibits buying and selling personal data except where a law provides otherwise, and Article 8 caps the administrative fine for buying or selling personal data at ten times the proceeds of the violation, falling back to the general 3 billion dong ceiling where that is higher. Article 28 ties advertising that uses personal data to the anti-spam rules.

Decree 91/2020: Advertising Messages, Emails and Calls

Decree 91/2020/ND-CP regulates advertising by SMS, MMS and USSD message, email and phone call:

• Prior consent. Ads and ad calls need the user's advance agreement through a listed route, such as a sign-up form (Article 11).
• Register and sender ID. Check the Do Not Advertise list first (Articles 7 and 11). Ad messages and calls must come from a registered brand identifier, not an ordinary phone number (Article 13).
• Labels and opt-outs. Messages and email subjects start with [QC] or [AD]. Email carries the advertiser's contact details and an opt-out at the end (Articles 15 and 17 to 20).
• Limits. In 24 hours, no more than 3 ad messages or emails to one number or address, or 1 ad call to one number, unless agreed. Messages run 07:00 to 22:00, ad calls 08:00 to 17:00 (Article 13).
• Stopping and records. Stop immediately on refusal, and keep consent and refusal records for at least a year (Articles 13 and 11).

Article 3 defines advertising messages as ones introducing products or services to the public, so whether one-to-one B2B outreach falls inside is a question for counsel; applying the rules to every Vietnamese contact avoids it. Chat apps such as Zalo aren't named in Article 1, and a draft decree from the Ministry of Public Security would replace Decree 91/2020 and extend the rules to internet-based messaging and calls. It isn't in force.

Indonesia: Explicit Consent, With a Legitimate-Interest Option

Law No. 27 of 2022 was promulgated on 17 October 2022 and took effect that day (Article 76), and Article 74 gave controllers and processors at most two years to conform. Personal data means data about an identified or identifiable individual (Article 1), with no business-contact carve-out. The Law doesn't mention marketing or advertising by name, so the questions are the lawful basis and the person's rights.

Article 20 lists six bases: explicit valid consent for specific purposes, contract, legal obligation, vital interests, public interest, and "other legitimate interests" balanced against the person's rights. Consent must be written or recorded (Article 22). A person can withdraw it (Article 9), and the controller must then stop processing within 3 x 24 hours (Article 40). An institution designated by the President enforces the Law (Article 58), and sanctions include fines of up to 2 percent of annual income or revenue linked to the violation (Article 57).

A Practical Checklist for a Regional Team

Build to the strictest rule you'll meet, then relax only where counsel says you can.

Before You Load a List

• Record each contact's source and date; Malaysia's notice rule and Philippine access rights both turn on saying where data came from. How B2B contact data works lists vendor questions.
• Tag contacts by the person's country and the phone number's country, not the company's headquarters.
• Keep personal mobiles and consumer email out unless you hold consent; the prospect list guide covers sourcing.
• Document the Philippine legitimate interest assessment before the first send, and hold prior consent for each channel in Vietnam.

Before You Send

• Check Singapore numbers within 21 days of sending, unless you hold evidenced consent or the B2B exclusion clearly applies.
• Put sender identity, postal address and a working opt-out in every email, plus <ADV> for bulk email to Singapore and [QC] or [AD] for Vietnam, and keep Vietnamese ad calls to 08:00 to 17:00.
• Draft with how to write a cold email and keep personalization to what a person would expect.

After You Send

One suppression list that every tool reads, updated the same day, beats all five clocks. The opt-outs and suppression lists article covers how to build it, and multichannel sequences shows where a stop request has to reach. A CRM that records where each lead came from and keeps chat history on one profile makes these records easier to hold. Rework's Lead module captures leads from many sources and its Prospect inbox keeps one profile per person across WhatsApp, LINE and Zalo; the WhatsApp CRM integration guide covers field mapping and deduplication.

Get Local Counsel Before You Scale

For how outreach lands culturally, see business culture in Southeast Asia and outbound in Southeast Asia. On the legal side, pick the first market you'll enter and have a local lawyer review the list source, the consent wording and the opt-out flow, then add the next country with its own review.