Cold Email Malaysia: Legal Rules & Scripts That Work

2. What Counts as Cold Email in Malaysia

Quick Answer: Cold email is a one-to-one business message sent to someone who never asked to hear from you, at a work address, about something relevant to their job. It is not a newsletter, not a blast, and not email marketing to an opted-in list.

The law, the inbox providers and the reader all treat cold email and email marketing differently. Three things separate them:

• Cold email is one-to-one in form. Plain text, no header image, no footer full of social icons. It should read like a message a person typed.
• Email marketing is one-to-many by consent. Someone gave you their address. There is a list, a template and a duty to let them leave. That ground is covered in our EDM guide for Malaysian SMEs.
• Bulk blasting is neither. It borrows the volume of marketing and the disguise of a personal note, and it is what gets domains blocked.

Hiring for the second category means an email marketing agency — a different engagement. Before either, check where your mail leaves from: business email hosting in Malaysia decides what you can authenticate.

3. Is Cold Email Legal in Malaysia? What the PDPA Requires

Quick Answer: Malaysia has no CAN-SPAM equivalent banning cold email outright. The Personal Data Protection Act 2010 governs it instead, and its demand is simple: collect data fairly, be transparent about who you are, and stop marketing to anyone who asks you to.

The Personal Data Protection Act 2010 (Act 709) regulates personal data in commercial transactions, and a named person’s work address is personal data. The Act does not say “never email a stranger” — it hands that stranger a right to shut you down, and the Personal Data Protection (Amendment) Act 2024 sharpened the duties on whoever holds it.

Four rules keep a cold email programme in Malaysia on the right side of the line:

1. Target the role, not the private life. Emailing procurement@ or a named manager about a work matter is defensible. Emailing a Gmail address found in a WhatsApp group is not.
2. Say who you are and where you got the address. One honest line — “I found you on your company site” — removes the main complaint.
3. Honour an opt-out immediately and permanently. Treat any version of “don’t email me” as final, across every tool you own.
4. Do not buy or scrape lists. You cannot show fair collection for data you did not collect, and bought lists are where the spam traps live.

Two duties sit alongside. Your claims still have to be true, and our guide to advertising law in Malaysia covers what you may promise. Tracking the resulting clicks is its own question, handled in consent mode and PDPA for GA4 and AI and PDPA for Malaysian marketers.

4. What Cold Email Actually Returns Here

Quick Answer: How the list was built predicts the result more than the copy does. Across ZenWeb-managed Malaysian outreach, a hand-researched list of 80 named contacts returns a 9.4% reply rate. A purchased list of 5,000 returns 0.4% and burns the domain doing it.

Read the last column against the first. The hand-built list produced twenty-three times the reply rate of the purchased one, with roughly one-thirtieth of the complaints. Volume never compensated for accuracy. That complaint column also has a hard ceiling attached, which the next section explains.

Measurement here is unusually simple: replies per hundred sent, meetings per hundred replies. Our primer on what performance marketing means and our guide to hiring a performance marketing agency in Malaysia apply the same thinking to paid channels.

5. The Sending Setup Google Now Requires

Quick Answer: Since February 2024, any sender emailing Gmail accounts needs SPF or DKIM, valid reverse DNS and a spam rate under 0.3%. Over 5,000 messages a day means SPF, DKIM and DMARC together. Most Malaysian SME domains fail one of these on day one.

Google’s email sender guidelines set the floor, and most Malaysian business inboxes run on Gmail or Google Workspace. That floor matters to outreach because a stranger who marks you as spam counts against a threshold measured in tenths of a percent.

• Authenticate before the first send. SPF and DKIM at minimum; add DMARC even at p=none so you can see what is being sent in your name.
• Do not send from your main domain. Use a separate sending domain so a bad month never touches quotations and invoices.
• Warm up slowly. Google advises raising volume gradually, not in bursts. Twenty a day for the first fortnight is the instruction, not caution.
• Watch the 0.3% line. Google asks senders to keep complaints below 0.1% and never reach 0.3%. Scraped and purchased lists cross it on their own.

If mail already goes astray, fix that first: email landing in spam and a bounce rate that is too high both deal with domain health.

6. Where Malaysian Cold Emails Die

Quick Answer: Of every 1,000 cold emails sent by Malaysian SMEs in ZenWeb-tracked campaigns, roughly 88 never arrive, 214 land outside the inbox, 43 sit unopened and 604 are opened then ignored. About 51 earn a reply. The biggest loss happens after delivery, not before.

Most owners work on the second row and ignore the fourth. That is backwards. Deliverability costs you 214 messages; writing about your company instead of the reader’s problem costs 604.

Row one carries the quieter lesson. Eighty-eight bounces per thousand can damage a young domain by itself, which is why cleaning a decaying list comes before volume. If opens are the weak point, low open rates has the diagnostic steps.

7. Three Cold Email Scripts That Work

Quick Answer: A cold email that works in Malaysia runs under 100 words, names one specific thing about the recipient’s business, makes one small ask, and attaches nothing. These scripts cover the three situations SMEs actually face: no connection, a shared context, and a follow-up.

Script 1 — the observation opener. Use when you have no connection at all.

Subject: your Shah Alam branch page

Hi Faizal — your new branch is on the site but not on Google Maps, so it is not showing for “aircond service Shah Alam”. We fix that for HVAC companies. Worth 15 minutes next week, or shall I send a two-line summary instead?

Script 2 — the shared context opener. Use when there is a real link: an industry event, a shared supplier, a published article.

Subject: your comment at the MITEC session

Hi Ms Tan — you mentioned quotation follow-up eating your team’s afternoon. We built the same fix for two other KL suppliers in about a fortnight. Happy to walk you through it. Free Thursday morning?

Script 3 — the follow-up. Three or four working days later, same thread, something new added.

Subject: (reply in the same thread)

Hi Faizal — one extra thing. Two competitors now rank above you for that search. I can put their positions in a reply here, no meeting needed. If this is not a priority, say so and I will close the file.

The same trio makes all three work: a lowercase, specific subject; one sentence proving you looked; an exit the reader can take without guilt. Handling replies is its own job, covered in setting up a follow-up sequence, and once volume outgrows one person, a marketing automation agency handles the routing.

8. Subject Lines, Length and Reply Rate

Quick Answer: Shorter wins on both counts in ZenWeb-tracked Malaysian campaigns. Emails of 50–90 words reply at 7.8%; those over 200 words reply at 1.4%. Subject lines of two to four lowercase words outperform sentence-case subject lines by roughly two to one.

Two details deserve a pause. Under 50 words performs worse than 50–90, because too short leaves no evidence you looked and reads as automated. The bottom subject row is the giveaway: sound like a promotion and you get treated as one. That is the difference from email marketing to a list that opted in.

9. Follow-Ups, and When to Stop

Quick Answer: Two follow-ups is the sweet spot for Malaysian B2B outreach. The second email adds roughly half again on top of first-email replies; the third adds a little more; the fourth mostly generates complaints. Stop at three total messages unless the recipient engages.

The sequence that works is short and spaced out:

1. Day 0 — the opener. One observation, one ask, one easy exit.
2. Day 4 — new information. Same thread, something they did not have before. Never “just bumping this up”.
3. Day 11 — the close. A single line offering to close the file. It often gets the reply, because it costs nothing to answer.

Then stop. Messages four and five rarely convert and reliably raise complaints against that 0.3% threshold. Silence in Malaysian B2B usually means wrong timing, not no interest, so park non-responders for next quarter. Our guide to performance marketing services and fees sets out how outreach is usually scoped alongside paid channels.

10. Cold Email Against Other B2B Channels

Quick Answer: Cold email books a Malaysian B2B meeting for around RM 190 in ZenWeb-tracked accounts, against RM 340 for LinkedIn and RM 520 for search ads. It is cheap per meeting and slow to build, because the real cost is your time rather than media budget.

Referrals win on cost and lose on control; you cannot schedule them. Search ads win on speed and lose on price. Outreach sits between: affordable, controllable, hungry for hours you may not have. Read the last column before the second.

That is why outreach rarely stands alone. It fills the gap while slower channels mature, which is the sequencing our guides to growth marketing in Malaysia and performance marketing versus digital marketing both work through. For consumer businesses the same budget usually belongs in WhatsApp marketing instead, because Malaysians answer chat far faster than email.

11. Conclusion

Quick Answer: Cold email in Malaysia works when the list is small and researched, the sending domain is authenticated and separate, the message runs under 100 words, and the sequence stops at three. Get those four right and the legal side mostly takes care of itself.

The law is not the obstacle most owners assume. Identify yourself honestly, write to people about their work, stop when asked, and the PDPA is satisfied. The harder discipline is restraint — smaller lists, shorter messages, fewer follow-ups.

Start with 50 companies you would genuinely like to work with. Authenticate a separate sending domain, write one honest paragraph per company, send twenty a day. Inside a month you will know whether the channel suits your market, without risking the inbox your business runs on. Worth raising with your accountant: the spend may be deductible, as our guide to whether advertising is tax deductible in Malaysia explains.

12. Frequently Asked Questions

1. Is cold email legal in Malaysia?

Yes, when done properly. There is no outright ban on unsolicited business email. The Personal Data Protection Act 2010 governs how you handle the recipient’s data: identify yourself honestly, stay relevant to their work, and stop when they ask.

2. Do I need consent before sending a cold email in Malaysia?

Consent is the safest position and is required for marketing to a list. For one-to-one outreach to a work address, the practical standard is fair collection, honest identification and an immediate opt-out. Bought and scraped lists fail it.

3. How many cold emails can I send a day?

Start at 20 to 30 a day from a warmed sending domain and raise the number gradually, as Google advises. Above 5,000 messages a day to Gmail accounts, SPF, DKIM and DMARC must all be in place.

4. Should outreach go out from my main company domain?

No. Use a separate sending domain that resembles your main one. If complaints or bounces damage its reputation, your quotations, invoices and customer replies keep arriving normally.

5. How long before cold email produces a meeting?

Three to five weeks in ZenWeb-tracked Malaysian accounts, including list building and warm-up. If nothing has landed after roughly 300 researched sends, the problem is the offer or the target list, not the setup.