Digital Marketing Lesgo Media · 2026
- RM0-RM118monthly tool cost to start
- 72 hoursPDPA breach reporting limit
- 5,000messages a day, Gmail and Yahoo threshold
A furniture retailer in Shah Alam once told me he had 4,000 customers. He did, sitting in an accounting system as invoices, with email addresses nobody had exported and no permission to send anything. That is a filing cabinet, not a list.
The vocabulary makes it worse. Agencies here quote for an EDM, courses teach email campaigns, and the software calls it a broadcast. Owners assume these are three separate things and pay for two of them.
This guide settles the terminology first, then covers what actually decides whether email works: getting permission properly under Malaysian law, the four automations that carry the revenue, and what it all costs in ringgit.
EDM and email campaign mean the same thing
EDM is short for electronic direct mail. The term took hold in Malaysia and Singapore during the early agency years and never left. A marketer in London saying email campaign means the same activity.
There is one local wrinkle. Some Malaysian vendors use EDM to mean the artwork itself, the designed HTML file that goes out. So when a quotation prices one EDM, ask whether that covers design, the send, or both.
From here on this article says email marketing, because that is what your software and its documentation call it. If your client says EDM, say EDM back. The label changes nothing technical.
Why email still wins repeat purchases
The difference between email and social media is ownership, not audience size. Organic reach on Facebook or Instagram is set by an algorithm that can change without warning, and it has. An email list sits in a database you control.
For repeat purchases that decides the economics. Someone who already bought is the easiest person to sell to again, and paying Meta again to reach them means buying the same customer twice. Email costs close to nothing.
Most Malaysian SMEs still have no list, for reasons that repeat across industries. The whole budget goes into ads, so nobody stores anything. Checkout forms collect a phone number but not an email. And WhatsApp becomes the default, which feels fine until you try to message 2,000 people at once.
WhatsApp is strong for one to one conversation here, but fragile as a broadcast channel: numbers get reported, bulk blasts trigger bans, and you never own the list. That is why the channel mix question is not email against ads. Ads bring people in, email brings them back.
Building a list without buying one
Start with one hard rule: do not buy a list. Databases sold in this market come without provable consent, bounce badly, and the spam complaints that follow damage your sending domain within days. A useful list gets built slowly, out of traffic you already have.
- Capture at checkout and on enquiry forms. The highest value source, because purchase intent already exists. Add a clear consent checkbox, unticked.
- Give a concrete reason to sign up. A specific discount, early access to new stock, or a guide people would use. Subscribe to our newsletter is not an offer.
- Collect in the shop. Warranty registration, digital receipts, or the guest WiFi login. Say plainly that promotions will follow.
- Use pages that already rank. If an article brings steady search traffic, put a related offer inside it, not in the sidebar.
- Clean the list every quarter. Remove anyone who has not opened or clicked in six months. A smaller responsive list beats a large dead one.
For a small shop with moderate traffic, a realistic early rate is tens of subscribers a month, not thousands. The actual figure depends on traffic volume, how good the offer is, and whether a physical location feeds the list.
What PDPA requires when you email Malaysians
The governing law is the Personal Data Protection Act 2010, Act 709. Its first principle is consent: you may not process personal data without permission. For marketing, that means permission before the first send.
Regulation 3 of the Personal Data Protection Regulations 2013 goes further: consent must be in a form that can be properly recorded and maintained by whoever collects it. That is why pre-ticked boxes are weak, and an empty checkbox with a stored timestamp is defensible.
Section 43 gives individuals the right to send written notice telling you to stop using their data for direct marketing. Once it arrives, you stop. An unsubscribe link is the easiest way to handle those requests automatically.
The law has since been tightened. The Personal Data Protection (Amendment) Act 2024 came into force in stages through 2025, with the major provisions starting 1 June 2025. According to summaries by Mayer Brown and DLA Piper of guidelines issued by the Personal Data Protection Department, the changes include a mandatory Data Protection Officer once you process data for more than 20,000 individuals, or sensitive data including financial information for more than 10,000; breach notification to the Commissioner within 72 hours; and notice to affected individuals within seven days after that. The maximum penalty for breaching the security principle rose to RM1,000,000 and three years imprisonment.
What this means for your form
- Unticked checkbox, ticked by the customer, never pre-selected.
- State what you will send and roughly how often, in ordinary language.
- Store the date, time and source of every consent you collect.
- Unsubscribe link in every promotional email, processed within two days.
This is general information for marketers, not legal advice. If you handle sensitive data or large volumes, speak to a lawyer.
Broadcasts and automated flows do different jobs
This is the most useful split in email marketing, and most owners do not know it exists. A broadcast goes to everyone at a moment you pick, like a Hari Raya sale. A flow is triggered by something a person did, and keeps running long after setup.
| Aspect | Broadcast | Automated flow |
|---|---|---|
| Timing | A date you pick | A customer action |
| Ongoing effort | New copy every time | Built once, runs for months |
| Relevance | Moderate, same message for all | High, matched to context |
| Revenue pattern | Spiky, tied to send dates | Steady month to month |
| Best for | Seasonal promotions, launches | Onboarding, recovery, repeat sales |
Most SMEs only send broadcasts, usually when stock is not moving, so results swing with the calendar. Flows give you a floor because they run daily either way. Build flows first, then set a broadcast schedule.
The four flows worth building first
Do not attempt ten automations in month one. These four capture most of what is leaking away.
- Welcome. Two or three emails after signup. Deliver what you promised, explain why the business exists, then make the first offer. Engagement here is the highest you will ever see.
- Abandoned cart. For ecommerce this is usually the biggest earner. One reminder within a few hours, another the next day. Do not lead with a discount, or customers learn to abandon carts on purpose.
- Post-purchase. Triggered after delivery. Thank them, explain how to use the product, ask for a review. Almost nobody here builds this one, and it cuts repetitive support questions more than anything else on the list.
- Win-back. For people who have gone quiet, timed to your product cycle. Sixty days for skincare, a year for furniture. Ask how they are getting on before selling.
If you sell services, replace abandoned cart with a follow-up for people who enquired and never answered the phone. Same principle: chase intent that already existed and got interrupted. Done properly it lowers your cost per lead without adding a ringgit to ad spend.
SPF, DKIM and DMARC without the jargon
These three are DNS records on your domain, doing one job between them: prove the mail really came from you. Without them your messages are far more likely to be filtered or rejected.
SPF lists which servers may send using your domain name. DKIM adds a digital signature so the receiver can confirm nothing was altered in transit. DMARC tells Gmail and Yahoo what to do when either check fails, and reports back on what is being sent in your name.
Since February 2024, Google and Yahoo have required all three from bulk senders, meaning anyone sending 5,000 or more messages a day to their users. Microsoft began enforcing similar rules for Outlook.com in May 2025. The rules also cover spam complaint rates, which should stay under 0.1 percent and must never reach 0.3 percent, plus a one-click unsubscribe built to RFC 8058 and processed within two days.
Set all three up even if you send far fewer than 5,000 a day. They cost nothing, providers keep extending the same standards to smaller senders, and most tools generate the records for you to paste into your domain panel.
How often to send, and what to measure instead of opens
Once a week is a safe starting point for most Malaysian SMEs, and twice a month is fine if you have nothing worth saying. Lists die from empty emails, not frequency. Raise it gradually and watch two numbers: unsubscribe rate and spam complaints. If either climbs, go back.
Measurement changed when Apple introduced Mail Privacy Protection in iOS 15 in 2021. It pre-loads images for Apple Mail users, including the tracking pixel, so an open is recorded whether or not anyone read the message. Open rates now look healthy and mean very little.
Measure what a recipient has to do deliberately: clicks, conversions, revenue per email delivered, unsubscribe rate and spam complaints. For one number to take into a management meeting, use revenue per recipient. Apply the same discipline across your marketing budget.
What the tools actually cost in ringgit
Email is among the cheapest channels to start. At roughly RM4.08 to the US dollar in August 2026, published vendor plans convert like this.
Those prices come from EmailToolTester’s 2026 Brevo review and EmailVendorSelection’s 2026 Mailchimp breakdown. Brevo’s free tier allows 300 emails a day, which covers most SMEs through their first year.
The bigger difference is how vendors count. Brevo charges by emails sent, so it stays cheap if you hold a large list and mail it rarely. Mailchimp charges by contact and its tiers jump, so 8,000 contacts means paying the 10,000 rate.
The real cost is not the subscription but the hours spent writing and monitoring. Budget two to four hours a week, plus a full day once to set up the four flows. If you outsource, ask for setup and retainer quoted separately, the same way you would assess any agency.
Nak tahu angka sebenar untuk business anda?
Hantar detail ringkas. Kami semak akaun atau website anda, pastu tunjuk di mana duit bocor dan apa langkah paling berbaloi seterusnya.
Frequently asked questions about EDM and email marketing in Malaysia
What is the difference between EDM and email marketing?
There is no technical difference. EDM stands for electronic direct mail and is the common term in Malaysia and Singapore, while other markets say email campaign. The only confusion is that some local vendors use EDM to mean the HTML artwork itself, so check whether a quotation covers design, the send, or both.
Can I buy an email list in Malaysia?
You can find them for sale, but do not buy one. Purchased data comes without provable consent, which conflicts with the consent principle under PDPA 2010. Technically it is worse: bounce rates and spam complaints from bought lists damage your sending domain within days, after which even legitimate email lands in the junk folder.
What does PDPA require on my opt-in form?
Consent must be in a form that can be properly recorded and maintained, under Regulation 3 of the Personal Data Protection Regulations 2013. In practice that means an unticked checkbox the customer ticks themselves, a plain description of what you will send, and stored records of the date and source of each consent. This is general information, not legal advice.
Do I need to appoint a Data Protection Officer?
Under the Personal Data Protection (Amendment) Act 2024, in force in stages during 2025, appointing a DPO is mandatory once you process personal data for more than 20,000 individuals, or sensitive data including financial information for more than 10,000. Most small SMEs are below that, but a growing list can cross it unnoticed.
How often should I email my list?
Once a week is a safe starting point for most Malaysian SMEs. If you have nothing useful to share, twice a month beats sending filler. Increase frequency gradually while watching unsubscribe and spam complaint rates, and step back to the previous schedule if either rises.
Why are open rates no longer reliable?
Since Apple introduced Mail Privacy Protection in iOS 15 in 2021, images in email are pre-loaded for Apple Mail users, including the tracking pixel that records an open. An open is logged whether or not anyone read the message. Measure clicks, conversions, revenue per recipient, unsubscribe rate and spam complaints instead.
What are SPF, DKIM and DMARC?
All three are DNS records that prove email really came from you. SPF lists which servers may send using your domain, DKIM signs each message so content can be verified as unaltered, and DMARC tells Gmail and Yahoo what to do if either fails. Both have required all three from senders of 5,000 or more messages a day since February 2024.
Which automated flow should I build first?
Welcome first, because it is simplest and gets the highest engagement. Then abandoned cart if you sell online, since it usually produces the most revenue. Post-purchase next, to cut repeat support questions and collect reviews, and win-back last for customers who have gone quiet.
How much does an email marketing tool cost for a small SME?
You can start at RM0 on Brevo’s free plan, which allows 300 emails a day. As the list grows, paid plans begin around RM37 a month and rise to about RM118 for higher sending volumes. Mailchimp Standard at 2,500 contacts sits near RM245 a month at the August 2026 exchange rate.
Conclusion: the list matters more than the tool
EDM and email marketing are the same thing, so do not let vocabulary slow you down. What decides the outcome is whether you hold a list gathered with recorded consent, and whether the four flows run daily without anyone touching them. SPF, DKIM and DMARC make sure the mail arrives.
Versi Bahasa Melayu artikel ini boleh dibaca di Email Marketing Malaysia: Apa Itu EDM.
If you want us to check your opt-in forms, deliverability records and flows before the first campaign goes out, get in touch.
