Personal data and responsible calling
Personal data rules for Malaysian property agents calling leads
What the Personal Data Protection Act 2010 means for property agents who call and message leads: consent, purpose, stop requests, purchased lists and call recording.
Published 2026-09-23. Updated 2026-09-23.
Property agents handle a lot of personal data: names, phone numbers, budgets, family details and sometimes identity documents. In Malaysia, the Personal Data Protection Act 2010 sets out how businesses must handle that data, and it was amended in 2024. This guide explains, in plain language, the calling and messaging habits that follow the spirit of the Act. It is not legal advice. Check the current law and your agency’s policy, and ask a lawyer for anything specific.
The principles that matter most for calling
| Principle | What it means in practice |
|---|---|
| Consent and purpose | Use a number for the purpose the person gave it for, such as the enquiry they made |
| Notice | Tell people who you are and why you are contacting them |
| Disclosure | Do not pass their details to others without a proper basis |
| Security | Keep lead lists and recordings protected, not in open group chats |
| Retention | Do not keep data longer than you need it |
| Access and correction | People can ask what you hold and ask for corrections |
Stop requests
When someone asks you to stop calling or messaging, stop, record it, and make sure colleagues and any calling tool respect it too. A clear do not call list protects both the person and your reputation.
Purchased and shared lead lists
Be very careful with lead lists bought from third parties or shared between agents. Ask where the data came from and whether the people agreed to be contacted for this purpose. If you cannot answer that, do not call the list.
Recording calls
If you record calls, tell the caller at the start. A short line such as "This call may be recorded for quality and follow up" is common practice. Store recordings securely and delete them when no longer needed.
Using AI to call leads
If an AI agent makes calls for you, the same responsibilities apply. It should say who it is calling for, respect stop requests, avoid asking for sensitive data it does not need, and keep records secure. Lebah.io includes a do not call list, automatic opt out handling and an optional recording notice to support this.
- You only call people who enquired or agreed to be contacted.
- You introduce yourself and your agency on every call.
- Stop requests are recorded and respected by everyone.
- Recordings are announced and stored securely.
- You do not ask for identity numbers or documents on a first call.
Sources checked 22 September 2026
The 2024 amendments
The Act was amended in 2024. The changes include stronger obligations around data breaches, the appointment of data protection officers for some organisations and a right to data portability, among others. Check the current guidance from the Personal Data Protection Department to see how the changes apply to your agency.
Frequently asked questions
Can I call someone who enquired on a listing portal?
Generally, a person who left their number on an enquiry about a property expects to be contacted about that enquiry. Stay within that purpose and stop if asked.
Do I need to tell leads that a call is recorded?
It is good practice to tell them at the start of the call. Store recordings securely and delete them when no longer needed.
Can I share lead details with another agent?
Only with a proper basis, such as the person agreeing to it. Casually forwarding lead lists between agents creates risk.