Using an AI agent on WhatsApp under Malaysia's Personal Data Protection Act: what you collect, what you must tell customers, who processes the data, and the 2024 amendments
Every WhatsApp conversation with a customer contains personal data: a name, a phone number, often an address or a health detail. Adding an AI agent does not change the law, but it adds a processor (the agent's vendor) and usually a sub-processor (the AI model provider), and the PDPA has things to say about both. This is the practical version.
Quick answer
Under Malaysia's PDPA you are the data user for your customers' WhatsApp data. You must tell customers what you collect and why (a short privacy notice, in English and Malay), collect only what you need, keep it secure, not keep it longer than necessary, let customers access and correct it, and make sure any vendor that processes it (your AI agent provider and, through them, the AI model provider) does so under a contract with security obligations. The 2024 amendments added mandatory breach notification, a data protection officer requirement for some businesses, direct duties on processors, and higher penalties. ReplyKit publishes its processors, encrypts data, isolates each business, never trains on your conversations, and lets you export or delete everything. This is general guidance, not legal advice.
What in a chat is personal data
- Name, phone number, address, email: always.
- Appointment details, order history, what they asked about: personal data because it is linked to the person.
- Health information a patient types to a clinic, or financial details to an adviser: sensitive personal data, which needs explicit consent and extra care.
- Voice notes and photos: personal data too, and photos may show other people.
You collected this before the agent existed; the agent reads it to reply. What changes is that a vendor now stores and processes it on your behalf.
The seven principles, applied to WhatsApp
- General. Collect with consent, for a lawful purpose. Messaging you for a quote is consent to use the details for that quote; it is not consent to marketing.
- Notice and choice. Tell customers what you collect, why, who processes it, and their rights. A short notice linked in the first reply does it; the wording is in the privacy notice guide.
- Disclosure. Do not pass data to third parties beyond what the notice says. Your AI vendor and its AI provider are processors acting for you, which the notice should mention.
- Security. Reasonable protection: encryption, access control, a vendor contract with security terms.
- Retention. Keep chats only as long as needed. Decide a period (12 or 24 months is common for customer service) and delete.
- Data integrity. Keep it accurate; let customers correct it.
- Access. Customers may ask what you hold. A CRM with export makes that a two-minute job.
The 2024 amendments
Parliament passed amendments in 2024 that came into force in stages through 2025. The ones that matter for a small business with an AI agent: breach notification to the Commissioner and, for serious breaches, to affected customers; a data protection officer for businesses processing above thresholds set by the regulator; direct obligations on data processors for security, which means your vendor is now accountable in its own right, not only through your contract; a right to data portability; and substantially higher penalties. Check the current thresholds and guidance on the Personal Data Protection Department's site, since they are set by regulation and have been updated.
Questions to ask any AI agent vendor
- Where is the data stored, and is it encrypted at rest and in transit?
- Is each business's data isolated from other customers'?
- Which AI provider processes the text, under what terms, and do they retain or train on it?
- Can I export and delete all my data myself?
- Do you notify me of a breach, and how fast?
- Is there a written agreement covering security and processing?
ReplyKit's answers are in the privacy policy: data isolated per workspace and encrypted, processed by a named AI provider under business terms that do not retain it for training, exportable and deletable from the dashboard, with the processors listed. The general data-safety picture is in is an AI agent safe for customer data.
A ten-minute checklist
- Write or update your privacy notice to mention WhatsApp, the AI assistant, and your processors.
- Link it in the agent's first reply and on your website.
- Turn on the assistant disclosure so customers know they are talking to an AI.
- Decide a retention period and calendar the deletion.
- Keep a copy of your vendor's terms and privacy policy.
- Know how you would notify the Commissioner and customers of a breach, and who at the vendor to call.
- For clinics and advisers: get explicit consent before collecting sensitive data, in the chat, in writing.
Frequently asked questions
Do I need consent to use an AI agent on WhatsApp?
You need to tell customers what you collect, why, and that an assistant and a vendor process it, through a privacy notice. Messaging you is consent to handle their enquiry; marketing needs separate consent.
Is my AI vendor a data processor under the PDPA?
Yes, and since the 2024 amendments processors carry direct security obligations. You still need a notice and a written agreement.
Do I need a data protection officer?
Only above thresholds set by the regulator. Check the current guidance on the PDP Department's site.
What if there is a breach?
The amendments require notification to the Commissioner and, for serious breaches, to affected customers. Know your vendor's breach process in advance.
Is this legal advice?
No. It is a plain-English summary for small business owners. For your specific situation, consult a lawyer or the PDP Department's guidance.
Built in Malaysia, written for the PDPA
Isolated and encrypted data, named processors, export and delete any time. 7-day free trial, no card.
Sources and further reading
ReplyKit is an independent product and is not affiliated with or endorsed by Meta or WhatsApp. This article summarises Malaysian data protection law in general terms as of October 2026 and is not legal advice; consult a lawyer or the Personal Data Protection Department for your situation.