Does Malaysia's PDPA apply to a restaurant's WhatsApp offers?

Likely yes. The PDPA 2010 regulates personal data processing in commercial transactions, so keeping customer numbers for offers is covered.

• Removal right: the PDP Department says a person can ask an organisation to remove their details from direct marketing, and it must tell them when done.
• Keep an opt-out list and honour stop requests.
• Ask clearly before sending offers.
• Meta also requires opt-in.
• The Act was amended in 2024, so check the current text. Not legal advice.