Custom Audiences From Your CRM: Setup and PDPA

Your customer list is the most valuable audience you own. These people already know your business, have bought before or asked for a quote. Uploading them to Meta lets you re-engage them, exclude them from prospecting ads, or use them as a seed for new audiences. No other Meta targeting is built on data this close to your real buyers.

It is also the most sensitive audience you own. Every row is someone’s personal data, and Malaysia’s Personal Data Protection Act now carries much heavier penalties than it did a few years ago. Many SMEs upload a spreadsheet exported from WhatsApp chats or a POS system without asking whether those customers ever agreed to marketing.

This guide from IZI Digital Marketing helps you decide which CRM data you can use, how to set up a customer list audience properly, and what to ask of anyone handling your list. It supports our guide to choosing a Facebook ads agency in Malaysia, because how an agency treats your customer data says a lot about how it will treat your account. The video below walks through the upload screens.

PART 1 · DIAGNOSE

What Are Custom Audiences From a CRM List?

IN BRIEFA customer list custom audience is a group Meta builds by matching emails or phone numbers from your CRM to Facebook and Instagram accounts. You can show those people ads, exclude them, or grow lookalikes from them. It sits alongside website and engagement audiences in a Meta retargeting audience plan.

Meta offers several audience types. Website audiences come from the pixel, engagement audiences from people who interacted with your page or videos. A customer list custom audience is different because the data comes from you. That gives you three practical uses:

• Re-engage past customers with repeat-purchase, upgrade or referral offers, instead of paying to find them again.
• Exclude existing customers from ads meant for new buyers, so your prospecting budget is not spent on people who already paid.
• Seed lookalike audiences that help Meta find people who resemble your best customers rather than your average clicker.

Before matching, Meta hashes your customer information, turning each identifier into a code that cannot be reversed. Hashing protects the data in transit, but it does not make the upload legal by itself. Whether you were allowed to use that data for advertising is decided long before you open Ads Manager.

BENCHMARK BRIEFING 1 OF 4

Which CRM Fields Improve Your Match Rate?

IN BRIEFIn our illustrative model, a Malaysian list with emails alone matches about 35% of rows. Adding correctly formatted phone numbers lifts it to about 58%, and adding names and city takes it to about 65%. Format matters as much as fields, which is why Meta ads targeting after the privacy changes leans on clean first-party data.

The biggest jump in the model comes from fixing phone numbers, not from adding more columns. Malaysian CRMs often store numbers as 012-345 6789, which Meta’s guidelines ask you to convert into a full international format with the country code. Emails also need lowercasing and trimming of stray spaces. Ten minutes of cleaning often beats buying a bigger list.

PART 2 · DIAGNOSE

Can You Upload Customer Data to Meta Under the PDPA?

IN BRIEFYes, if the customers were told their data could be used for marketing and shared with service providers, and they agreed. The PDPA does not ban custom audiences; it bans using data for purposes people were never told about. Your website’s privacy notice is where this starts, as our guide to PDPA website compliance explains.

The Personal Data Protection Act 2010 applies to personal data processed in commercial transactions. It rests on seven personal data protection principles published by the Department of Personal Data Protection (JPDP). Four of them decide most upload questions:

• General Principle: you need consent to process personal data, unless an exception applies. Advertising to past customers is rarely one of the exceptions.
• Notice and Choice: customers must be told the purpose of collection and who the data may be disclosed to, such as advertising platforms.
• Disclosure: data should not be disclosed for a purpose other than the one stated at collection, or to parties not named in the notice.
• Retention: data should not be kept longer than the purpose needs, so a ten-year-old list is harder to justify.

The stakes rose with the Personal Data Protection (Amendment) Act 2024. The maximum fine for breaching the principles went from RM300,000 to RM1,000,000, with up to three years’ imprisonment. Meta’s own Customer List Custom Audiences Terms also make you, not Meta, responsible for having the right to use the data.

BENCHMARK BRIEFING 2 OF 4

PDPA Checklist for Custom Audience Uploads

IN BRIEFEach of the seven PDPA principles maps to one practical check before a CRM upload. Consent and notice are checked at collection, security and retention at upload, and access requests afterwards. The same thinking applies when leads come from ad forms, which our guide to fixing junk leads from ads touches on.

The two highlighted rows fail most often. A privacy notice that only mentions “order processing” does not cover advertising, however reasonable the upload feels. Fix the wording on your forms today, and your list becomes cleaner to use every month from here on.

PART 3 · DESIGN

Which Customer Segments Should You Upload?

IN BRIEFUpload segments with a clear job, not your whole database. Recent buyers work as exclusions, high-value customers as lookalike seeds, and lapsed customers as win-back targets. Small segments tire quickly, so plan creative refreshes using our guide to ad fatigue on Meta.

In automated campaigns, the role of your list changes. Meta’s AI decides much of the targeting, so a customer list works best as a signal and an exclusion rather than a tight box to advertise inside. Our explainer on what Meta Advantage+ hands over to AI shows where existing-customer settings fit. Whatever the campaign type, name each segment clearly, for example “CRM – buyers 90d – exclude”, so anyone reading the account knows its job.

BENCHMARK BRIEFING 3 OF 4

How Big Is Your CRM Audience After Cleaning?

IN BRIEFIn our model, a 10,000-row CRM shrinks to about 3,500 matched people after removing rows without consent, cleaning duplicates and matching. That is roughly a third of what the owner expected. A small result is not a failure; pair it with pixel audiences from a sound Meta Pixel and Conversions API setup.

The consent column is the one owners forget. Removing rows without marketing consent is the step that protects you, and it usually costs less reach than expected because those contacts were least likely to buy again anyway. Treat the matched figure, not the row count, as your real audience size.

PART 4 · DEPLOY

How to Set Up a Customer List Custom Audience

IN BRIEFCheck consent, strip the file to the identifiers Meta needs, format them, and upload from an ad account your business owns. Then set a refresh date and a deletion rule. Ownership matters most, so first read our guide to keeping ownership of your Meta Business Manager.

1. Confirm the segment’s consent. Filter the export to rows collected with a notice that covers marketing and advertising partners.
2. Strip the file down. Keep only email, phone, first name, last name, city and country. Remove IC numbers, addresses, purchase notes and anything else Meta does not need.
3. Format the identifiers. Lowercase emails, remove spaces, and write phone numbers with the 60 country code, following Meta’s customer list formatting guidelines.
4. Upload from your own ad account. In Ads Manager, go to Audiences, choose Create audience, pick Customer list and accept the terms. Ads Manager hashes the file before sending it.
5. Delete the working CSV. Once uploaded, remove the stripped file from laptops, email threads and shared drives.
6. Set a refresh and removal rule. Update the list monthly, and apply opt-out requests to both your CRM and the Meta audience.

Step five is the one almost everyone skips. The biggest leak risk is the spreadsheet, not Meta. A cleaned customer file sitting in someone’s downloads folder is exactly the kind of exposure the new data breach rules were written for.

BENCHMARK BRIEFING 4 OF 4

How the PDPA Has Changed for Marketers

IN BRIEFThe PDPA stayed largely unchanged from 2013 to 2024. The 2024 amendments then came into force in three phases during 2025, adding higher fines, breach notification, data protection officers and data portability. Anyone running your Facebook ads agency work should now treat customer lists as regulated data.

For a customer list, the June 2025 changes matter most. If a CRM export leaks, the business may now have to report it through the JPDP’s data breach notification process. Uploading to Meta also sends data overseas, which is why the cross-border rules deserve a line in your privacy notice.

PART 5 · DRIVE

What Should Your Agency Do With Your CRM Data?

IN BRIEFAn agency handling your customer list is acting on your behalf, so it should upload into your ad account, keep no copies, and follow your deletion rules. Put these terms in writing before you share any file. A structured digital marketing RFP is the easiest place to ask.

Ask these questions of your current agency or any you are considering:

• Where will the list be uploaded? The only good answer is your own ad account, never the agency’s.
• How is the file sent and stored? Listen for a secure shared folder with an expiry date, not a WhatsApp attachment.
• Who deletes the working file, and when? A named person and a date, ideally within days of the upload.
• How are opt-outs applied? They should flow from your CRM to the Meta audience at every refresh.
• What happens to the audiences if we part ways? They stay in your account; the agency’s access is removed.

Customer lists also power the ads you show them. A warm audience often responds best to short, personal video, which our look at Reels ads in Malaysia that actually convert covers. To check how an existing account handles lists today, use our guide to auditing a Meta ads account before hiring.

CONCLUSION

CRM Custom Audiences: What to Decide Next

Custom audiences built from your CRM are some of the most accurate targeting Meta offers. They cut wasted spend through exclusions, bring past buyers back, and give lookalikes a strong seed. They also carry more legal weight than any other audience type, especially since the 2025 PDPA changes.

Make two decisions before your next upload. A consent decision sets which segments your notices actually cover. A handling decision sets who uploads, from which account, and when files and audiences are removed. Settle both and your customer list becomes a lasting asset rather than a hidden liability. For how we plan this inside a campaign, see our Meta ads services.

FAQ

Frequently Asked Questions

1. Is it legal to upload my customer list to Facebook in Malaysia?

Yes, with conditions. It depends on what customers were told when you collected their details; the PDPA expects notice and consent covering marketing and disclosure to service providers such as advertising platforms.

2. Does Meta hashing make my upload PDPA-compliant?

No. It depends on consent and notice, not encryption; hashing protects the data during matching, but whether you may use it for advertising was decided when you collected it.

3. What match rate should I expect from a CRM list?

Often between a third and two thirds of rows. It depends on list age and formatting; uploading email and phone together, with phone numbers in 60 country-code format, usually lifts the match rate noticeably.

4. Can I upload a WhatsApp contact list to Meta?

Usually not safely. It depends on whether those contacts received a notice mentioning marketing use; most WhatsApp contact lists were never collected with one, so leave them out.

5. How often should I refresh a customer list custom audience?

Monthly suits most SMEs. It depends on how fast your customer base changes; busy e-commerce stores may refresh weekly, and every refresh should apply the latest opt-out requests.

6. Should my agency keep a copy of my customer list?

No. It depends slightly on the service agreed, but the safe default is uploading into your own ad account and deleting working files within days, with that rule written into the contract.