A company should not move a course attendance list into a sales campaign simply because it already has the file. Review what information was collected, the purpose explained to attendees and the applicable basis for the proposed marketing use. Administrative access to a list is not the same thing as permission to use every field for a different purpose.
Raffles Corporate Services works with a panel of experienced Singapore law firms who offer cost-effective and efficient legal service and advice. This article is general information only and is not legal advice.
The purpose limitation provisions in the Personal Data Protection Act concern appropriate purposes and the extent of personal-data handling. Start by identifying whether the information and proposed activity are covered, including any applicable exclusion or exception.
Inspect the fields before approving the campaign
A course file can contain names and contact details alongside attendance records, dietary requirements, accessibility arrangements or questions submitted during training. Much of that information may have been collected to organise the event. A marketer should not receive the entire file by default.
List the fields required for the proposed campaign and explain why each is relevant. Exclude unrelated details from the working audience file. Where information was supplied in a business capacity, review its classification rather than assuming that every item is treated identically under the PDPA.
Compare the new purpose with the original explanation
Locate the registration form and notice used for the particular event. Do not assume today’s website notice is the notice an attendee saw months earlier. Check any marketing choice recorded at registration and any later withdrawal or preference change.
If the campaign has a different purpose or involves a new recipient, review the necessary notification, consent or other applicable basis before proceeding. A vague assurance that “all attendees are our contacts” does not explain the decision.
Example: dietary instructions are not sales segmentation
A training organiser keeps meal requirements to administer a course. A sales colleague later proposes using that information to create targeted offers. The company should question whether that reuse is appropriate and supported, rather than treating the field as a convenient marketing attribute. The review should also consider whether the detail needs to remain in the retained event file at all.
Build an approved audience file
- Identify the proposed message and audience.
- Use the recorded preferences and applicable legal assessment.
- Include only the information needed to deliver the approved campaign.
- Apply relevant suppression and opt-out information.
- Control who receives the file and whether onward use is permitted.
Check the rules for the actual marketing channel as a separate matter. Approval of an internal dataset does not by itself resolve every requirement applying to a telephone, email or messaging campaign.
Keep evidence of the decision
Record the event, the notice and preferences reviewed, the approved fields and purpose, the person responsible and any advice obtained. Keep the campaign file separate from the original event administration file so later staff do not assume all fields were approved for reuse.
If the basis for the campaign cannot be established, pause the proposed use and consider a lawful way to obtain the information or permission needed. Do not manufacture a consent record or change an old form to make it appear that the person agreed earlier.
Does attendance mean agreement to future promotions?
Do not infer that from attendance alone. Review the actual notice, choices and applicable law.
Can we keep the original list while excluding it from marketing?
Review retention for the original purpose separately. A decision not to market does not answer how long an event record should be retained.
Related guidance
- Mapping the personal data your company holds
- Organising a data protection management programme
- Background on company data protection obligations
Help with company compliance and privacy matters
If you would like assistance organising your company’s compliance procedures or obtaining advice on a privacy issue, email [email protected] or WhatsApp +65 8501 7133. Our team can assist with corporate secretarial, accounting and tax matters. Where legal advice is needed, advisers from our associated law firms can assist. This is general information; legal advice should address the facts of the particular request or dispute.