Marketing Calls, SMS and WhatsApp Messages in Singapore: The Do Not Call Registry and the Spam Control Act

Before a Singapore business calls, texts or WhatsApps a Singapore phone number to promote its goods or services, it must either check the number against the Do Not Call (DNC) Registry no more than 21 days before sending, or hold the person’s clear and unambiguous consent in a form it can produce later. The message must identify the business and give a working contact, and marketing calls must not hide the caller’s number. If you send commercial SMS, WhatsApp or email messages in bulk, the Spam Control Act 2007 adds further rules, including an unsubscribe facility and, for unsolicited messages, an <ADV> label.

This guide is for business owners, directors and marketing managers running telemarketing, SMS or messaging campaigns to customers and prospects in Singapore.

Which law applies to your campaign?

Two separate laws govern marketing messages. The DNC provisions in Part 9 of the Personal Data Protection Act 2012 (PDPA) apply to marketing sent to Singapore telephone numbers, even a single message. The Spam Control Act applies to unsolicited commercial electronic messages sent in bulk, including email. A campaign can be caught by both.

What counts as a marketing message under the DNC rules?

The PDPA calls it a “specified message”: broadly, a message whose purpose is to offer, advertise or promote goods, services, land or a business or investment opportunity. A Singapore telephone number is an eight-digit number beginning with 3, 6, 8 or 9.

The PDPC’s current Advisory Guidelines on the Do Not Call Provisions explain that several types of message are excluded by the Eighth Schedule to the PDPA, including:

• messages whose sole purpose is to complete or confirm a transaction the recipient has agreed to, deliver what they bought, or give warranty, recall or safety information;
• messages sent while you have an ongoing relationship with the recipient, where the sole purpose relates to the subject of that relationship;
• messages whose sole purpose is market research or a market survey;
• messages sent to an organisation for the purposes of that organisation (business-to-business marketing);
• messages sent by an individual acting in a personal or domestic capacity.

The PDPC also notes that a message promoting only a job opening, a charitable cause or a political cause, with no offer of goods or services, is not a specified message.

When does an ongoing relationship apply?

An ongoing relationship arises from a continuing subscription, membership, account, loan or similar arrangement, or regular dealings such as a package of treatments. The PDPC looks at continuity, regularity and frequency, and says a once-off transaction is not enough. The message must relate to the subject of that relationship. A gym can tell current members about a new class; it cannot rely on the membership to promote an unrelated insurance product.

Older material describes this exemption as a separate 2013 Exemption Order limited to text and fax messages. Since the PDPA amendments that took effect on 1 February 2021, the PDPC’s guidelines describe the exclusion as part of the Eighth Schedule. Check the current guidelines before relying on it for voice calls.

B2B calls that turn personal

A call to a company’s business number to sell a product for the company’s use is excluded. The PDPC gives the example of a salesperson who then asks the same contact whether they would like to buy something for personal use. At that point the exclusion no longer applies and the DNC rules do.

How to run a compliant call, SMS or WhatsApp campaign

1. Classify the message. Decide whether it is a specified message or falls within an exclusion. Write the reasoning down for each campaign.
2. Sort your list by consent. Separate numbers where you hold clear and unambiguous consent for that channel from numbers where you do not.
3. Check the DNC Registry for numbers without consent. Register an account at dnc.gov.sg and check each number against the register for the channel you will use. Results are valid for 21 days from receipt. Send only within that window.
4. If an agency checks for you, get the dates. Under section 43A, a third-party checker must give accurate results and tell you the date it received them and their validity period. You remain responsible as a “sender” if you cause or authorise the campaign.
5. Build the message correctly. Identify your business and give contact details the recipient can readily use, valid for at least 30 days after sending. The PDPC says short codes and no-reply email addresses are not enough.
6. Do not hide your number on calls. Section 45 prohibits concealing or withholding the calling line identity on marketing calls.
7. Apply Spam Control Act rules if sending in bulk. For bulk commercial SMS, WhatsApp or email, include an unsubscribe facility, and label any message sent without consent with <ADV> at the start.
8. Process opt-outs quickly. Under the PDPA, stop sending to a number within 21 days of the person withdrawing consent. Under the Spam Control Act, unsubscribe requests must be honoured within 10 business days.
9. Keep records. Retain consent evidence, DNC results, campaign lists and opt-out logs so you can answer a PDPC inquiry.

What is clear and unambiguous consent?

Under section 43(4), you need not check the DNC Registry if the subscriber or user of the number has given clear and unambiguous consent to receiving the message, evidenced in written or other form that can be accessed later. The PDPC’s guidelines look at two things: whether you told the person clearly and specifically that marketing would be sent to their phone number, and whether they agreed through a positive action.

• “You consent to receive special offers from us by SMS” is the kind of clause the PDPC treats as specific enough.
• “You consent to the use of your personal data for marketing purposes” is not, because it does not say marketing will be sent to the person’s phone number.
• Silence or a failure to untick a box is unlikely to count as clear and unambiguous consent.

DNC consent is a separate question from general PDPA consent to collect and use personal data. You need to satisfy both. Our guide on PDPA basics and data protection registers covers the wider obligations, and our note on handling a withdrawal of marketing consent explains how to update your systems when a customer opts out.

Practices that are prohibited outright

Section 48B of the PDPA prohibits sending any message to phone numbers obtained by a dictionary attack (automatically generating number combinations) or by address-harvesting software (software that collects published numbers from the internet). This applies even to messages that are not marketing, such as job recruitment, and even if you checked the DNC Registry. The PDPC gives the example of a company that adds 1 to the end of its existing customers’ numbers to find new prospects: that is a dictionary attack.

The PDPC’s guidelines say an employee who sends messages in good faith on instructions is not personally liable under this prohibition, but directors and similar senior officers can be. The Spam Control Act separately prohibits dictionary attacks and address harvesting for email and other electronic addresses.

What does the Spam Control Act require?

The Spam Control Act applies to unsolicited commercial electronic messages sent in bulk. “Unsolicited” broadly means the recipient did not request or consent to the message. For these messages:

• Include a working unsubscribe facility, with an English version, that recipients can use to stop further messages.
• Label unsolicited messages with <ADV> followed by a space as the first characters of the email subject line, or of the SMS or message text.
• Use honest subject lines and accurate sender information.
• Stop sending to anyone who unsubscribes; messages sent after 10 business days from the request are not treated as consented to.

A person who suffers loss from a breach can sue for an injunction and damages, or statutory damages of up to S$25 per message, capped at S$1 million in aggregate unless actual loss above that is proved. Anyone who aids or knowingly takes part in a breach can also be liable.

Example: a renovation company’s WhatsApp promotion

Example (hypothetical): A renovation company buys a list of 3,000 phone numbers from a marketing agency and plans to send a WhatsApp promotion over a week. It holds no consent from these people.

Each WhatsApp message is a specified message to a Singapore number, so the company must check every number against the No Text Message Register within 21 days before sending and remove listed numbers. The volume exceeds the Spam Control Act’s bulk thresholds, so each message needs the <ADV> label at the start, the company’s name and contact details, and an unsubscribe option. If the agency built the list by generating numbers automatically, the campaign breaches section 48B whatever the DNC results show. The company should also ask how the list was compiled and whether sharing it complied with the PDPA. Using an agency does not shift the company’s responsibility as a sender.

Campaign compliance checklist

• Message classified as specified or excluded, with reasons recorded
• Consent records showing what the person agreed to, for which channel, and when
• DNC Registry results dated within 21 days of sending
• Written confirmation from any third-party checker of the result date and validity
• Sender name and working contact details in every message
• Caller ID displayed on all marketing calls
• <ADV> label and unsubscribe facility for unsolicited bulk messages
• Opt-out log, with suppression applied across all systems and agencies
• Confirmation of how any purchased list was compiled

A company that runs regular campaigns should give this responsibility to its data protection officer, who can review each campaign before it goes out.

Frequently asked questions

Do the DNC rules apply to WhatsApp and Telegram messages?

Yes. The PDPC states that the DNC rules apply to marketing messages sent to a Singapore telephone number through apps that use the number as an identifier, such as WhatsApp and Telegram. They fall under the No Text Message Register.

We are an overseas company. Do these rules apply to us?

The DNC provisions apply if the sender is in Singapore when the message is sent or the recipient is in Singapore when they access it. An overseas company marketing to people in Singapore is generally covered. Overseas organisations can open a DNC Registry account.

Can we call existing customers without checking the register?

Only if you hold clear and unambiguous consent for that channel, or the call falls within an exclusion such as an ongoing relationship and relates solely to its subject. A customer who bought once a year ago is unlikely to be in an ongoing relationship.

Does a customer survey need a DNC check?

Not if its sole purpose is market research. If the survey also promotes an offer, it becomes a specified message.

Who is liable if our marketing agency breaks the rules?

Under the PDPA, a “sender” includes whoever sends, causes or authorises the message. Your company can be liable alongside the agency, so set out DNC responsibilities in your contract and check the agency’s records.

Need help with marketing compliance or a PDPC inquiry?

If your company, or you as a director or shareholder, is dealing with a marketing campaign that may breach the DNC rules or the Spam Control Act, or a PDPC inquiry about one, contact the Raffles Corporate Services team at [email protected] or on WhatsApp at +65 8501 7133 or +65 9018 0072. We will help you understand the documents and deadlines. Where your matter needs a lawyer, we will refer you to a firm on our panel of Singapore law firms that regularly handles data protection and marketing compliance. Raffles Corporate Services is a corporate services provider, not a law firm, and this article is general information, not legal advice.

The Raffles Corporate Services Editorial Team