PDPA WhatsApp Marketing Singapore: What to Know
Guide · 12 min read · Updated 27 Oct 2026
General guide to PDPA and WhatsApp marketing in Singapore: consent, Do Not Call provisions, service vs marketing messages, opt-out and record keeping.This is general information, not legal advice. Check pdpc.gov.sg for the current rules.
In Singapore, the Personal Data Protection Act (PDPA) shapes how you can use customers' phone numbers for marketing. As a general rule, you need consent to send marketing messages, you should respect the Do Not Call (DNC) registers, you must make it easy to opt out, and you should keep records. A reply to a customer who just asked you a question is a different thing from a promotion you start yourself.
Why this matters for a small business
WhatsApp feels informal, so it is easy to treat it as a free-for-all. You see a list of past customers and think, "let me send everyone a promotion." But a phone number is personal data, and the PDPA applies whether you send by SMS, call or message. Mistakes are avoidable if you know the shape of the rules.
The PDPC is Singapore's data protection regulator. Its website explains the Data Protection Provisions and the Do Not Call provisions in plain language, with guidelines, advisory notes and e-services such as checking numbers against the registers. We link to it throughout and we recommend you read the current pages yourself.
We tried to ground this guide against the PDPC site, but parts of its detailed pages were not accessible to us when writing, so we describe the rules at a general level and point you to the official source for specifics. We do not state penalties, time periods or exact thresholds here. Please check them at pdpc.gov.sg.
Two kinds of messages: service and marketing
The first question is always: what is this message for?
Service message vs marketing message
| Service message | Marketing message | |
|---|---|---|
| What it is | About something the customer already asked for or bought | Promotes or advertises goods, services or the business |
| Examples | Appointment confirmation, technician on the way, quote you were asked for, receipt | Discount offers, new service announcements, seasonal promotions, 'book now' pushes |
| Starts with | A customer enquiry or transaction | You deciding to reach out |
| Rules to think about | Keep it relevant to the transaction | Consent, DNC checks, identification, opt-out; check current PDPC guidance |
The grey area
A thank-you plus a review request is common. A message that is mostly about the service the customer just received is generally treated differently from one that pushes a new product. When you add a discount or a new-offer line, ask yourself whether the message has become marketing. When in doubt, check PDPC guidance or seek professional advice.
The building blocks of the rules
Four ideas to remember
Consent
Permission, given clearly, to receive marketing messages.
DNC check
Look at the registers before marketing to a number unless an exception applies.
Opt-out
An easy way to say stop, which you honour.
Records
Proof of what the person agreed to and when.
Consent
Consent should be clear and given by the person. A pre-ticked box on a form or a phrase hidden in terms may not be enough. A simple form line, such as "Yes, send me offers and updates on WhatsApp", with a tick the customer chooses, is easier to defend than silence.
Do Not Call registers
Singapore keeps DNC registers for voice calls, text messages and fax. PDPC publishes guidance on how they apply to different messages and different channels, including messaging apps. Check what it says today. If a customer gave clear consent to marketing, that is generally treated differently from a number you simply have. Your obligations depend on details, so read the current PDPC pages.
Identification and opt-out
Marketing messages should say who you are and how to stop receiving them. Make opt-out genuinely simple, and act on it quickly. Replying STOP should mean stop.
Records
Keep a note of who agreed, when, how and to what. A spreadsheet column or a CRM field is enough. PDPC guidance covers how long records should be kept; check the current period rather than guessing.
Worked examples of the line between the two
These are illustrations of how a business might think about the line, not rulings. Where a case is unclear, check PDPC guidance.
Which side of the line?
| Likely feels like service | Likely feels like marketing | |
|---|---|---|
| Aircon firm | 'Your technician is on the way, arriving around 2pm.' | 'Book your annual service this month and get a free filter check.' |
| Tuition centre | 'Your child's trial class is tomorrow at 4pm. Please reply to confirm.' | 'Enrol this week for our new holiday programme.' |
| Clinic | 'Reminder: your appointment is on Friday at 10am.' | 'Our new health screening package is now open.' |
| Salon | 'Thanks for visiting today. Here are your aftercare notes.' | 'Refer a friend and both of you get a treat.' |
A decision flow before you press send
Should I send this message?
A simplified way to think it through. It is not a substitute for PDPC guidance.
- 1
Did the customer ask me something?
If you are replying about their request, you are in service territory.
- 2
Is it about their job or booking?
Confirmations, updates and receipts for a transaction are service messages.
- 3
Does it promote anything?
Offers, new services or 'book now' lines make it marketing.
- 4
Do I have clear consent?
If not, do not send marketing until you do.
- 5
Have I checked the rules for this number?
Check current PDPC guidance and DNC register requirements.
- 6
Does it say who I am and how to stop?
Add both, and honour opt-outs.
- 7
Have I logged the consent?
Date, how, and what they agreed to.
Short version
Customer asked?
Reply about their request.
Promotion?
If yes, treat as marketing.
Consent?
Clear and recorded.
Opt-out ready?
Name and a way to stop.
How to get consent the right way
Consent line on a form
Example wordingOpt-in follow-up on WhatsApp
Example wordingOpt-out confirmation
Example wordingConsent from the past
Old lists are a risk. A spreadsheet of numbers from jobs three years ago is not a marketing list just because you have it. Ask yourself whether those people ever agreed to marketing, and keep a record.
The consent lifecycle
Consent is not a one-off tick. It has a beginning, a record, a use and an end. Thinking of it as a lifecycle helps you spot where small businesses usually slip.
From first tick to opt-out
- Collect
Customer chooses to opt in
A clear line on a form or a YES reply to your request. Not pre-ticked, not buried.
- Record
You log it
Name, number, date, how they agreed and what they agreed to receive.
- Use
You send what you said you would
If you said 'occasional offers', do not turn it into daily messages or unrelated products.
- Check
You review before each campaign
Look at the current PDPC guidance and your records before sending.
- End
Customer opts out
You stop promptly, confirm politely and update your record.
A scenario: the cleaning company promotion
Mei Ling has 400 past customers in a spreadsheet. She wants to blast an end-of-year promotion on WhatsApp. What should she think about?
Two ways to handle it
Risky
More careful
She can still reply to anyone who messages her, send booking confirmations, and send a review request after a job. Whether a particular review message counts as marketing depends on its content, so keep it simple and about the job.
More scenarios from Singapore small businesses
A tuition centre and the trial class list
A centre has 80 numbers from parents who enquired about trial classes over two years. Some enrolled, some did not. The owner wants to send a holiday programme promotion. The sensible questions are: did these parents agree to receive promotions, or only to be contacted about the trial? Is there a record? What do the current PDPC pages say about the message and the numbers? Without an answer, the safer course is to start collecting consent on the enquiry form, and to use the next trial confirmation to ask whether they would like to hear about future programmes.
A clinic and appointment reminders
A neighbourhood clinic sends reminders the day before each appointment. That is tied to a booking the patient made. The clinic then wants to add a line about a new screening package to every reminder. That one line may change how the message is viewed. A cleaner approach is to keep reminders as reminders and to send the screening message only to patients who have agreed to hear about services. Clinics should also check their own professional and advertising rules, which are separate from the PDPA.
An F&B shop and the delivery group
A cafe adds customers to a WhatsApp group so they can see daily specials. Some were added by a staff member after a takeaway order, without being asked. Adding people without their agreement is the kind of habit that creates complaints. A better approach is to invite them: a counter sign or receipt line that says "Join our specials list on WhatsApp", and let the customer start the chat or reply YES.
When someone complains or asks what you hold
Sooner or later a customer will say, "Stop messaging me" or "Where did you get my number?" How you react in the first hour matters more than the wording. The goal is to stop the messages, tell them honestly what you know, and fix your process.
If a customer objects
- 1
Stop sending
Remove them from every promotional list straight away.
- 2
Reply politely
Acknowledge, confirm they will no longer receive promotions.
- 3
Find the source
Check your records: form, event, referral, or old list.
- 4
Fix the cause
If it was a process gap, close it so it does not repeat.
- 5
Know where to look
If it escalates or you are unsure of your duties, read pdpc.gov.sg or seek professional advice.
Reply to a stop request
Example wordingReply to 'where did you get my number?'
Example wordingA simple yearly tidy-up
Marketing list housekeeping
Do this at least once a year, and before any big campaign.
Your list
- Every promotional contact has a recorded reason for being there
- People who opted out are marked and cannot be re-added by accident
- Old, unexplained numbers are removed or re-asked
- Staff know not to add people to lists or groups without asking
Your process
- Forms have an unticked, specific consent line
- Messages say who you are and how to stop
- You have read the current PDPC pages this year
- Someone in the business owns data protection questions
Common mistakes
Practical do and don't
Do
- Collect consent clearly, with a choice the customer makes
- Keep records of when and how people agreed
- Honour opt-outs fast
- Keep service messages about the service
- Read the current PDPC pages before a campaign
Avoid
- Treat a messaging app as outside the rules
- Blast an old list without checking consent
- Hide the opt-out or ignore replies saying stop
- Slip promotions into service messages
- Copy numbers from websites, groups or business cards for marketing
- Assuming consent from a transaction. A past purchase does not automatically mean the customer agreed to promotions. Check the rules.
- Forgetting to record consent. If a complaint arrives, you will want proof.
- Ignoring the website. If your site collects numbers, the form needs a consent line and a privacy policy. See PDPA for website owners.
- Relying on blog advice. Including this one. Read pdpc.gov.sg.
What Website.sg does and does not do
Website.sg gives you a way to run WhatsApp replies, follow-up and review requests from one inbox, with a dedicated WhatsApp Business number you buy separately from Twilio. The tools do not decide whether a message is lawful; that is your responsibility as the business. Use them for replies to customers and requests tied to a job, keep a record of consent for anything promotional, and check the current rules.
Frequently asked questions
Do the Do Not Call rules apply to WhatsApp?
Can I message a customer who asked for a quote?
Is a review request a marketing message?
How long do I keep consent records?
What are the penalties?
Next step
Add a clear consent line to your forms, start a simple record and read the PDPC pages today. If you want WhatsApp replies, follow-up and review requests in one place, see what Website.sg includes. Related reading: PDPA for website owners, WhatsApp review request templates and following up quiet customers.
Want a website without the hassle?
Website.sg builds your website and sets up web chat, WhatsApp follow-up and Google reviews for one monthly price.
See pricingRelated services
Keep reading