Please read this first. This guide is general information to help sales teams understand the rules. It is not legal advice, and the law and the regulator's guidance change over time. Check the latest guidance at pdpc.gov.sg, and have a lawyer review your own outreach process.
If you prospect in Singapore by phone, SMS, WhatsApp or email, three sets of rules apply to you:
- The data protection provisions of the PDPA. These cover how you collect, use and look after personal data.
- The Do Not Call (DNC) provisions of the PDPA. These cover marketing calls and messages to Singapore phone numbers.
- The Spam Control Act. This covers unsolicited commercial messages sent in bulk.
They overlap, but they're not the same. A lot of confusion comes from treating them as one rule. Let's take them one at a time.
1. The PDPA and business contact information
The Personal Data Protection Act 2012 (PDPA) sets out how organisations handle personal data: getting consent, using data only for the purposes you told people about, keeping it accurate, protecting it, and not keeping it longer than you need.
For B2B sales, one definition matters a lot: business contact information. This is an individual's name, job title, business phone number, business address, business email and business fax number, provided for business purposes rather than solely personal ones.
The PDPA's data protection obligations largely don't apply to business contact information. In practice, that means you can generally use a prospect's work details to reach them about business matters without first getting consent under those provisions.
Two important caveats:
- The exemption doesn't switch off the DNC rules. Phone numbers are still covered by the DNC provisions below, whether they're business numbers or not.
- A mobile number isn't automatically business contact information. If the number is the person's personal phone, treat it as personal data.
2. The Do Not Call (DNC) Registry
This is the part that most often trips up sales teams.
What it covers
The DNC provisions apply to specified messages: calls and messages whose purpose includes offering, advertising or promoting goods, services, land or business opportunities. If you're selling, it's a specified message.
They apply to Singapore telephone numbers, meaning both mobile numbers and fixed lines.
The Registry has three separate registers:
- No Voice Call Register
- No Text Message Register, covering SMS, MMS and messages sent to a phone number
- No Fax Message Register
A person can sign up to one, two or all three.
Treat WhatsApp as a text message. Messaging apps that reach someone through their phone number, such as WhatsApp, should be treated as covered. If you'd have to check the DNC Registry before sending an SMS, check before sending the WhatsApp.
What you must do
Before you send a specified message to a Singapore number, you must either:
- check the number against the relevant DNC register and not proceed if it's registered, or
- hold clear and unambiguous consent from the person to receive that kind of message, evidenced in writing or another accessible form.
Checks are done through the DNC Registry at dnc.gov.sg. Your organisation registers an account and submits numbers to be checked.
DNC results are valid for 30 days. After that, check again before you call or text. A number that was clear last month may be registered today.
Other DNC requirements
- Identify yourself. A marketing message must include your organisation's name and a way to contact you.
- Don't hide your caller ID. Marketing calls must not conceal the calling number.
- No dictionary attacks or address harvesting. Generating numbers automatically, or using software that harvests them, to send marketing messages is prohibited.
What about B2B calls?
Messages sent to an organisation for its business purposes can fall outside the DNC rules. But the line isn't always obvious. A director's mobile might be a business line, or it might be their personal phone. When you can't be sure, check the number. It costs far less than a complaint.
What happens if you get it wrong
The PDPC can impose financial penalties for DNC breaches. For organisations these can reach S$1 million. Individuals, including sales reps who make the calls, can also be penalised.
3. The Spam Control Act
The Spam Control Act applies to unsolicited commercial messages sent in bulk by email, SMS or instant messaging.
If you run an email campaign to people who haven't opted in:
- Label it. The subject line must start with
<ADV>, followed by a space. - Include a working unsubscribe option that stays live.
- Honour unsubscribes within 10 business days.
- Don't use misleading subject lines or sender details.
Your compliance checklist
| When | Do this |
|---|---|
| Building a list | Record the source of every contact. Prefer business contact information. |
| Before calling | Check numbers against the No Voice Call Register, or confirm you hold consent. |
| Before SMS or WhatsApp | Check against the No Text Message Register, or confirm consent. |
| Before an email campaign | Add <ADV> to the subject, include unsubscribe, and set a 10-business-day process. |
| Every 30 days | Re-check any numbers you're still calling or messaging. |
| When someone opts out | Stop immediately, record it, and share it across your team and tools. |
| Always | Keep evidence: check results, consent records, opt-out logs. |
Common questions
Can I call a number I found on a company website? Often, yes, if it's a business line and you're contacting the organisation about business. If you're marketing to it, check the DNC Registry unless you're confident the B2B exclusion applies.
Someone gave me their card at an event. Is that consent? It's a good start for business contact information, but it isn't clear and unambiguous consent to receive marketing messages. If you plan to send marketing texts, check the DNC Registry or ask explicitly.
Do I need to check numbers I've bought from a data provider? Yes. The obligation sits with the person or organisation sending the message, not the provider. A good provider tells you where its data comes from and reminds you to check. It can't do the check on your behalf.
How SG Best Leads handles this
- We record a source for every company and contact in our database.
- Anyone can ask to be removed through our Remove My Data form. We suppress them from search, exports and enrichment.
- Every export reminds you to run a DNC check before calling or messaging.
- Our Acceptable Use Policy prohibits spam and reselling data.
We don't run DNC checks for you. That obligation stays with the sender, which is you.