Singapore PDPA and DNC rules for AI marketing automation

By Reckona AIUpdated 25 October 20264 min read

Fast follow-up wins leads in Singapore. Before you automate it, here is what the rules require.

Key takeaway: In Singapore, automated marketing is shaped by the PDPA’s data protection rules, its Do Not Call provisions for marketing messages to Singapore telephone numbers, and the Spam Control Act for bulk unsolicited messages. Get clear consent, check the DNC Registry unless you hold clear and unambiguous consent in a form you can evidence, and make opting out easy.

PDPA data protection basics

Collect, use or disclose personal data only with consent or another basis the PDPA allows.
Tell people the purposes before or when you collect their data.
Protect the data, keep it only as long as needed and respond to access and correction requests.

The PDPC administers the PDPA.

The Do Not Call Registry

Before sending marketing messages by voice call, text or fax to a Singapore telephone number, you generally need to check the DNC Registry, unless the person has given clear and unambiguous consent in written or other accessible form. Marketing messages must also identify the sender and give contact details.

Bulk messages and the Spam Control Act

The Spam Control Act covers unsolicited commercial electronic messages sent in bulk by email or mobile number. It requires an unsubscribe facility and labelling of unsolicited advertisements, among other things.

AI tools and vendors

Know which tools process personal data and where.
Check transfer obligations if data leaves Singapore.
Confirm whether a vendor uses your data to train models, and put data processing terms in place.
The PDPC has published guidance on using personal data in AI systems; follow it where relevant.

A compliant set-up

Capture consent with wording and timestamp in your forms and WhatsApp opt-in flows.
Run DNC checks before messaging numbers without evidenced consent.
Sync opt-outs to every sending tool automatically.
Keep records of consent, DNC checks and messages sent.

This article is general information, not legal advice. Rules change; check current guidance from the relevant regulator.

How we approach it

Reckona AI scopes Singapore automation around the PDPA and DNC rules from day one. See Reckona AI in Singapore.

Frequently asked questions

Do I need to check the DNC Registry in Singapore?

Generally yes, before sending marketing messages by call, text or fax to Singapore numbers, unless you have clear and unambiguous consent from the person in written or other accessible form.

Does the PDPA apply to WhatsApp marketing?

The PDPA’s data protection rules apply to the personal data involved, and DNC rules can apply to marketing messages sent to Singapore numbers. WhatsApp’s own policies also require opt-in.

What is the Spam Control Act?

A Singapore law covering unsolicited commercial messages sent in bulk by email or mobile number, with requirements such as an unsubscribe facility and labelling.

Can I use AI tools on customer data in Singapore?

Yes, with a valid basis under the PDPA, appropriate protection, transfer safeguards and vendor terms. Follow the PDPC’s guidance on personal data in AI systems.

Want this done for your brand?

Start with a free audit: a written scope and a baseline of how AI assistants describe your brand today.

Get my free audit →