If your business sends promotional SMS, WhatsApp-style text messages or makes sales calls to Singapore numbers, the Do Not Call (DNC) Registry rules for businesses apply to you. They sit inside the Personal Data Protection Act (PDPA) and are enforced by the Personal Data Protection Commission (PDPC). Alongside them, the Spam Control Act sets separate rules for bulk commercial electronic messages. Getting either wrong can lead to complaints, investigations and financial penalties.
This guide is written for business owners and marketing teams. If you are a consumer trying to stop unwanted calls, our article on the Do Not Call Registry and spam calls is the one you want. What follows is general information, not legal advice. The PDPC’s website and advisory guidelines are the authoritative source, and the rules are updated from time to time, so check the current position before you launch a campaign.
What the DNC Registry Covers
The DNC Registry lets people in Singapore register their Singapore telephone numbers to opt out of marketing messages. There are separate registers for:
- Voice calls, including live and recorded calls.
- Text messages, such as SMS, MMS and messages sent through instant messaging apps to a phone number.
- Fax messages.
A number can be on one, two or all three registers. The rules apply to a “specified message”, which broadly means a message whose purpose is to offer, advertise or promote goods, services, land, business opportunities or similar. A purely transactional message, such as a delivery update, appointment reminder or receipt, is generally not a specified message, as long as it does not slip in promotional content. Messages sent to a business, rather than to an individual, are generally outside the DNC provisions, but check how this applies before you rely on it.
Your Core Duty: Check Before You Send
Before sending a specified message to a Singapore number, you must check the relevant DNC register, unless an exception applies. In practice:
- Submit your list to the DNC Registry. Organisations register an account with the DNC Registry and submit numbers for checking, either online or through a system connection for larger volumes. The PDPC charges for checks, with details on its website.
- Use results within the valid period. A check result is only valid for a limited number of days. Once it expires, you must check again before sending. Confirm the current validity period on the PDPC site and build it into your campaign schedule.
- Remove registered numbers. Do not message numbers that appear on the relevant register unless you hold valid consent or an exemption applies.
- Keep records. Keep evidence of your checks, consent and campaign dates in case the PDPC asks or a customer complains.
You must also identify your organisation in every specified message, include contact details the recipient can use to reach you, and not hide or conceal your calling line identity when making marketing voice calls.
Consent and the Existing Customer Exemption
There are two main routes for messaging a number that is on the registry.
Clear and unambiguous consent. If the individual has given you clear and unambiguous consent to receive specified messages on that number, you do not need to check the registry for them. That consent must be evidenced in written or other form that can be accessed for later reference. A pre-ticked box buried in terms and conditions is unlikely to be enough. Good practice is a separate, unticked opt-in that names the channels (calls, SMS, messaging apps) and the kinds of offers.
The ongoing relationship exemption. An exemption order allows organisations with an ongoing relationship with a customer, such as an active subscription, membership or account, to send certain marketing messages related to that relationship without checking the registry. It has conditions: the message must relate to the subject of the ongoing relationship, you must offer an opt-out, and you must stop once the person opts out. Check the PDPC guidance on which message types and channels the exemption covers.
Consent can be withdrawn at any time. When someone opts out, update your records promptly and make sure every team and vendor stops contacting them within the time the rules allow.
The Spam Control Act: A Separate Set of Rules
The Spam Control Act deals with unsolicited commercial electronic messages sent in bulk, including email and text messages. It overlaps with the DNC rules but has its own requirements, and a single campaign can trigger both. Under the Act, bulk unsolicited commercial messages generally need to:
- Carry the label “
” followed by a space at the start of the subject line or message. - Include an accurate sender identity and a functioning unsubscribe facility.
- Honour unsubscribe requests within the time the Act sets.
- Avoid misleading subject lines and headers.
- Not be sent using lists gathered by dictionary attacks or address-harvesting software.
The PDPA also separately prohibits sending messages to numbers generated through dictionary attacks or harvested with address-harvesting software.
| Requirement | DNC rules under the PDPA | Spam Control Act |
|---|---|---|
| Main question | Is the Singapore number registered? | Is the bulk message unsolicited and commercial? |
| Channels | Voice calls, text messages, fax | Email and text or multimedia messages |
| Key step | Check the register or hold valid consent or exemption | Label “ |
| Enforcement | PDPC, financial penalties | Civil action by affected parties |
Penalties and Who Is Responsible
The PDPC can investigate DNC breaches and impose financial penalties and directions. Penalty caps were raised in recent amendments and can be significant for larger organisations, so check the current figures with the PDPC. Some conduct, such as using dictionary attacks or harvested lists, carries more serious consequences.
Responsibility does not disappear when you outsource. If a telemarketing agency, SMS platform or freelancer sends messages for you, you are generally still accountable for ensuring checks were done and consent held. Write DNC compliance into your contracts, ask vendors for proof of checks and audit them.
A Practical Compliance Checklist
- Map every channel you use for marketing: calls, SMS, messaging apps, email and fax.
- Separate transactional and promotional templates, and keep promotional content out of service messages.
- Collect consent with a clear, unticked opt-in that names the channel, and store the record.
- Run DNC checks before every campaign and re-check when results expire.
- Identify your business and give contact details in every message.
- Make opting out easy and process requests quickly across all systems.
- Train sales staff on what they may and may not say on calls.
- Appoint someone to own PDPA compliance, often your Data Protection Officer.
Your customers are also becoming more wary of unknown senders, so registering your SMS sender ID helps your legitimate messages get through. Our explainer on the SMS Sender ID Registry and the Likely-SCAM label covers how that works, and our guide to when businesses can ask for NRIC numbers explains another common PDPA pitfall.
Frequently Asked Questions
Can I message a customer who gave me their number at checkout? Possibly, but giving a number is not automatically consent to marketing. You need clear and unambiguous consent that is recorded, or an exemption such as an ongoing relationship, or you must check the registry first. A separate, unticked opt-in naming the channels is safer than wording buried in terms.
Is it safe to buy a list of phone numbers for an SMS campaign? It is risky. You are still responsible for checking the relevant registers or holding valid consent, and lists built with dictionary attacks or address-harvesting software are prohibited. Ask the seller how the numbers were gathered, and obtain proof of consent and checks before using any list.
Do DNC rules apply to cold calls to other companies? Messages sent to a business rather than an individual are generally outside the DNC provisions, but that depends on the facts. Do not rely on this without checking PDPC’s advisory guidelines, particularly when the number may belong to an individual such as a sole proprietor.
How long should a business keep DNC check records? Keep them for as long as you may need to show compliance, such as when a customer complains or the PDPC asks. The PDPC’s advisory guidelines are the place to check on any specific retention expectations. Records should cover check results, consent evidence and campaign dates.
Does the DNC Registry cover email marketing? No, the DNC registers cover voice calls, text messages and fax to Singapore numbers. Marketing email falls under the Spam Control Act instead, which has its own requirements on labelling, sender identity and unsubscribe. One campaign can trigger both sets of rules, so check each channel.
Official sources: Personal Data Protection Commission