Marketing to people in Singapore answers to two parts of one law: the data protection obligations of the Personal Data Protection Act 2012 (PDPA), which govern how your organisation collects, uses and discloses personal data such as names, email addresses and phone numbers, and the Do Not Call (DNC) provisions in Part 9 of the same Act, which govern marketing calls, text messages and faxes to Singapore telephone numbers. The Personal Data Protection Commission (PDPC) administers both. Before a marketing call, text or fax goes to a Singapore number, the sender checks the number against the DNC Registry within the previous 21 days, unless the recipient gave clear and unambiguous consent that is recorded for later reference. Bulk marketing email falls under a different law, the Spam Control Act, which the PDPC does not administer.
What the PDPA and the Do Not Call Provisions Cover, and Who They Apply To
The data protection obligations apply to organisations that collect, use or disclose personal data in Singapore, and the DNC provisions apply to specified messages addressed to Singapore telephone numbers where the sender is in Singapore when sending or the recipient is in Singapore when accessing the message, subject to the Act's exclusions. The PDPC's PDPA overview defines personal data as data about an individual who is identifiable from that data, or from that data and other information the organisation has or is likely to have access to. The PDPA generally does not apply to individuals acting on a personal or domestic basis, to employees acting for their organisation, to public agencies, or to business contact information such as a name, job title, business telephone number, business address and business email.
Which data protection obligations shape marketing?
Consent, notification and purpose limitation decide whether a marketing use of personal data is allowed at all, while accountability, protection and retention limitation decide how the data is held. The PDPC's list of data protection obligations sets out what each one asks of an organisation:
- Notification: tell individuals the purposes for which your organisation intends to collect, use or disclose their personal data.
- Consent: collect, use or disclose personal data only for purposes the individual has consented to, let the individual withdraw consent with reasonable notice, and stop once consent is withdrawn.
- Purpose limitation: use personal data only for purposes a reasonable person considers appropriate in the circumstances, and do not, as a condition of providing a product or service, require consent beyond what is reasonable to provide it.
- Accountability: designate a data protection officer and make your data protection policies and complaints process available on request.
- Protection and retention limitation: make reasonable security arrangements for personal data you hold, and stop retaining it, or dispose of it properly, once no business or legal purpose needs it.
What counts as a specified message under the DNC provisions?
A specified message is any message whose purpose, or one of whose purposes, is to offer, advertise or promote goods, services, land, property interests or business or investment opportunities, or to promote a supplier of them, and one marketing element is enough. The PDPC's organisation's guide to the DNC provisions applies this to voice calls, text messages and faxes, and states that a message with both service and marketing elements is still a specified message. Section 36 defines a voice call to include a call with a recorded or synthetic voice, and a Singapore telephone number as an eight-digit number beginning with 3, 6, 8 or 9.
Under the Eighth Schedule to the Act, several kinds of message are not specified messages at all. Two matter most to marketers: a message sent while the sender is in an ongoing relationship with the recipient, whose sole purpose relates to the subject matter of that relationship, and a message sent to an organisation for any purpose of the receiving organisation. The PDPC's examples of an ongoing relationship are a membership, subscription, account or loan; a one-off transaction does not establish one, and a service message that carries a promotion, such as a delivery update with a discount code, is a specified message.
What does the DNC check involve?
Before sending a specified message to a Singapore telephone number, the sender holds valid confirmation that the number is not listed in the relevant DNC register, checked within 21 days before the message goes out. Section 43 of the PDPA recognises two routes: confirmation received from the PDPC in response to the sender's own application, or information from a third-party checker that the sender has no reason to believe is out of date or inaccurate. Section 43A makes a checker who provides this information for reward ensure that it is accurate.
Section 44 requires every specified message to carry clear and accurate information identifying the individual or organisation that sent or authorised it, and how the recipient readily contacts them, reasonably likely to stay valid for at least 30 days after sending. A voice call does not conceal or withhold the sender's calling line identity (section 45). Under section 37(3) and (4), a business that authorises another person to promote its goods or services is deemed to authorise the messages that person sends to promote them, unless it takes reasonable steps to stop those messages.
What makes DNC consent valid?
Consent replaces the DNC check only when it is clear and unambiguous and is evidenced in written or other form that stays accessible for later reference. The PDPC describes valid consent as a positive action, such as ticking a checkbox, that relates specifically to the messages, tells the individual the messages go to their Singapore telephone number, and sits outside the general terms and conditions. Under section 46, consent is not validly given when an organisation requires it, as a condition of supply, beyond what is reasonable, or obtains it through false or misleading information or deceptive practices. Under section 47, an individual withdraws consent at any time, and the PDPC expects the organisation to stop sending within 21 days and to include clear withdrawal instructions in its messages, such as "Reply UNSUB".
What penalties apply?
The PDPC imposes financial penalties for intentional or negligent breaches, and section 48J of the PDPA sets the ceilings: up to S$200,000 for an individual and up to S$1 million for any other person who breaches the DNC provisions. For a breach of the data protection obligations, the ceiling for an organisation is 10% of its annual turnover in Singapore where that turnover exceeds S$10 million, and S$1 million in any other case.
General guidance, not legal advice.
What the Rules Mean for Your Marketing, Forms and Campaigns
Every form that collects personal data and every call, text or fax that markets to a Singapore number carries the rules, from enquiry forms and gated downloads to lead lists and SMS templates. The table matches common marketing claims and practices to the rule behind each one.
| Claim type | What the rule says | What to check | Source |
|---|---|---|---|
| Purpose statement on enquiry and lead forms | Notify individuals of the purposes of collection, use and disclosure; use the data only for purposes they consented to | Each form names every purpose, marketing included | PDPC, Data protection obligations |
| Marketing consent checkbox | Consent is a positive action specific to the messages, states they go to the individual's Singapore number, and is not hidden in general terms | An unticked box with its own wording; a record of when and how consent was given | PDPC, Organisation's guide to the DNC provisions; PDPA section 43(4) |
| "Free" offer in return for marketing consent | Consent required as a condition of supply beyond what is reasonable is not validly given | Gated downloads, giveaways and sign-up offers | PDPA section 46(1); PDPC, Data protection obligations |
| SMS and call campaigns | No specified message to a Singapore number without a DNC check in the previous 21 days or valid consent | The check date for every list, per register | PDPA section 43; PDPC guide |
| Sender identity | Clear, accurate sender identification and contact details valid for 30 days; no concealed caller ID | SMS templates, call scripts and outbound numbers | PDPA sections 44 and 45 |
| Bought or rented lists described as "DNC-cleaned" | The checker ensures accuracy and states the result date and validity; do not rely on information with reason to suspect it is out of date or wrong | The checker's result dates against your send dates | PDPA sections 43(2)(b) and 43A; PDPC guide |
| Business-to-business outreach | Business contact information sits outside the PDPA; DNC rules do not apply to business numbers unless the offer is for personal use | Lists hold work contacts only; offers are for business use | PDPC, PDPA overview; PDPC, Other data protection concerns |
| Marketing email | Bulk commercial email falls under the Spam Control Act; the PDPC page lists a clear, working unsubscribe option and processing unsubscribes within 10 business days | Unsubscribe link and suppression timing | PDPC, Other data protection concerns |
Sources: PDPC, Data protection obligations; PDPC, Organisation's guide to Singapore's Do Not Call (DNC) provisions; PDPC, PDPA overview; PDPC, Other data protection concerns; Personal Data Protection Act 2012, Part 9 and section 48J, Singapore Statutes Online, current version as at 24 October 2026. All checked 24 October 2026.
Does the DNC Registry cover marketing emails?
No: the DNC Registry covers voice calls, text messages and faxes to Singapore telephone numbers, and the PDPC states that unsolicited bulk email falls under the Spam Control Act, a framework the Infocomm Media Development Authority regulates. The PDPC's page on other data protection concerns adds that enforcement under the Spam Control Act is through civil action. A personal email address is still personal data, so the PDPA's notification and consent obligations apply to how your organisation collects and uses it.
General guidance, not legal advice.
What the Rules Mean for AI Answers and AI-Generated Content
The PDPA applies to personal data whatever tool processes it, so customer lists, enquiry records and chat transcripts used with AI tools stay under the same notification, consent, purpose limitation and protection obligations.
Who is responsible when a generative AI system processes customer data?
The PDPC's generative AI guidance places primary responsibility for PDPA compliance on system deployers. The PDPC lists the deployer's duties as defining clear purposes for processing personal data, safeguarding the data that flows through its systems, and reviewing those safeguards regularly, especially for agentic AI systems.
Does AI-drafted or AI-voiced marketing change the DNC rules?
No: the DNC provisions judge a message by its content and purpose, not by who or what drafted it, and section 36 of the PDPA counts a call with a recorded or synthetic voice as a voice call. An AI-written SMS that promotes your services is a specified message, and an AI voice agent that makes outbound promotional calls to Singapore numbers makes voice calls.
What do AI assistants repeat about your data practices?
In Aemorph's working model, ChatGPT, Claude, Gemini and Perplexity describe a business from the public sources they find, your privacy policy and service pages among them, so an outdated or unsupported data-handling claim on your site becomes material for their answers. The fix sits at the source, on the pages you control. The free Hallucination Report compares what the AI engines say about your business with what your website currently says, and flags where they conflict.
General guidance, not legal advice.
How Aemorph Handles Data and Checks Claims Before Publication
Aemorph publishes a claim about your data practices only after your nominated point of contact signs it off, and it handles your data under its own privacy policy, which names the Personal Data Protection Act 2012. Aemorph is not a law firm. It does not review your forms, lists or campaigns against the PDPA or the DNC provisions, and it does not confirm that any message complies: as the organisation that collects the data and sends the messages, your business holds those obligations. Aemorph runs SEO, SEM, content and AI visibility; it does not run or coordinate email or social media marketing for clients.
| Practice | Applies to | Standard | Checked against | When |
|---|---|---|---|---|
| Account access | Every client | Client-owned domains, hosting, Search Console, GA4, ad accounts and CRM; named accounts on least privilege | Access granted by the client | Kick-off and on change |
| Credentials and sensitive data | Every client | Credentials in secure password management; sensitive data on a need-to-know basis, never exported unnecessarily | ISO 27001-aligned practice | Throughout the engagement |
| Every regulated or data-handling claim | Every client | Approved by the person your business nominates | Your point of contact's sign-off | Before Aemorph publishes |
Source: Aemorph operating practice, October 2026.
Who signs off the claims on your pages?
You decide who signs off: the business owner, the chief marketing officer or the risk team. Aemorph publishes a regulated or data-handling claim only after that person approves it, and the facts in your verified record are the facts your business supplies and approves. Inside the Showstopper Sensor (Sprint 1), a 30-day showstopper-answer sprint for ChatGPT, Claude, Gemini and Perplexity, the same sign-off covers the showstopper answers before they go live. Questions about how Aemorph handles personal data go to privacy@aemorph.com first, and then to the PDPC.
General guidance, not legal advice.
Digital Marketing in Singapore: Start With a Free Strategic Conversation
Singapore businesses that want SEO, SEM, content and AI visibility coordinated from one approved set of facts start with a free strategic conversation with Aemorph. Aemorph is headquartered at 34 South Bridge Road, Singapore, and replies to every message within 24 hours. The digital marketing services page sets out how Aemorph coordinates each channel from your verified record, with NCS Singapore among its Singapore results.