WhatsApp Marketing Rules in Singapore: What the PDPA Do Not Call Provisions, the Spam Control Act and Meta Require
Singapore is one of the few countries whose regulator names WhatsApp in its own anti-telemarketing guidance. Here is what that means for a promotion sent to a +65 number.
Short answer: the PDPC's own Do Not Call guidelines say the DNC rules in Part 9 of the Personal Data Protection Act (PDPA) apply to marketing sent through "data applications (such as 'Whatsapp', 'iMessage' or 'Viber') which use a Singapore telephone number". So before you send a promotional WhatsApp to a +65 number you need either clear and unambiguous consent, recorded so it can be produced later, or a DNC Register check no older than 21 days; every marketing message must identify you and say how to contact you; and an opt-out must be honoured within 21 days. Maximum penalties are S$1 million for an organisation and S$200,000 for an individual. Meta adds its own opt-in rule on top. This is general information, not legal advice; for a specific campaign, ask a Singapore-qualified lawyer.
Four sets of rules, and which ones cover WhatsApp
A WhatsApp promotion to a Singapore customer can fall under up to four sets of rules at once. They overlap, but the differences decide what you have to do.
| Rule | What it is written for | Does it apply to a WhatsApp campaign? |
|---|---|---|
| PDPA Part 9: Do Not Call (DNC) provisions | "Specified messages" (marketing) sent to Singapore telephone numbers by call, text or fax | Yes. The PDPC's guidelines name WhatsApp, iMessage and Viber as covered where they use a Singapore number |
| PDPA Data Protection Provisions | Collecting, using and disclosing personal data, including for marketing | Yes. Using a customer's name and number for promotions needs a proper purpose and consent, and withdrawal must be respected |
| Spam Control Act 2007, as amended in 2020 | Unsolicited commercial electronic messages sent in bulk to email addresses, mobile numbers and, since the 2020 amendments, instant messaging accounts | Can apply to bulk unsolicited WhatsApp promotions with a Singapore link |
| WhatsApp Business Messaging Policy | Every business using the WhatsApp Business Platform | Yes, contractually, and Meta enforces it directly on your account |
Is WhatsApp covered by the Do Not Call rules? Yes, in the regulator's words
In many countries, telemarketing rules are written for calls and SMS and you have to argue about whether they reach WhatsApp. Singapore removed the doubt. The PDPC's Advisory Guidelines on the Do Not Call Provisions (revised 1 February 2021) explain that "message" includes sound, text and visual forms, and state that the DNC provisions "apply equally to all means by which a sender may send a specified message to a Singapore telephone number", including "voice calls, SMS, or any data applications (such as 'Whatsapp', 'iMessage' or 'Viber') which use a Singapore telephone number".
There are three DNC registers a person can join: No Voice Call, No Text Message and No Fax Message. The No Text Message Register covers "any text, sound or visual message that is not a specified call or fax", which is where a WhatsApp text, image or voice-note promotion fits. A WhatsApp call carrying marketing would fall under the No Voice Call Register, which the guidelines describe as covering voice or video calls by "a telephone service, data service or any other electronic means".
What counts as a "specified message"
The DNC rules apply only to specified messages. In short, a message is one if any of its purposes is to advertise or offer goods or services, land or an interest in land, or a business or investment opportunity, or to promote a supplier of those. The guidelines put it plainly: "In most instances, a marketing message of a commercial nature would be a specified message."
The Eighth Schedule to the PDPA excludes some messages entirely. The ones that matter for WhatsApp senders:
- Transactional messages whose sole purpose is to facilitate, complete or confirm a transaction the customer agreed to, give warranty, recall or safety information, or deliver goods or services they are entitled to. An order confirmation, a delivery update or a lesson reminder for a course the parent paid for fits here.
- Ongoing-relationship messages sent while you have an ongoing relationship with the recipient and whose sole purpose relates to that relationship. The PDPC looks at continuity and frequency; its own examples include memberships, subscriptions and "a course of medical or dental treatment that requires follow-up visits to a clinic". One-off transactions are not enough.
- Market research or surveys whose sole purpose is research.
- Messages to organisations, other than individuals acting in a personal capacity, for the receiving organisation's purposes. Pure business-to-business messages are outside the DNC rules.
The word that does the work is sole. A delivery update is excluded; a delivery update that adds "and 20% off your next order" is a specified message again, and it is a marketing template on Meta's side too.
The duties when you send a specified message to a +65 number
| Duty | What the PDPA and the PDPC's guidelines say | What it looks like on WhatsApp |
|---|---|---|
| Check the DNC Register (section 43) | Unless you have the right consent, you need confirmation that the number is not on the relevant register, from a check made within 21 days before sending, directly or through a checker | Re-check the numbers in each campaign; a check from last month is out of date. Keep the result and its date |
| Or obtain clear and unambiguous consent | No register check is needed if the subscriber or user gave clear and unambiguous consent, "evidenced in written or other form so as to be accessible for subsequent reference" | An unticked opt-in box or a "Yes" reply to a specific question, stored with date, source and the wording shown |
| Identify yourself (section 44) | Clear and accurate information identifying who sent or authorised the message, and how the recipient can readily contact you, valid for at least 30 days after sending | Brand name in the template body, plus a Singapore phone number or monitored email. The guidelines say short codes and no-reply addresses do not count as contact information |
| Do not make consent a condition (section 46) | You may not require consent to marketing as a condition of supplying goods or services beyond what is reasonable; consent obtained through misleading practices is not valid | Checkout must work whether or not the WhatsApp marketing box is ticked |
| Honour withdrawal (section 47) | You may not prohibit withdrawal; the prescribed period to give effect to a withdrawal is 21 days | Stop at once in practice; 21 days is the legal outer limit, not a target |
| No harvested or generated numbers (section 48B) | Since the 2020 amendments, sending to numbers obtained through address-harvesting software or by dictionary attacks is prohibited | Never upload scraped or sequentially generated +65 lists |
What "clear and unambiguous" means in practice
The PDPA does not define the phrase, but the PDPC's guidelines give tests and examples. Two facts matter: whether you told the person clearly and specifically that marketing messages would be sent to their Singapore number, and whether they agreed through a positive action. Silence or a failure to opt out does not count.
- Passes: a box the customer ticks next to "you consent to receive information about special offers we may have from time to time" by a named channel; a form where the customer ticks SMS and email among listed channels.
- Fails: "you consent to the use of your personal data for marketing purposes", which the PDPC calls not sufficiently specific; an email saying customers will be treated as consenting unless they reply; quietly amending your terms and conditions to allow promotional messages.
The PDPC's examples name SMS. For WhatsApp, the safe wording names the channel and the business: "Yes, send me offers and new arrivals from Bright Skin on WhatsApp." That one sentence also satisfies Meta's opt-in rule, which requires the business name and a clear statement that the person is opting in.
The 2020 amendments: what changed for marketers
Parliament passed amendments to the PDPA and the Spam Control Act in November 2020, and the PDPC's revised DNC guidelines took effect on 1 February 2021. Four changes matter for WhatsApp senders:
- Dictionary attacks and address harvesting became prohibited for messages to telephone numbers (section 48B).
- Third-party DNC checkers gained duties: results they pass on must be accurate and must carry the date received and the validity period.
- DNC enforcement moved to financial penalties imposed by the PDPC, alongside the data protection regime. Law-firm summaries put the current maximum for a Part 9 contravention at S$200,000 for an individual and S$1 million in any other case.
- The Spam Control Act reached instant messaging. Its definition of "electronic address" now covers "an email address, an instant messaging account or a mobile telephone number".
Do not confuse these with the data protection maximum, which since 1 October 2022 is 10% of annual Singapore turnover above S$10 million, or S$1 million otherwise.
The Spam Control Act and bulk WhatsApp promotions
The Spam Control Act (SCA) is older than the DNC rules and aimed at bulk spam. It applies to unsolicited commercial electronic messages that have a Singapore link, for example because the sender is a Singapore entity or the recipient is in Singapore when the message is read. A message is "unsolicited" if the recipient did not request it or consent to it, and merely having published their number is not consent. Messages count as sent in bulk above any of these thresholds for the same or similar content: more than 100 in 24 hours, more than 1,000 in 30 days, or more than 10,000 in a year.
A sender of unsolicited commercial messages in bulk must comply with the Act's Second Schedule, which deals with matters such as an unsubscribe facility and labelling, and recipients can bring civil action. After an unsubscribe request, the Act treats any consent as gone for messages sent more than 10 business days later. The SCA's IM provisions treat a message to a WhatsApp account identified by a phone number as a message to an instant messaging account, not to the phone number, which is how the Act separates its rules for IM from those for SMS.
For a business that only messages people who opted in, the SCA mostly reinforces what you already do. Its practical lesson is the 10-business-day unsubscribe clock, shorter than the PDPA's 21 days; honour every STOP immediately and you satisfy both.
Meta's own rules sit on top
A lawful message can still get your number restricted if it breaks Meta's rules.
- Opt-in first. Meta's policy says you may contact people only if they gave you their number and you received opt-in permission confirming they want subsequent messages. Meta's developer guidance adds that the opt-in must clearly state the person is opting in and name the business, and that you must comply with applicable law.
- Respect opt-outs everywhere. "You must respect all requests (either on or off WhatsApp) by a person to block, discontinue, or otherwise opt out." A customer who says "please stop" on the phone to your front desk has opted out.
- Template categories. Promotions go in marketing templates. Meta can recategorise an approved utility template carrying promotional content to marketing, normally with a day's notice.
- Quality enforcement. Blocks and reports lower your quality rating; Meta "may limit the amount of messages a business can send" and can remove access entirely after significant negative feedback.
Three Singapore situations, answered
A tuition centre messaging parents
Lesson reminders, make-up slots and fee receipts for enrolled students are transactional or ongoing-relationship messages. A holiday-camp promotion to current parents may fall under the ongoing-relationship exclusion; one to parents of students who left two years ago does not. A WhatsApp marketing opt-in on the enrolment form settles it.
A dental clinic's recall reminders
The PDPC lists a course of dental treatment with follow-up visits as an example of an ongoing relationship. A six-monthly check-up reminder to a regular patient is the kind of message the exclusion is built for. A whitening promotion to someone who visited once in 2023 is a specified message.
An online shop that collected numbers at checkout
A number given for delivery is not consent to promotions; add a separate, unticked WhatsApp marketing box at checkout. An order update is transactional; an abandoned-cart nudge with a discount code is promotional and needs consent or a DNC check.
A practical compliance checklist
- Collect a WhatsApp-specific, unticked opt-in that names your business, and store date, time, source and wording.
- For anyone without that consent, check the numbers against the DNC Register within 21 days before each specified message, and keep the result.
- Put your brand name and a real contact route (a Singapore number or monitored email, not a short code or no-reply address) in every marketing template.
- End marketing templates with an opt-out line such as "Reply STOP to stop promotions" and keep the keyword in English. QuickWA records consent and opts contacts out automatically on English keywords such as STOP and UNSUBSCRIBE; replies like "停止" or "berhenti" still need a human to act on them.
- Apply every opt-out across all numbers and campaigns at once, and never re-import an opted-out contact.
- Keep transactional messages purely transactional; move any offer into a separate marketing template.
- Set sensible sending hours. Singapore law sets no WhatsApp marketing hours, but QuickWA lets you set a sending window in Settings so scheduled broadcasts wait until it reopens; it is off by default, so choose your hours.
- Never upload scraped, generated or purchased lists.
QuickWA's consent tracking and automatic opt-outs help you run this process, but no software makes a business compliant on its own; the decisions above are yours. See what is included on the QuickWA Singapore page, and how marketing and utility messages are priced in our Singapore pricing guide.
Sources
- PDPC, Advisory Guidelines on the Do Not Call Provisions (revised 1 February 2021): WhatsApp coverage, registers, specified messages, Eighth Schedule exclusions, ongoing relationship, 21-day checks, clear and unambiguous consent, sections 44, 46, 47 and 48B: pdpc.gov.sg (PDF) (checked 26 Oct 2026)
- Spam Control Act 2007 (sections 2, 4A, 5, 6 and 7), Singapore Statutes Online: sso.agc.gov.sg (checked 26 Oct 2026)
- Allen & Gledhill, increased maximum financial penalties under the PDPA from 1 October 2022 (Part 9 maximums): allenandgledhill.com (checked 26 Oct 2026)
- PDPC, announcement of the 2020 amendments to the PDPA and Spam Control Act: pdpc.gov.sg (checked 26 Oct 2026)
- WhatsApp Business Messaging Policy: whatsappbusiness.com/policy (checked 26 Oct 2026)
- Meta, getting opt-in for WhatsApp: developers.facebook.com (checked 26 Oct 2026)
- Meta, template categories and recategorisation: developers.facebook.com (checked 26 Oct 2026)
Frequently asked questions
Do Singapore's Do Not Call rules apply to WhatsApp? +
Yes. The PDPC's Advisory Guidelines on the Do Not Call Provisions say the rules apply to any data application, naming WhatsApp, iMessage and Viber, that uses a Singapore telephone number. A WhatsApp promotion to a +65 number is treated like a marketing SMS.
Do I need to check the DNC Register before a WhatsApp campaign in Singapore? +
Only for recipients who have not given you clear and unambiguous consent, evidenced in a form you can produce later. For everyone else, the check must be made within 21 days before you send.
Are order updates and appointment reminders covered by the DNC rules? +
Not if their sole purpose is transactional, such as confirming an order or delivering a service the customer is entitled to, or if they relate solely to an ongoing relationship like a course of dental treatment. Adding a promotion to them brings them back under the rules.
What are the penalties for breaking the DNC rules in Singapore? +
Law-firm summaries put the maximum financial penalty for a Part 9 (Do Not Call) contravention at S$1 million for an organisation and S$200,000 for an individual. Separate, higher maximums apply to data protection breaches.
How quickly must I stop messaging someone who opts out in Singapore? +
The PDPA allows up to 21 days to give effect to a withdrawal of consent, and the Spam Control Act treats consent as withdrawn for messages sent more than 10 business days after an unsubscribe request. In practice, stop immediately.
Does Singapore law limit the hours I can send WhatsApp marketing? +
The PDPA and Spam Control Act set no sending hours for WhatsApp. Sensible hours still protect your quality rating, and QuickWA lets you set a sending window in Settings so scheduled broadcasts wait until it reopens.