ActivityTracker
SellingUpdated 11 min read

Spam Control Act Singapore: which of your messages it covers

The Spam Control Act covers commercial emails, texts and instant messages sent in bulk to people who never asked for them: more than 100 alike in a day, 1,000 in 30 days or 10,000 in a year. The PDPA reaches a financial advisor sooner, on one message, one bought list or one lost file. Here's what each law asks of your week, and the proof to keep.

By Leo Tan, founder of ActivityTracker

What the Spam Control Act covers

The Spam Control Act sets rules for commercial messages sent in bulk to people who never asked for them, whether by email, text or instant message. Bulk means more than 100 messages on the same or a similar subject in 24 hours, with two higher lines at 1,000 in 30 days and 10,000 in a year. Cross a line and each unsolicited message needs a working way to unsubscribe. You then stop within 10 business days of a request, and anyone who lost out from a breach can sue you for up to S$25 a message.

For a financial advisor the Personal Data Protection Act (PDPA) bites first. One marketing WhatsApp to a listed number breaks it, and so does holding one client list you shouldn't have.

A message falls under the Act's bulk rules only when four things are true at once:

TestWhat the Act asksIn your week
CommercialIs its main purpose to offer or promote goods, services, land, or a business or investment opportunity?Yes for an invite to look at a new retirement plan, no for the meeting address
ElectronicDid it go to an email address, a mobile number or an instant messaging account?Email, SMS and WhatsApp count, and voice calls are left out
UnsolicitedDid the person ask for it, or agree to get it?A signed roadshow form with "send me updates" ticked is a yes.
In bulkDid you cross one of the three counts?120 of the same promotion on a Sunday night is over the first line.

Three parts of the Act catch advisors out more than the rest.

  • A name card isn't a yes. Section 5 says handing over or publishing an address or number doesn't count as asking for your messages, so the card in your roadshow bowl and the email on a LinkedIn profile both fail on their own.
  • An assistant who pastes your promotion into 150 chats is sending it, and so are you, because the Act's sender includes anyone who causes or authorises a message.
  • WhatsApp has been in since 1 February 2021, when the 2020 amendments made an instant messaging account an electronic address alongside email and mobile numbers.

Section 7 limits the Act to messages with a Singapore link and draws that link wide: sent from here, sent by someone here, or read here. If you sell from Singapore, assume every message has one.

When your follow-ups count as sending in bulk

The count goes by subject, not by wording. Section 6 counts messages on the same or a similar subject, so a client's first name at the top of 140 copies of one promotion doesn't make them 140 different messages.

WindowBulk once you send more thanWhat gets you there
24 hours100One evening spent pasting a year-end promotion into your chats
30 days1,000A monthly newsletter to the 1,200 contacts in your phone
One year10,000A weekly market note to 200 people, every week of the year

Spread one promotion over a week and you stay under the 24-hour line while the 30-day and one-year counts keep adding up. The PDPA ignores the count altogether and judges each marketing message on its own.

A reply to a client or a call-back a referral asked for is neither bulk nor unsolicited. Campaigns cross the lines, such as the new-launch broadcast. Planning one on a broadcast list? Read WhatsApp broadcast list vs group first.

What every bulk message has to carry

When a message is commercial, unsolicited and part of a bulk send, section 11 holds you to the Act's Second Schedule, which asks six things of you:

  1. A way to unsubscribe: an email address, web address, phone number, fax number or postal address, plus a line telling the person they can use it to unsubscribe.
  2. That line in English, set out clearly. Add Chinese or Malay if you like, as long as English is one of them.
  3. The right contact for the channel. An email gives an email address for the request. A text to a mobile number gives a mobile number they can text back.
  4. A contact that keeps working for at least 30 days after you send, and costs no more to use than a normal message.
  5. A stop within 10 business days of the request, and the request kept to yourself: you can't pass it on to anyone without the person's consent.
  6. On email and texts, an honest subject line with the letters <ADV> and a space in front of it (or at the start of a text with no subject), true header details, and an email address or number that reaches you.

Instant messages get one break. The Second Schedule's labelling paragraph doesn't apply to a message sent to an instant messaging account. So a bulk WhatsApp promotion doesn't need <ADV> at the front, and it still needs the unsubscribe line. Close with one of these:

Rather not get offers from me? Reply STOP, or text STOP to [your mobile number], and I'll stop sending them.

To stop these emails, write to [your email address] with STOP in the subject line.

Add it to your smaller sends as well. Then the day you message 104 people instead of 90, you're already inside the rules.

Who enforces it, and what a breach costs

No regulator enforces the Spam Control Act. The Ministry of Digital Development and Information said so in a written answer to Parliament on 9 January 2024: the Act runs on civil claims that wronged people bring themselves, and PDPC doesn't track them.

Sections 13 to 15 set out what a court can do. Anyone who suffered loss from a breach can sue the sender, and anyone who helped. The court can order you to stop, and the claimant picks between their actual loss and statutory damages of up to S$25 a message, capped at S$1 million unless they prove a bigger loss. Legal costs can go on top.

At S$25 a message, a 600-message launch is a S$15,000 claim before costs. For most advisors the bigger cost is one the Act doesn't price, when a client screenshots your blast into a family chat and your next three referrals see it.

People who get unwanted marketing complain to PDPC under the PDPA instead. PDPC took 23,548 of those complaints in 2019 and 2,144 in 2023, and it can impose penalties where the Act can't.

The PDPA is yours to follow, not only your firm's

The PDPA treats you as an organisation in your own right. Its definition of organisation in section 2 includes any individual, and section 4 lifts the data protection duties off an employee acting in the course of employment, a shelter a contractor doesn't get. If your contract with your firm makes you an independent contractor, PDPC treats you as an organisation. It said so in a 2017 decision and again in a 2022 decision, where the representative agreement said nothing in it created any employment. Both times, the advisor answered for the clients' data personally.

Six duties touch a selling week:

DutyWhere it sitsWhat it means for you
Consent and noticeSections 13 and 20Say why you want someone's details and get their yes before you take, use or pass them on
Do Not CallPart 9Check a Singapore number before a marketing call, text or WhatsApp, unless you hold a clear yes
No made-up numbersSection 48BNever message numbers a formula generated or software scraped
WithdrawalSection 16When someone withdraws consent, stop, and make anyone working for you stop
ProtectionSection 24Keep client data safe on your phone and on paper
RetentionSection 25Delete it once you no longer need it for the reason you took it, or for legal or business reasons

WhatsApp comes in through Do Not Call. PDPC's guide to the DNC Registry for individuals puts app messages that use a person's number, WhatsApp among them, on the No Text Message register. How to run the check, the 21-day rule and the consent that counts are in DNC Registry Singapore. WhatsApp adds a rule of its own: its Business Messaging Policy, which covers the WhatsApp Business app, lets you contact people only if they gave you their number and opted in to hear from you.

PDPC sets the penalties, under section 48J. For a data protection breach, the ceiling is S$1 million, or 10% of annual turnover in Singapore for an organisation turning over more than S$10 million. An individual who breaks the Do Not Call rules, or messages made-up numbers, faces up to S$200,000.

Your firm's rules on client messages sit on top of both laws. For setting up WhatsApp itself, see WhatsApp for financial advisors in Singapore.

Three PDPC decisions about financial advisors

Three of PDPC's published decisions are about advisors, and each one started with a shortcut that looked ordinary at the time.

The spreadsheet that made up 1,000 numbers

In [2023] SGPDPCS 6, PDPC found that a financial advisor used Excel's RANDBETWEEN formula to generate 1,000 numbers between two ends of a range, then hired a telemarketer to call them about his advisory services. 384 were on the No Voice Call register, unchecked, and he had no record of consent. That broke section 43(1), the duty to check, and section 48B(1), the ban on messaging generated numbers. He got a warning, because he had screened numbers before, stopped the calls at once and bought more checking credits.

The Spam Control Act's section 9 bans the same trick for addresses made up by a dictionary attack or collected by harvesting software. Since the 2020 amendments that part of the Act leaves mobile numbers to the PDPA, so a generated phone list breaks the PDPA and a scraped email list still breaks the Act.

The client list bought from a departing representative

A representative leaving the industry offered his list of client leads to two other advisors, in 2019 and 2020, and each paid him S$1,000. It held the names, mailing addresses and numbers of roughly 1,000 clients, and the insurers behind their hospitalisation plans. PDPC found the seller had disclosed the data without consent, and the two buyers had collected it without consent on his word that the clients had been told. A careful buyer, PDPC said, does due diligence, such as asking the seller for samples of the written notices and consents.

All three got warnings. The seller avoided a financial penalty only because of his health and money troubles, and PDPC said people who sell personal data for profit should expect to pay heavily.

PDPC cleared the firm. It had controls to stop representatives exporting client data and contract terms requiring them to follow the PDPA, and when the seller left it wrote asking for client lists back. Those safeguards kept the firm out of the decision, and they did nothing for the three advisors in it.

The folders by the bin

In the 2017 decision, a former representative left clients' folders beside a rubbish bin in a multi-storey car park. They held 13 certificates for 12 people, with names and NRIC numbers. PDPC found he still had to protect that data after leaving his firm, because he'd held it as an independent contractor with control over it, and imposed a financial penalty of S$1,000 under section 24.

Which law reads which part of the message

The two laws ask different questions, so check every send against both:

Spam Control ActPDPA
What it readsThe message itselfYour data and where your list came from
How manyBulk sends onlyOne message is enough
Who actsThe person who lost out, in courtPDPC, with directions and penalties
Top figureS$25 a message, S$1 million capS$1 million, or S$200,000 for an individual's Do Not Call breach

Clearing one doesn't clear the other. A single cold WhatsApp to a listed number is nowhere near the bulk line and still breaks the Do Not Call rules, while a promotion emailed to 300 seminar contacts needs the <ADV> label and the unsubscribe line however tidy your PDPA paperwork is.

Joanne's year-end send

Made-up example: Joanne is a financial advisor. It's a Sunday night in late November, and she wants to send one WhatsApp about a new retirement plan to 520 numbers before Monday.

She counts first. 520 alike in an evening is more than 100 in 24 hours, so this is a bulk send.

Then she sorts by where each number came from. 220 are clients. 160 came from a roadshow in August. 140 came from a colleague who quit in October and offered her his list.

The 140 go first. Those clients never agreed to their details passing to her, so she deletes the file and tells the colleague she won't use it.

Of the 160 roadshow contacts, 70 ticked "Send me updates from Joanne by WhatsApp" on the form and signed it. The other 90 dropped a name card in the bowl, which isn't a yes. On Monday morning she runs those 90 numbers through the DNC Registry. 21 are on the No Text Message register and come off the list, and 69 come back clear.

Of the 220 clients, 150 said yes to hearing about new plans at their fact-find, and she noted the date each time. The other 70 get their usual year-end review reminder and no promotion.

The 70 roadshow yeses and the 150 clients who agreed get the plan. The 69 cleared name cards get a short personal note that mentions the roadshow and asks if they'd like the details.

She sends those 289 messages one at a time from Monday to Thursday. Each opens with what that person last talked to her about and ends with her name, her firm and the STOP line.

Two people reply STOP on Tuesday, and she ticks both that evening, well inside 10 business days. Neither hears from her about a plan again.

What to keep on every contact

The proof is one line per person, written down the day it happens. When a question comes, from a client, your firm or PDPC, you want to show the answer in a minute:

  1. Where they came from: a referral, a roadshow, a website form, an existing client.
  2. What they agreed to, in their words, with the date and how: a signed form or the WhatsApp they sent you.
  3. The date you checked their number on the DNC Registry, if you market to them without a yes.
  4. Any STOP or withdrawal, with its date. Under the Act you're done within 10 business days. Under the PDPA, tell them what withdrawing changes, then stop, and make sure anyone working for you stops too.
  5. Paper goes in a shredder once you no longer need it, never a bin, and the phone your chats live on stays locked, because section 24 covers a lost device as well.

Ask at the fact-find. The client is already signing forms, so one more tick box for updates by WhatsApp costs you nothing. Tick a STOP the day it arrives: it's easy to show later, and nobody on your team gets the chance to send one more.

In ActivityTracker's CRM, pick Referral or Event in the Source field the day you meet someone, and tick Do not contact the day they say STOP. When someone answers your personal note, move them into your sales follow-up process the same day.

If you lead a team, ask for the source line in your weekly pipeline review. A list nobody can trace is a list nobody should message.

Keep the proof on the person. In ActivityTracker's CRM every contact starts with a Source field and a Do not contact tick box, and the daily birthday email leaves off anyone ticked.

See how the CRM works

Keep reading

Questions people ask

Sources

Ask first, then send.

Write the yes down the day you get it.

Book a walkthrough See pricing