PDPA Singapore: what the law asks before you message, call or keep a client's details

This guide isn't legal advice. For your own case, read the PDPC's guidelines or ask a lawyer.

The Personal Data Protection Act 2012 sets the baseline rules in Singapore for how organisations collect and look after personal data. The Personal Data Protection Commission, the PDPC, enforces it. The same Act set up the national Do Not Call Registry, where people list their Singapore numbers to stop unwanted marketing calls and texts.

Personal data, in the Act's words, is data "whether true or not, about an individual who can be identified" from it, or from it combined with other information you have. A client's name with their mobile number is personal data. So is a note that says "wants a 4-room flat near Tampines, moving after the baby arrives".

It covers paper as well as screens. The PDPC's overview says the Act covers data "stored in electronic and non-electronic formats", so your notebook of names counts the same as a spreadsheet.

The PDPC lists four things the Act generally doesn't apply to:

• an individual acting on a personal or domestic basis
• an employee acting for the organisation they work for
• public agencies
• business contact information, such as a work email, office number or job title

That last one matters to anyone who sells to companies. A buyer's office line and work email are outside most of the Act. Their personal mobile, home address and family details are not.

If you sell for yourself, the PDPC's guidance for data protection officers is plain: whether you run a small business or a large organisation, "as long as you collect, use, or disclose personal data, the PDPA applies to you."

The PDPC sets out 11 obligations. Here they are beside what each one means for a client list:

Exceptions apply to several of these. The PDPC points to its Advisory Guidelines on Key Concepts in the PDPA for the detail.

Of the 11, consent is the obligation you'll meet every working day, because every new number you save starts with it. The PDPC's wording is short: use personal data only for purposes the person has consented to.

Three rules follow from it:

1. You can't make a sale depend on a yes to more than the sale needs. The PDPC says you may not require consent "beyond what is reasonable to provide that product or service".
2. People can withdraw consent at any time, with reasonable notice, and you can't stop them. Once they do, the Act has you tell them what withdrawing will mean for them and stop using their data for that purpose.
3. Consent is sometimes deemed, which means the law treats the person as having agreed. That happens when someone volunteers their details for an obvious purpose, in some contract situations, and when you notify people and give them time to opt out.

Deemed consent is narrower than most sellers hope. A buyer who gives you their number to book a viewing has agreed to calls about that viewing, and nothing in that covers your monthly market report. The PDPA consent guide has a clause you can copy for the moment you collect details.

Write down when and how each yes was given. If a client asks why you messaged them, "she ticked the box on the open house sheet on 3 September" is an answer. "I think she said OK" isn't.

The Do Not Call provisions sit inside the PDPA. They bite hardest on people who sell, since a seller's week is full of calls and texts to Singapore numbers. Send marketing messages to those numbers and the PDPC's guide says you must check them against the DNC Registry first, unless the recipients have given you valid consent.

A "specified message" is the PDPC's term for a marketing message. It's one that advertises or offers goods or services, property, or a business or investment opportunity. The PDPC's guide covers voice calls, text messages and faxes to Singapore numbers. The Act defines a message as "any message, whether in sound, text, visual or other form". If you aren't sure where a WhatsApp message to a mobile falls, read the PDPC's Advisory Guidelines on the Do Not Call Provisions.

Watch for mixed messages. The PDPC says a message with any marketing purpose is a specified message, even if the rest of it is service. A delivery update that carries a discount code counts.

An ongoing relationship means an ongoing purchase or use: a membership or a subscription, say, or an account or a loan. The PDPC is explicit that one-off transactions aren't enough. A client who bought from you once two years ago isn't in an ongoing relationship with you.

Clear and unambiguous consent, in the PDPC's terms, needs a positive action that relates to the messages, such as ticking a box. The person must know the messages will go to their Singapore number, and it can't be hidden in your general terms. Let people withdraw at any time, put clear instructions in your messages ("Reply UNSUB to stop"), and stop within 21 days of a withdrawal.

As of November 2026, the PDPC's page sets out these steps:

1. Open a main account on the DNC Registry portal. A Singapore-registered business needs its UEN and a Corppass user. A sole practitioner without a UEN uses Singpass, and the PDPC gives insurance and real estate agents as examples.
2. Pay the one-time set-up fee of S$32.70, GST included.
3. Check numbers. A small lookup of fewer than 10 numbers gives results straight away. For a bigger list, upload a CSV of 8-digit numbers and the results arrive within 24 hours.
4. Note the date. Results are valid for 21 days. If you send after that, check again.

Each main account gets 1,000 free credits a year, and each number checked uses a credit after that, even if you checked it before. If you buy a list someone calls "DNC-cleaned", the PDPC says the seller must tell you when they got the results and how long they're valid. If there's reason to doubt it, you must not rely on it. Our DNC Registry walkthrough goes through the portal screen by screen.

Appointing a data protection officer is, in the PDPC's words, your mandatory first step. The DPO answers for compliance, handles customers' requests about their data and is the person the PDPC deals with when something goes wrong.

In a small business that's usually the owner, which the PDPC allows. What you must do is make the DPO's business contact details public, in one of two ways the PDPC describes: register them in the PDPC's DPO Registry, or publish them on your own website and keep them current.

A name on a form isn't enough on its own. The PDPC says you still need the processes behind it, like checking numbers before a marketing message goes out and recording each consent as you get it.

Four obligations decide how you look after the list once you have it:

• Accuracy: make a reasonable effort to keep the data accurate and complete, especially when it decides something about the person.
• Access and correction: when a client asks, show them the data you hold and how it was used or disclosed in the year before the request, and correct any error as soon as practicable.
• Protection: make reasonable security arrangements so nobody gets at the data without authorisation.
• Retention limitation: stop keeping data, or dispose of it properly, once it serves no business or legal purpose.

Retention is the one sellers forget. An enquiry from 2019 who never replied isn't a client you're keeping warm. Pick a date each year, and clear out the people you'll never contact again.

NRIC numbers need extra care. The PDPC has separate advisory guidelines on how the PDPA applies to collecting and using NRIC numbers and copies of the card, and it advises organisations against using NRIC numbers to verify someone's identity or as default passwords. If you don't need a client's NRIC for the sale, don't take it.

Transfer limitation matters if your tools store data overseas. The PDPC says personal data may leave Singapore only under the Regulations' requirements, so the protection stays comparable to the PDPA's.

A data breach, by the PDPC's definition, is personal data being accessed, copied or disclosed without authorisation, among other things. A lost phone with your clients on it can be one. A spreadsheet emailed to the wrong Mr Tan can be another.

Not every breach has to be reported. It's notifiable if it's likely to cause significant harm to the people affected, or if it affects 500 or more people. The PDPC's examples of harmful data include credit card details and financial information such as wages, commission or bonus.

Once you've decided a breach is notifiable, you have no later than 3 calendar days to tell the PDPC, through its online portal. Tell the affected people too if it's likely to cause them significant harm. The PDPC's self-assessment tool walks you through the decision, and the PDPC asks you to write down how you reached it.

As of November 2026, section 48J of the Act sets the ceiling on the PDPC's financial penalties for an organisation. For one whose annual turnover in Singapore exceeds S$10 million, it's up to 10% of that turnover. For any other organisation, it's up to S$1 million.

The PDPC also lists costs that don't come as a fine: lost trust, and clients who share what happened online. For a seller whose business is referrals, that second cost is usually the bigger one.

You don't need a compliance team. You need a few habits, done the same way every time:

• Name your DPO and publish their contact details.
• Say what you'll use a number for when you collect it.
• Record each yes with the date and how it was given.
• Check the DNC Registry before marketing to anyone who hasn't given clear consent, and note the date.
• Honour every "stop" straight away, on every channel.
• Clear out records you no longer need, once a year.
• Know where your tools keep your records, and who can open them.

A CRM can hold most of that for you. Palby CRM, which we make, keeps consent per channel on each record, with when and how it was given, and honours Do not contact on every send. It doesn't check numbers against the DNC Registry, so you still do that on the PDPC's portal.

• PDPC, PDPA Overview, pdpc.gov.sg, read 2 November 2026
• PDPC, Data Protection Obligations, pdpc.gov.sg, read 2 November 2026
• PDPC, Organisations' Guide to Singapore's Do Not Call (DNC) Provisions, pdpc.gov.sg, read 2 November 2026
• PDPC, Check Numbers Against the Do Not Call (DNC) Registry, pdpc.gov.sg, read 2 November 2026
• PDPC, Getting Started as a Data Protection Officer (DPO), pdpc.gov.sg, read 2 November 2026
• PDPC, Report Your Organisation's Data Breach, pdpc.gov.sg, read 2 November 2026
• PDPC, Understand the PDPA and What It Means for You, pdpc.gov.sg, read 2 November 2026
• PDPC, Advisory Guidelines on the PDPA for NRIC and Other National Identification Numbers, pdpc.gov.sg, read 2 November 2026
• Singapore Statutes Online, Personal Data Protection Act 2012 (current version as at 2 November 2026), read 2 November 2026