What the PDPA asks before you use a customer's details
You need their consent to collect, use or share their details, unless a law lets you do it without (PDPA section 13). And consent only counts if you told them what it's for first (section 14(1), which points to the notice duty in section 20).
So a valid yes needs both of these:
- They knew the purpose. You told them, on or before you took their details, what you'd use them for (section 20(1)(a)).
- They agreed to that purpose. Not to "marketing" in general, and not to something you added later. A new purpose needs telling before you use their details for it (section 20(1)(b)).
Two things make a yes worthless. You can't make consent a condition of selling to them, beyond what you need to provide the service. And you can't get it with false or misleading information. Consent given either way "is not validly given" (sections 14(2) and 14(3)).
PDPC's own example is a spa that tucks "we may share your data with marketing agencies" into its standard terms. The customer's consent to that part isn't valid, because the spa didn't need it to give her a massage (Key Concepts guidelines, page 41).
A yes for marketing needs more
Replying to a parent who asked about P5 maths is one thing. Sending her next term's promotion is marketing, and PDPC asks for more:
| What PDPC says | Where |
|---|---|
| Get express consent for marketing, by opt-in. The person ticks an unticked box. A pre-ticked box they have to untick isn't appropriate. | Key Concepts, page 51 |
| For marketing to a Singapore phone number, the consent should be clear and unambiguous, and in writing or another form you can look up later. "Verbal consent alone would be insufficient." | Key Concepts, page 39, and PDPA section 43(4) |
| Saying nothing isn't consent. Clear consent "is unlikely to be construed" from someone simply not opting out. | DNC guidelines, page 24 |
| Be specific. "You consent to receive information about special offers we may have from time to time, by SMS" is specific enough. "You consent to the use of your personal data for marketing purposes" isn't. | DNC guidelines, pages 24 and 25 |
| Keep the proof for as long as you rely on the consent. | DNC guidelines, page 32 |
That last row is the one sellers miss. If the yes was a tick on a paper form at your open house, the form is your proof. If it was a WhatsApp reply, the chat is.
When a customer says stop
Anyone can withdraw consent at any time, as long as they give reasonable notice (section 16(1)). Then four things follow:
- You tell them the likely consequences of withdrawing, if there are any (section 16(2)). A tuition centre might say it can still send class changes, but not promotions.
- You don't argue. You can't forbid a withdrawal (section 16(3)).
- You stop. You stop collecting, using and sharing their details for that purpose, and so does anyone working for you (section 16(4)).
- You keep the rest. They can say no to marketing and still get the service. PDPC says people "must be allowed to withdraw consent for optional purposes without concurrently withdrawing consent for the necessary purposes" (Key Concepts, page 55).
How fast? PDPC's rule of thumb is that at least 10 business days from the day you get the notice is reasonable. If you need longer, tell them when it will take effect (Key Concepts, page 55). For marketing messages to a Singapore number there's a hard limit on top: stop within 21 days of getting the notice (DNC Regulations, regulation 17).
In practice, act on the day. A "stop" that waits for the weekly admin is how a parent gets the new term's timetable a month after she asked you not to.
A consent clause to copy
Paste this under your enquiry form, your open house sign-in sheet or your WhatsApp welcome message. Change the words in brackets. Leave both boxes unticked.
We'll use your name, number and email to reply to this enquiry and to arrange [your trial class / the viewing / the site visit].
>
[ ] Yes, [business name] may send me news and offers about [classes / listings / renovation packages] by WhatsApp and SMS to the number above.
>
[ ] Yes, [business name] may email me news and offers.
>
You can say stop at any time. Reply STOP, or write to [name] at [email]. [Name] also answers questions about how we use your details.
Why it's written this way:
- The first line is the purpose, told before you collect (section 20(1)(a)).
- Each channel has its own box, so a yes to email isn't a yes to WhatsApp.
- The boxes start empty, because PDPC says a pre-ticked box isn't appropriate for marketing.
- The last line gives a person to ask, which section 20(1)(c) requires on request. It's also where your data protection officer's details can go.
Record each yes where you'll see it
A yes on a paper form in a drawer won't stop a colleague from messaging the wrong person. Put it on the customer's record, with the date and how you got it.
In Palby CRM, each customer's record keeps consent for WhatsApp messages, email and calls: yes, no or not recorded. Set one by hand and add a note of up to 500 characters on how they agreed, and Palby adds the date and your name. Once your WhatsApp number is linked, a customer who writes stop is marked No for WhatsApp, with the day it happened. Tick Do not contact and every channel reads No.
Before a festive message goes out, filter your list by WhatsApp consent and send only to the yeses. Not recorded is a state of its own, so you can find who you've never asked.
30 minutes. You choose the day and the time.
Book a walkthroughKeep reading
- DNC Registry Singapore: how to check
- Consent and PDPA in Palby CRM
Questions about PDPA consent
Agreement from a person to collect, use or share their details for a purpose they were told about first. Without it, or a law that allows it, you can't use their details (PDPA sections 13 and 14).
For marketing to a Singapore phone number, no. PDPC says that consent should be in writing or another form you can look up later, and that "verbal consent alone would be insufficient".
Not for marketing. PDPC says marketing consent should be opt-in, with a box the person ticks themselves.
Replying to their own question about your service isn't a marketing message, PDPC says, and someone who gives you their details for an obvious purpose is usually deemed to agree to it. Our guide to deemed consent has the detail.
Until they withdraw it. Keep the proof for as long as you rely on it.
PDPC treats at least 10 business days as reasonable notice. For marketing messages to a Singapore number, the limit is 21 days. Acting on the day is safer.
Yes, the clause is free to copy and change for your own forms.
Sources
- PDPA 2012 s13, s14, s16, s18, s20 and s43 (sso.agc.gov.sg/Act/PDPA2012, current version as at 2 Nov 2026), read 2 Nov 2026
- Personal Data Protection (Do Not Call Registry) Regulations 2013, reg 17 (sso.agc.gov.sg/SL/PDPA2012-S709-2013), read 2 Nov 2026
- PDPC Advisory Guidelines on Key Concepts in the PDPA, revised 29 Apr 2026, pages 39, 41, 51 and 55, read 2 Nov 2026
- PDPC Advisory Guidelines on the Do Not Call Provisions, revised 1 Feb 2021, pages 24, 25 and 32, read 2 Nov 2026