Three ways a customer is treated as agreeing
Most of what you do with a customer's number needs no signed form. The PDPA deems people to consent in three situations, each in its own part of the Act.
| Kind | When it applies | Where |
|---|---|---|
| By conduct | They hand you their details for a purpose, and it's reasonable that they would | Section 15(1) |
| By contract | Their details have to go to someone else to set up or carry out a contract with you | Section 15(3) to (7) |
| By notification | You tell them what you plan to do, give them time to opt out, and they don't | Section 15A |
By conduct: the obvious purpose only
A parent fills in your trial class form. She's deemed to agree to you using her number to confirm the class, because that's why she gave it (section 15(1)).
The limit is the purpose. PDPC says it covers only purposes that are "objectively obvious and reasonably appropriate from the surrounding circumstances" (Key Concepts guidelines, page 42). Its example is a taxi booking. The number can be used to tell the passenger the taxi has arrived. The same operator can't use it to market its limousine service (page 43).
For a seller, that splits one number into two uses:
- Calling back about the viewing they booked, the quote they asked for or the class they signed their child up for is covered.
- Adding them to your new launch list, your monthly promotions or a festive message is a new purpose. Ask first.
By contract: what the deal needs
When someone gives you their details to enter a contract with you, they're deemed to agree to you passing them on where that's reasonably necessary to conclude the contract (section 15(3)). Section 15(6) covers what's reasonably necessary to carry it out, too.
A renovation firm that passes a customer's address and number to the carpenter doing the job is the everyday case. The contract can narrow this, and it stops at what the contract needs. It doesn't cover your partner's promotions.
By notification: tell them, then wait
Since 1 February 2021 there's a third route. You can rely on deemed consent by notification only if, before you collect, use or share the details, you:
- Assess the risk first. Section 15A(4)(a) asks you to decide it "is not likely to have an adverse effect" on them, and section 15A(5) asks how you'd reduce any effect you find.
- Tell them what you intend to do and why.
- Give them a reasonable period and a reasonable way to say no (section 15A(4)(b)).
Consent only counts once the opt-out period has passed, and PDPC doesn't set a length. Its own examples use 10 days and 14 days (Key Concepts, pages 48 to 50).
The catch for sellers: this route can't be used to send marketing messages. The regulations exclude it (Personal Data Protection Regulations 2021, regulation 13), and PDPC says the same: "deemed consent by notification does not apply to the purpose of sending direct marketing messages" (Key Concepts, page 51).
So "We'll send you offers unless you reply NO" doesn't make a yes. For marketing, get the yes itself.
Five questions sellers ask
| You're about to | Deemed consent? | Why |
|---|---|---|
| Call back the buyer who left their number for a viewing | Yes, by conduct | It's the purpose they gave it for |
| Message the same buyer about another launch next month | No | A new marketing purpose. Ask first |
| Pass a customer's address to your subcontractor for their job | Yes, by contract | Reasonably necessary to carry out the contract |
| Tell 300 past customers you'll send promotions unless they opt out | No | Notification can't be used for marketing messages |
| Reply to an enquiry that arrived on WhatsApp | Usually yes | PDPC says replying to someone's own request for information isn't a marketing message (DNC guidelines, page 11) |
One more rule works in your favour. When consent is deemed under section 15 or 15A, the notice duty in section 20(1) doesn't apply (section 20(3)). You still need to know which purpose you're relying on.
Write down which kind you're relying on
Deemed consent is the kind people forget they're using. Six months later, nobody remembers whether a customer's number came from a viewing form or a bought list.
In Palby CRM, consent sits on each customer's record, channel by channel, as yes, no or not recorded. When you set it by hand, add a note of up to 500 characters on how you got it, like "Booked a trial class on our form, 3 Sep". Palby adds the date and your name. Customers you've never asked stay Not recorded, so a filter finds them before you send anything.
30 minutes. You choose the day and the time.
Book a walkthroughKeep reading
- DNC Registry Singapore: how to check
- Consent and PDPA in Palby CRM
Questions about deemed consent
Consent the Act treats someone as giving without a signed yes: by handing you their details for an obvious purpose, by entering a contract that needs their details shared, or by not opting out after you've told them (sections 15 and 15A).
Not by notification. The regulations exclude marketing messages from it. Deemed consent by conduct also stops at the purpose the person gave their details for, and a promotion is usually a new purpose.
PDPC doesn't set one. Its own examples use 10 and 14 days. You assess what's reasonable, and consent only counts once the period has passed.
Yes. Assess that it isn't likely to have an adverse effect on the person, and note the steps you'd take to reduce any you find.
Only if it's part of the same obvious purpose. PDPC's taxi example says a number given to book a taxi can't be used to market the operator's limousines.
Sources
- PDPA 2012 s15, s15A and s20(3) (sso.agc.gov.sg/Act/PDPA2012, current version as at 2 Nov 2026), read 2 Nov 2026
- Personal Data Protection Regulations 2021, regs 13 and 14 (sso.agc.gov.sg/SL/PDPA2012-S63-2021), read 2 Nov 2026
- PDPC Advisory Guidelines on Key Concepts in the PDPA, revised 29 Apr 2026, pages 42, 43 and 46 to 51, read 2 Nov 2026
- PDPC Advisory Guidelines on the Do Not Call Provisions, revised 1 Feb 2021, page 11, read 2 Nov 2026