PDPA and WhatsApp marketing in Singapore: what businesses should know

WhatsApp is one of the most effective ways to reach customers in Singapore, and one of the easiest to misuse. Singapore's Personal Data Protection Act (PDPA) sets rules for how businesses collect, use and contact people with personal data. This article is general information, not legal advice. For your own case, check the guidance published by the Personal Data Protection Commission (PDPC) or speak to a qualified adviser.

Why the PDPA matters for WhatsApp

A phone number is personal data. If you collect numbers from enquiry forms, events or ads and then message those people, the PDPA's consent and purpose rules apply. Marketing messages sent to Singapore telephone numbers can also fall under the Do Not Call (DNC) provisions.

Three habits that keep you on the right side

1. Get clear consent. Tell people what they are signing up for and how you will contact them. A tick-box on your form, or a customer who messages you first, is a good starting point.
2. Check the Do Not Call Registry. Before sending marketing messages to numbers you do not already have a clear relationship or consent with, check them against the DNC Registry as required.
3. Make opting out easy. Include a simple way to stop messages, honour it quickly, and keep a record.

Customer service messages are different from marketing

Replying to a customer who messaged you is part of normal service. Promotions, new-product announcements and blasts are marketing. Keep the two separate in your records and in your tools.

Practical safeguards when blasting

• Send only to contacts who have opted in or who are genuinely existing customers.
• Segment your list so messages are relevant. Irrelevant blasts lead to blocks and reports.
• Space messages out. Dreamztrack sends blasts at random 1 to 10 second intervals, which reduces the risk of WhatsApp flagging your number.
• Tag customers who opt out so no one can message them again by mistake.

Where Dreamztrack helps

Dreamztrack keeps chat history, tags and opt-out status in one place so your team can see who has agreed to receive messages. The compliance decisions stay with your business, so review your approach with the PDPC guidance in hand.