Telephone marketing, including phone calls and text messaging, can be an effective marketing tool because of the widespread use of mobile phones. However, since a mobile phone is such a personal device, telephone marketing is strictly regulated in Singapore.
What laws and regulations apply?
Personal Data Protection Act (PDPA)
The Personal Data Protection Act of 2012 (PDPA) established the Do Not Call (DNC) Registry.
Consumers who do not want to receive telemarketing messages via phone calls, text messages, or fax can register their numbers with the Registry. Telemarketers are legally required to check against this registry before contacting individuals, unless express consent has been obtained.
To whom and what does the Act apply?
The provisions of the PDPA apply to all persons and organizations , including individuals, companies, associations, and other corporate or unincorporated entities.
According to Section 38 of the PDPA, the DNC Provisions apply if:
- The sender of the message is in Singapore when it is sent, or
- The recipient of the message is in Singapore when it is accessed.
The rules do not apply if both sender and recipient are located outside Singapore when the message is both sent and accessed.
Example: If a Singaporean consumer is traveling overseas and receives a marketing SMS from a company abroad while abroad, the PDPA’s DNC provisions would not apply. However, if the marketing message originates from within Singapore, the rules do apply , even if the consumer is abroad when receiving it.
What constitutes a “specified message”?
Section 36(1) broadly defines a message to include sound, text, visual, or other electronic formats . This definition covers not only phone calls and SMS, but also messaging apps tied to Singapore numbers such as:
- iMessage
- Viber
- Telegram
Section 37 defines a “specified message” as one that advertises, promotes, or offers to supply:
- Goods or services
- Land or property interests
- Business or investment opportunities
- Any other information prescribed under the Act
Excluded purposes under Section 37(5) include:
- Employment opportunity notices
- Charitable donation solicitations
- Political messaging
Importantly, B2B marketing messages (business-to-business) are not considered “specified messages” under the PDPA.
How do I comply with the Do Not Call Registry?
The DNC rules impose strict obligations:
- Duty to Check the Registry ( Section 43)
Organizations must check the Registry before sending specified messages to ensure numbers are not listed, unless they have clear, documented consent . - Duty to Identify the Sender ( Section 44)
Marketing messages must clearly identify the sender and provide a way for recipients to contact them. - No Masking Caller ID ( Section 45)
Calls cannot conceal or withhold the caller’s line identity. - Prescribed Duration of Checks
Since August 1, 2023 , telemarketers must check the DNC Registry within 45 days before sending messages.
Example: If numbers are checked on Aug 5, 2023, the results are valid until Sep 19, 2023.
Organizations also find practical compliance guidance from the Direct Marketing Association of Singapore (DMAS) SMS/MMS Marketing Checklist.
Risks of noncompliance
The penalties for violating DNC provisions can be significant.
- When the DNC registry came into enforcement in 2014, the PDPC investigated over 3,700 valid complaints within 5 months and pursued action against more than 680 companies ( PDPC Media Release, 2014).
- Under the PDPA, organizations can be fined up to 10% of annual Singapore turnover , depending on severity and scale of the breach. Serious breaches can also lead to State Court proceedings.
- The PDPC continues to actively enforce compliance, issuing fines, warnings, and compliance orders to companies across industries. See PDPC enforcement cases here.
Key Takeaway
Mobile marketing through calls, SMS, and messaging apps remains attractive in Singapore due to high smartphone penetration. But it must be carried out with precision and full compliance with the PDPA and the DNC Registry rules . Organizations should:
- Always check the Registry within the prescribed 45-day window
- Obtain clear, documented consent before sending marketing content
- Identify themselves clearly in all outreach and avoid masking caller ID
- Have a compliance process in place to avoid severe fines and reputational damage