PDPA and Do Not Call rules for WhatsApp marketing

1. The DNC rules cover WhatsApp

PDPC's advisory guidelines on the Do Not Call provisions apply to messages sent through "any data applications (such as 'Whatsapp', 'iMessage' or 'Viber') which use a Singapore telephone number". CEA has issued the same reminder to agents.

2. Property marketing is a "specified message"

A message is a "specified message" if one of its purposes is to advertise, promote or offer goods or services, a business or investment opportunity, or land or an interest in land. Property marketing falls squarely within it.

3. Check the DNC Registry within 21 days

Before sending a specified message to a Singapore number, you must have checked the number against the DNC Registry within the prescribed duration, which is 21 days. Some older material mentions 30 days; the prescribed duration in PDPC's guidelines is 21.

4. When you don't need to check

• Clear and unambiguous consent. You don't need to check if the person gave clear and unambiguous consent to receive your messages, evidenced in written or other accessible form. That requires a positive action, such as ticking a box on your enquiry form. PDPC says consent is unlikely to come "from a mere failure to opt out".
• An ongoing relationship. Messages sent within an ongoing relationship are excluded where their sole purpose relates to the subject of that relationship.

5. What each message must include

A specified message must identify who sent or authorised it and give contact details, and those details must remain valid for at least 30 days after the message is sent.

6. Penalties

The maximum financial penalty for breaching the DNC provisions is S$200,000 for an individual and S$1 million in any other case (PDPA, in force since 1 October 2022).

7. Bulk messages: the Spam Control Act

The Spam Control Act covers unsolicited commercial messages sent in bulk to instant messaging accounts, as well as email and mobile numbers. "In bulk" means more than 100 messages with similar content in 24 hours, more than 1,000 in 30 days, or more than 10,000 in a year. Such messages must include an unsubscribe facility and a statement explaining it, which must work for at least 30 days, and unsubscribe requests must be honoured within 10 business days.

8. Consent to use a lead's personal data

Separately from the DNC rules, the PDPA requires valid consent for the purposes you have told the person about, unless an exception applies. PDPC has advisory guidelines for the real estate agency sector. WhatsApp's own business policy also requires opt-in before you message people.

A practical checklist

• Collect explicit consent on your enquiry forms with an unticked checkbox, and keep the record.
• Check numbers without consent against the DNC Registry within 21 days of sending.
• Identify yourself and give a contact in every marketing message.
• Make opting out easy, and never message someone who has opted out.
• Prefer leads who message you first: that is a conversation, not cold marketing.

How ORQADOS helps

ORQADOS records the consent captured on your forms, enforces opt-outs centrally so anyone who says stop is never messaged again, sends only within your contact hours, and puts consent and opt-out status on every lead. You remain responsible for your DNC checks. See lead follow-up.

Sources: PDPC Advisory Guidelines on the Do Not Call Provisions (PDF); Personal Data Protection Act 2012; Spam Control Act 2007.

This guide summarises official sources as at 9 October 2026 and is not legal advice. Rules change; check the linked source, and your agency's compliance team, before relying on it.