WhatsApp Marketing in Singapore: PDPA & DNC Compliance Guide

WhatsApp marketing in Singapore is legal and effective, but only if you follow two sets of rules at once: the Personal Data Protection Act (PDPA) and its Do Not Call (DNC) provisions, plus Meta's own WhatsApp opt-in policy. In practice that means four things: collect clear, recorded consent; check numbers against the DNC Register (results are valid for 21 days); identify your brand in every marketing message; and honour opt-outs fast.

If you run a D2C brand, café chain or retail store in Singapore, WhatsApp is where your customers already are. The problem is that most "WhatsApp blast" advice online ignores Singapore's rules entirely, and a broadcast sent to the wrong list can cost far more than it earns. This guide shows you exactly what the rules say, how they apply to WhatsApp specifically, and a practical workflow to stay compliant without slowing your marketing down.

Note: this article is practical guidance, not legal advice. For decisions specific to your business, speak to a Singapore data protection lawyer or your Data Protection Officer.

Why WhatsApp marketing matters for Singapore businesses

WhatsApp is Singapore's most-used social platform, which makes it the highest-reach direct channel a brand can own. According to the Digital 2025: Singapore report by We Are Social and Meltwater, 80.1% of Singaporeans use WhatsApp every month, ahead of every other platform.

The wider market is almost fully online. DataReportal's Digital 2026: Singapore counts 5.78 million internet users, equal to 98.4% of the population. For a brand selling in S$, that means nearly every customer you acquire can be reached on WhatsApp after their first purchase.

The flip side is that Singaporeans are used to strong privacy protection. The Personal Data Protection Commission (PDPC) actively enforces the DNC rules, and customers know they can complain. Compliance is not a box-ticking exercise here; it is part of your brand reputation.

Does Singapore's Do Not Call Registry apply to WhatsApp?

Yes. Singapore's DNC provisions apply to WhatsApp marketing messages sent to Singapore telephone numbers. The PDPC's Advisory Guidelines on the Do Not Call Provisions state that the rules cover data applications that use a Singapore number, naming WhatsApp, iMessage and Viber as examples.

The DNC Registry is a national list where Singapore phone users can opt out of marketing calls, text messages and faxes. A WhatsApp promotion counts as a text message for DNC purposes, so if a customer has registered their number on the No Text Message Register, you need a valid exception before you can send them marketing.

This catches out many businesses that assume "WhatsApp isn't SMS, so DNC doesn't count." It does.

What counts as a "specified message"?

The DNC rules apply to specified messages: messages whose purpose is to advertise or promote goods, services, a business or an investment opportunity. Pure service messages, such as an order confirmation or a delivery update, are not specified messages. A message that mixes both (a delivery update with a "20% off your next order" banner) is treated as marketing.

The 6 rules every WhatsApp marketer in Singapore must follow

Here is what the PDPA, the DNC provisions and WhatsApp's policy require, translated into plain language.

1. Get clear and unambiguous consent. The PDPC guidelines say consent is not clear and unambiguous if it comes from someone failing to opt out. Pre-ticked boxes and "by buying you agree to marketing" lines do not count.
2. Keep evidence of that consent. Consent must be evidenced in written or other accessible form. For digital sign-ups, the PDPC recommends keeping the person's choice, the date and time, the form or page they saw, and the clauses they agreed to.
3. Check the DNC Register before sending, unless you have consent or an exemption. From 1 February 2021, DNC check results are valid for 21 days from the date you receive them. A list checked last month is not safe to use today.
4. Identify yourself in every marketing message. Messages must clearly identify the sender and explain how to contact you. The guidelines specifically say short codes and "no-reply" contacts are not valid contact information, and the contact details must stay valid for at least 30 days after sending.
5. Honour opt-outs quickly. When a customer withdraws consent, the PDPC guidelines set a 21-day period to give effect to it. Good practice on WhatsApp is to stop the same day.
6. Never use harvested or generated numbers. Sending to numbers obtained through address-harvesting software or generated by "dictionary attacks" is prohibited outright, with no exceptions.

On top of Singapore law, Meta's WhatsApp opt-in policy requires that businesses "clearly state the business's name that a person is opting in to receive messages from" and "comply with applicable law." Meta's pricing documentation is equally blunt: you can only message WhatsApp users who have opted in to hear from you.

What are the penalties?

The penalties are large enough to matter for any SMB. Since 1 October 2022, the maximum financial penalty for an organisation breaching the DNC provisions is S$1 million, or 5% of annual Singapore turnover for organisations whose Singapore turnover exceeds S$20 million, according to DLA Piper's summary of the PDPA amendments. Individuals face up to S$200,000.

WhatsApp adds its own penalty: if customers block or report you, your quality rating drops, and Meta's systems will rate-limit numbers that stay at low quality.

The ongoing relationship exemption: why one purchase is not enough

The ongoing relationship exemption lets a business send marketing about related goods or services to someone it has an ongoing relationship with, even if their number is on the DNC Register, as long as the message relates to the subject of that relationship. Many D2C brands assume every past buyer qualifies. They do not.

The PDPC guidelines are explicit that a once-off transaction is not enough to establish an ongoing relationship. The PDPC looks at continuity, regularity and frequency. A customer who bought one candle from your Shopify store in 2024 is not in an ongoing relationship with you.

Relationships that are more likely to qualify include:

• A subscription (coffee beans every month, a skincare refill plan)
• An active membership or loyalty programme the customer signed up for
• A gym, salon or clinic package with regular visits

Even then, the exemption only covers messages related to that relationship, and the customer must have been given a chance to opt out. Our recommendation: treat the exemption as a safety net, not a strategy. Express WhatsApp consent is simpler to prove and also satisfies Meta's opt-in policy, which the DNC exemption does not.

Which WhatsApp messages need marketing consent? A quick classification

The fastest way to stay compliant is to classify every template before you build it. This is the framework we suggest Singapore brands use. When in doubt, treat a message as marketing.

Notice the loyalty row. A points update stays a service message only while it is informational. Add "redeem now before it expires, plus 2x points this weekend" and it becomes marketing. If you run loyalty on WhatsApp, our guide to WhatsApp loyalty message templates for customer retention shows how to keep those templates clean and useful.

How to set up compliant WhatsApp marketing in Singapore: step by step

Here is a workflow that a small Singapore team can run without a full-time compliance officer.

1. Move to the official WhatsApp Business API. The personal WhatsApp app and unofficial "blaster" tools give you no opt-in records, no template approval and a high ban risk. The WhatsApp Business API gives you approved templates, a verified sender name and message logs you can point to if a customer complains.
2. Build a separate, unticked consent checkbox. At checkout and on sign-up forms, add a line such as: "Yes, send me offers and updates from [Brand] on WhatsApp. I can opt out anytime." It must name your business and must not be pre-ticked. If you sell on Shopify and connect your store through the RateUp Shopify integration, make sure the WhatsApp consent choice is captured with each customer record so your segments stay accurate.
3. Record the evidence. Store the timestamp, the form or page, and the exact wording the customer agreed to. A screenshot of your checkout copy, versioned by date, is cheap insurance.
4. Segment your list into three groups. (a) Express WhatsApp marketing consent; (b) service-only contacts; (c) possible ongoing-relationship customers. Only group (a) should receive broadcasts by default.
5. Run the DNC check where needed. For anyone you message under an exemption, or whose consent you are not sure of, check the DNC Register and send within the 21-day validity window. Re-check before every campaign.
6. Brand every template. Start promotional templates with your business name and include a working contact (a monitored WhatsApp number or support email, never a no-reply).
7. Add a one-tap opt-out. Include a "Stop promotions" quick-reply button on every marketing template. Tag anyone who taps it and suppress them from all future broadcasts the same day.
8. Keep your internal opt-out list permanent. Customers who opt out directly with you must stay suppressed even if their number is not on the national DNC Register.

Compliant WhatsApp campaign ideas for Singapore brands

Compliance does not mean sending less. It means sending to people who want to hear from you, which is exactly why consented WhatsApp lists perform so well. Here are campaigns that work within the rules.

Post-purchase sequences

Start with service messages (order confirmed, shipped, delivered), then move consented customers into a review request and a replenishment reminder. Our walkthrough on building a WhatsApp post-purchase sequence that drives repeat sales covers the timing in detail.

Abandoned cart recovery for consented shoppers

Cart reminders are one of the highest-return automations on WhatsApp. In Singapore, trigger them only for shoppers who ticked the WhatsApp marketing box. Here is how to set up Shopify abandoned cart recovery on WhatsApp.

Loyalty programmes that earn their own consent

A loyalty programme gives customers a reason to opt in: they want to hear about points, tiers and member rewards. Joining is a clear, active choice, which is exactly the kind of consent the PDPA wants to see. A WhatsApp loyalty programme also builds the continuous relationship that supports regular, relevant messaging.

Seasonal peaks: 11.11, Christmas and Chinese New Year

Singapore's big shopping moments are when businesses are most tempted to blast everyone. Plan ahead instead: run a consent drive two to three weeks before the peak ("Get early access to our 11.11 deals on WhatsApp"), then send the sale only to the people who said yes.

Common WhatsApp marketing mistakes Singapore businesses make

• Importing old customer lists. A spreadsheet of past buyers is not a consented marketing list. Re-permission them through a service touchpoint or an email first.
• Relying on a DNC check from last month. Results expire after 21 days.
• Using personal WhatsApp numbers for broadcasts. No records, no audit trail, and a fast route to a banned number.
• Burying the opt-out. If customers cannot easily stop promotions, they block or report you instead, which damages your quality rating.
• Adding promos to service messages. A "shipped" update with a discount code is a marketing message in the eyes of the law.

Frequently Asked Questions

Is WhatsApp marketing legal in Singapore?

Yes, WhatsApp marketing is legal in Singapore when it complies with the PDPA and its Do Not Call provisions. Businesses need clear and unambiguous consent or a valid exemption, must check the DNC Register when required, must identify themselves in each message, and must honour opt-outs. Meta's WhatsApp policy separately requires opt-in that names the business before any messages are sent.

Do I need to check the DNC Registry before sending WhatsApp messages?

You must check the DNC Registry before sending WhatsApp marketing messages to Singapore numbers unless you hold the recipient's clear and unambiguous consent or an exemption, such as an ongoing relationship, applies. The PDPC's guidelines confirm DNC rules cover apps like WhatsApp. DNC check results are valid for 21 days, so re-check before each campaign.

What counts as clear and unambiguous consent for WhatsApp marketing?

Clear and unambiguous consent is an active, recorded choice by the customer to receive marketing messages from your business. An unticked checkbox they tick themselves, a keyword they send to opt in, or a signed form all work. Silence, pre-ticked boxes and failing to opt out do not. Keep records of the date, time, form and wording.

Can I send WhatsApp messages to past customers in Singapore?

You can send service messages related to an order the customer placed. For marketing, a single past purchase does not create an ongoing relationship under PDPC guidance, so you need marketing consent or a DNC check showing the number is not registered. You also need WhatsApp opt-in under Meta's policy, so re-permissioning past buyers is the safest route.

What are the penalties for breaching Singapore's DNC rules?

Since October 2022, organisations can face financial penalties of up to S$1 million, or up to 5% of annual Singapore turnover for organisations with Singapore turnover above S$20 million. Individuals can face up to S$200,000. On WhatsApp, customer blocks and reports also lower your quality rating, which can lead Meta to rate-limit your number.

Conclusion: compliant WhatsApp marketing in Singapore is a growth advantage

WhatsApp marketing in Singapore works best when it is built on consent. Get a clear, recorded opt-in that names your brand, respect the 21-day DNC check window, brand every message, and make opting out a single tap. Do that, and every broadcast goes to customers who chose to hear from you, which protects your number, your brand and your margins.

RateUp helps D2C brands and SMBs run WhatsApp loyalty, broadcasts and automations on the official WhatsApp Business API, with WhatsApp, Instagram, and Messenger in one inbox and zero markup on WhatsApp API fees. If you want to see how a consent-first WhatsApp setup would look for your Singapore business, book a demo with the RateUp team.