WhatsApp Broadcast Consent in Singapore: Getting Opt-In Right Before Your Q4 Promotion

Yes, a WhatsApp promotional broadcast to Singapore mobile numbers is regulated marketing, and in most cases you need either clear and unambiguous consent or a documented existing business relationship before you send it. The PDPC's position is that the Do Not Call provisions follow the phone number, not the app carrying the message, so sending through WhatsApp rather than SMS does not take you out of scope. Meta's own Business Messaging Policy adds a second, separate requirement: opt-in before any template message. Two rulebooks, one send button. If your Q4 list was built from order forms, name cards and WhatsApp enquiries without a consent line anywhere, the honest answer is that part of that list is not broadcastable and you should find out which part before November, not after a complaint.

Does the PDPA apply to a WhatsApp broadcast, or only to SMS?

Singapore SMEs often assume the Do Not Call Registry is an SMS-and-cold-calls problem. It is not. The DNC provisions cover marketing messages addressed to Singapore telephone numbers, and the regulator's guidance treats messages sent through apps that address a phone number the same way it treats a text message. A WhatsApp promotion is addressed to +65 numbers. Treat it as in scope and you will never be wrong; treat it as outside scope and you are betting your compliance position on a technicality nobody at the PDPC has endorsed.

There are actually two obligations running in parallel, and conflating them is where small teams get into trouble:

• The data protection obligations govern how you collected, used and stored the number in the first place. A number given so you could quote a job was collected for quoting, not for promotions.
• The Do Not Call obligations govern the act of sending a marketing message to that number, including checking the register unless an exemption applies.

You can satisfy one and breach the other. A number you lawfully hold from a legitimate transaction can still be a number you may not blast a Deepavali promotion to.

What counts as valid opt-in, and what does not?

The standard is clear and unambiguous consent, in writing or another form that leaves a record. In practice, that means the customer took a deliberate, recorded action to agree to receive marketing from you, on a channel you can name.

What does not clear the bar, however common it is in Singapore SMEs:

• A number captured from an inbound WhatsApp enquiry. They messaged you about a delivery; that is not consent to a promotion.
• A name card collected at a trade show, unless the booth had a visible notice explaining what you would do with it.
• A pre-ticked box, or consent bundled into terms and conditions as a condition of purchase.
• A WhatsApp group your customers were added to without being asked.
• A list bought, scraped, or inherited from a reseller who cannot show you how it was built.

The exemption most SMEs misread is the ongoing relationship one. Where you have an existing business relationship with the recipient, you may send text-based marketing about subject matter related to that relationship without checking the DNC Registry, provided you give a clear and simple way to opt out and honour it. Two words do the damage there. Related means an aircon servicing customer can receive a servicing promotion, not a travel package. And text means the exemption does not extend to voice calls. It is a narrower door than most owners think, and it is the door most Q4 broadcasts try to walk through sideways.

How do you capture consent without adding friction to enquiries?

The instinct is to bolt a consent form onto the front of the enquiry process, which slows down first response and costs you orders. Don't. Put consent capture at the points where the customer is already committing to something:

1. At quotation acceptance. One line on the acceptance form or confirmation email, separately tickable, naming WhatsApp explicitly as a channel.
2. At order confirmation. If confirmation goes out as a WhatsApp utility message, append a plain question and log the reply. A typed "yes" with a timestamp is a far better record than a paper tick nobody can find.
3. On the website form. A separate unticked checkbox with its own wording, not merged into the privacy policy link.
4. At the counter or on delivery. If you take numbers on paper, the form needs its own consent line, and someone has to key it in the same week or it will not exist when you need it.

The operational point is that consent has to land in the same system as the number. If the tick lives on a paper form in a drawer and the number lives in your phone, you do not have a consented list — you have a number and a rumour.

What records must you be able to produce if someone complains?

Assume you will one day have to show your working for a single number, not for the list as a whole. For each contact you should be able to answer, within minutes: where the consent came from, when it was given, what wording they agreed to, which channel it covered, and whether they have since opted out. Add the DNC check evidence where you relied on a check rather than consent, and keep the opt-out log, because failing to honour an opt-out is its own breach regardless of how good the original consent was.

Financial penalties for breaching the unsolicited message provisions run to six figures for organisations, but for a 20-person SME the sharper cost is usually operational: a WhatsApp number flagged for poor quality, template messages throttled or the sender number blocked by Meta, which takes down your support channel and your promotion in the same afternoon. Consent compliance and channel reliability are the same problem wearing different hats.

What should an SME do before its first Q4 broadcast?

• Segment the list into three buckets: explicit consent, existing-relationship-and-related-subject-matter, and unknown provenance.
• Send only to the first two buckets. Leave the third alone until you have re-permissioned it through a transactional touchpoint.
• Check that every marketing template carries clear sender identity and a working opt-out instruction.
• Route opt-outs to a real process, not to an inbox where they get read and forgotten.
• Write down who owns the send. In most SMEs this sits with whoever is free, which is how an unapproved list goes out at 9pm.

Done properly, this shrinks your broadcast list and improves it. A smaller consented list gets better delivery, better response, and costs less per marketing template sent. The compliance work and the commercial work point the same direction.

Frequently asked questions

Do I need to check the Do Not Call Registry if I already have consent?

No. Clear and unambiguous consent to receive marketing on that channel removes the need to check the register for that number. But the consent must be recorded and specific, and it can be withdrawn at any time, at which point you must stop. If your only evidence is "they've been our customer for years", you are relying on the ongoing relationship exemption, not consent, and its limits apply.

Does an opt-in for email or SMS cover WhatsApp too?

Treat it as not covering WhatsApp unless the wording named the channel or was broad enough to include messaging apps. Channel-specific consent is the defensible position, and it is also what customers expect. If your existing consent wording says "email newsletter", add WhatsApp at the next transactional touchpoint rather than assuming it carries over.

What about messages to overseas numbers on my list?

The DNC provisions attach to Singapore telephone numbers, but the data protection obligations still apply to how you hold and use the data, and the destination country may have its own marketing rules. Meta's platform policy applies everywhere regardless. For a mixed list, the practical approach is to apply the Singapore standard across the board rather than maintaining two sets of rules for one send.

If you are unsure whether your list is broadcastable, the fastest diagnostic is to pick five numbers at random and try to produce the consent record for each. Whatever you can do in five minutes for those five is what you can do for the whole list. That is your answer.