Do Not Call Registry: SMS and WhatsApp Sales Follow-Up Rules

A sales follow-up by SMS or WhatsApp to a Singapore number needs the recipient’s consent or a Do Not Call Registry check if any part of it promotes something, unless an exclusion applies. PDPC’s Do Not Call (DNC) rules cover voice calls, SMS and messaging apps such as WhatsApp, iMessage and Viber when they use a Singapore telephone number, so a WhatsApp follow-up is covered in the same way as an SMS. Before sending, you need either the recipient’s clear and unambiguous consent, kept in a form you can produce later, or a check against the Do Not Call Registry made within the previous 21 days.

Two common cases fall outside the rule: a message to another organisation for that organisation’s own purposes, and a plain reply to someone who asked you for information. Most follow-ups sit between them, so run the five questions below before you send. This is general information from PDPC’s guidance, not legal advice. For what to say once you may send, see a sales follow-up that helps; the sales topic page lists related guides.

Do the Do Not Call rules cover WhatsApp and SMS?

Yes. PDPC’s Advisory Guidelines on the Do Not Call Provisions (revised 1 February 2021) say the rules apply equally to all means of sending a specified message to a Singapore telephone number, including data applications such as WhatsApp, iMessage and Viber that use the number. Three terms matter here.

• Specified message. Its purpose, or one of its purposes, is to advertise, promote or offer goods, services, land or a business or investment opportunity, or to promote a supplier of these. PDPC’s guide for organisations, last updated 22 April 2026, adds that a message mixing service and marketing content is still caught.
• Singapore telephone number. An eight-digit number starting with 3, 6, 8 or 9. Email is outside the DNC rules, although the Guidelines note that other PDPA obligations, and other laws they do not cover, may still apply.
• Registers. There are three: No Voice Call, No Text Message and No Fax Message. The Guidelines describe the text register as covering “any text, sound or visual message that is not a specified call or fax” and the voice register as covering “voice or video calls sent by a telephone service, data service or any other electronic means”. Our reading is that a WhatsApp message or voice note falls under the text register and a WhatsApp call under the voice register; the Guidelines do not name WhatsApp in this passage. PDPC’s page on checking numbers says a bulk check returns each number’s status in each register.

Can I send this follow-up? Five questions

Take these in order; each one says which answer clears you. The order is ours; the tests are PDPC’s.

1. Is any part of the message marketing? If not, the rules do not apply. That generally covers a reply whose sole purpose is to answer a request for information, or a message whose sole purpose is to confirm or complete a transaction the person has already agreed to enter into. One promotional line added brings the whole message back in.
2. Is the recipient an organisation, and is the message for that organisation’s own purposes? If so, the business-to-business exclusion applies and no check is needed. A pitch for the person’s own use does not qualify.
3. Is it going to a Singapore number, by call, SMS or an app that uses the number? If not, the DNC rules do not apply.
4. Do you hold clear and unambiguous consent for this kind of message to this number, in a form you can produce later? If yes, no check is needed.
5. If not, did you check the number within the last 21 days, and is it clear on the register for that channel? If yes, you may send. If there is no current check, or the number is listed, do not send.

One more exclusion: a message within an ongoing relationship (a membership, subscription, account or loan) whose sole purpose relates to it, such as a change in terms. PDPC says a once-off transaction is not enough to create such a relationship.

Worked example: six leads from a trade fair

Suppose, for illustration, a fictional bookkeeping and payroll firm met six people at a Singapore trade fair and wants to WhatsApp each the same offer: a free payroll review for teams under 20 until 30 November 2026. The leads and the offer are invented.

• Lead A ticked a box on the stand’s sign-up sheet beside “I agree to receive information about [Firm name]’s services by WhatsApp or SMS at the mobile number I have written below”. Question 4 clears it: the wording names the channels and the number, and the tick is a positive action. Keep the sheet; PDPC says to retain the original document for paper consent.
• Lead B is an HR manager whose business contact number is published on the company’s website, and the review is for the company’s payroll. Question 2 clears it: no check or consent is needed.
• Lead C is the same HR manager, but the message also offers a personal tax-filing service. In PDPC’s example, a salesman, John, phones Mary, HR manager of a childcare company, about a product for its centres (excluded), then asks if she would buy another for personal use, and loses the exclusion. Your message needs consent or a check.
• Lead D handed over a business card with a mobile number and ticked nothing. Do not assume Question 2 clears it: PDPC’s business-to-business example is a business number published on the company’s website, and the Guidelines do not discuss mobile numbers or business cards. Question 4 fails, because the Guidelines look for clear notice and a positive action and a card shows neither (our reading). Check the number and send only if it is clear for the channel.
• Lead E emailed asking for a payroll quote and gave a mobile number. In another PDPC example, a customer, John, leaves a number for a call back and the sales representative’s call is not a specified message. Send the quote and nothing more; our guide to customer enquiry replies covers who approves them.
• Lead F came from a list supplied by the fair’s organiser, marked “DNC-cleaned”. Numbers obtained from a third party still need consent or a check. PDPC’s FAQ says a third-party checker must tell you the date it received the results and their validity period, and that you must not rely on its word if you suspect they have expired or are wrong. A bare “DNC-cleaned” label gives you neither, so ask for the dates or run your own check.

The tally: only Leads A and B can receive the offer without a check. Leads C, D and F need consent or a check (for F, a checker’s dated result you have no reason to doubt can stand in), and Lead E gets the plain reply.

What counts as consent, and how do I keep the proof?

PDPC’s guide asks for a “positive action” that relates specifically to specified messages, clear notice that they will go to the person’s Singapore number, and wording not buried in general terms. In the Guidelines’ examples, a tick box beside “you consent to receive information about special offers we may have from time to time, by SMS” is enough; “you consent to the use of your personal data for marketing purposes” is not specific enough, and neither is an email saying customers agree unless they reply.

For electronic consent, keep the person’s choice, the date and time, the page or form they saw and the clauses they agreed to. A message asking for consent to send offers is itself a specified message when it goes to a Singapore number. The Guidelines’ example of seeking consent without one is an email; otherwise check the number first.

People can withdraw consent at any time, and you must stop within 21 days of the notice. In the Guidelines’ examples, a general “UNSUB” sent by SMS withdraws consent for SMS messages only, so say what your opt-out covers, as in “Reply STOP to end SMS and WhatsApp offers”.

How long does a DNC check last, and what does it cost?

A check is valid for 21 days. PDPC’s page on checking numbers, last updated 22 April 2026, says results are valid for 21 days from the date the check was conducted. The Guidelines count from receipt of the results (received 2 February 2021, valid until 23 February 2021). Our suggestion is to count from the check date, the earlier of the two. An older PDPC leaflet still online, DNC Rules for Organisations, carries a 2017 copyright date and says 30 days; do not use it.

Illustrative dates: the firm uploads its list on Monday 26 October 2026. Counting 21 days as in PDPC’s 2 February to 23 February example, a send on Thursday 12 November is within the window and the last day is Monday 16 November. A second round planned for Thursday 19 November needs a fresh check first.

Fees come from the same PDPC page; we did not read the DNC Registry portal itself, so confirm them there. A Singapore-registered organisation opens a main account with its UEN and a representative’s Corppass access, for a one-time fee of S$32.70 including GST. Each main account gets 1,000 free credits a year, used first. After that, pay-per-use is S$0.0273 a number for 1–4,999 numbers with a minimum charge of S$10, and 5,000 prepaid credits cost S$109.00. Prices include 9% GST, re-checking a number is charged again, and a bulk upload returns results within 24 hours.

Scaling the illustration up, say 120 numbers need checking. Two rounds at one credit a number use 240 of the 1,000 free credits. Without free credits, one round at pay-per-use is 120 × S$0.0273 = S$3.28, but the S$10 minimum applies, so S$10.

What must the message say, and who answers for it?

Every specified message you may send must identify the sender and say how to contact you, inside the message, in a form likely to stay valid for at least 30 days. “Contact me” with no name is not enough. Give a Singapore number that can receive calls or messages, or a working email address; short codes, no-reply addresses, a street address alone and “click here to contact us” do not count.

You also answer for messages sent for you. The Guidelines treat as a sender anyone who sends a message, causes it to be sent or authorises it, so a business that gives a call centre a customer list and message text is a sender alongside the call centre. Someone who takes reasonable steps to stop another person sending such messages is treated as not having authorised them; PDPC’s example is making it a condition of the authorisation that no specified messages go to Singapore numbers.

What to check before you send a promotional follow-up

• Does the message promote anything, even in one line? Then all of it is a specified message.
• Is the recipient an organisation, and is the message only for its own purposes?
• Can you produce the consent record: choice, date and time, form or page, wording?
• If you rely on a check, will it be under 21 days old on the send date?
• Does the message name the sender, give a working number or email, and say what STOP covers?

Next step: run your list through questions 1 to 4 first. Only the numbers that fail question 4 need a check.

Common questions