What the PDPA is
The Personal Data Protection Act 2012 (PDPA) governs how organisations in Singapore collect, use and disclose personal data. The Personal Data Protection Commission (PDPC) publishes guidance. If you handle enquirers' names and phone numbers, the PDPA is relevant to you.
This guide is general information. Check the PDPC's guidance and your licensed entity's compliance team for how it applies to you.
Consent
In general, you need consent to collect, use or disclose someone's personal data for a stated purpose. A person who fills in a form asking to be contacted about ILPs, and who is told how you will contact them, has a clearer basis than someone whose number came from a list they never agreed to be on.
Our forms say that by submitting, the person agrees to be contacted on WhatsApp about their enquiry, and link to the privacy policy.
The Do Not Call Registry
Singapore's Do Not Call (DNC) Registry lets people register numbers to opt out of certain marketing messages. In general, an organisation must check the registry before sending a marketing message to a Singapore number, unless the person has given clear and unambiguous consent. Check the PDPC's current guidance on which message types are covered, including messaging apps.
Good practice
- Say clearly why you collect the data and how you will contact the person.
- Only message about the enquiry they made.
- Let anyone opt out easily (for example by replying STOP).
- Keep data secure and keep it only as long as you need it.
- Know who in your organisation is responsible for data protection.
- Respond to access and correction requests.
Questions to ask your lead source
- How did each person enquire, and what did they agree to?
- Is there a record of consent?
- Were the leads checked against the DNC Registry where relevant?
- Are the leads sold to others?
This is one reason to prefer owning your leads over buying them.
Your agency's rules
Beyond the PDPA, many agencies and licensed financial advisory entities have their own rules for advertising and client contact. Confirm these before running any campaign. See our privacy policy for how we handle data.
Frequently asked questions
Do I need consent to message an enquiry on WhatsApp?
In general you should have a clear basis, such as the person asking to be contacted. Check PDPC guidance for your situation.
Does the Do Not Call Registry apply to WhatsApp?
Check the PDPC's current guidance on which messages are covered. When in doubt, rely on clear consent and an easy opt-out.
Is this legal advice?
No. It is general information. Speak to your compliance team or a lawyer for advice.