Singapore DNC Registry Rules Under the PDPA: 2026 Guide

Short answer

Before you make a marketing voice call, send a marketing SMS or send a marketing fax to a Singapore telephone number, you must hold a valid confirmation from the Do Not Call (DNC) Registry that the number is not listed on the relevant register — unless the subscriber gave clear and unambiguous consent recorded in a form you can produce later, or the message falls outside the Do Not Call provisions entirely. A check result can be relied on for up to 30 days.

The duty sits in Part 9 of Singapore's Personal Data Protection Act 2012 (PDPA), and it applies to you even if your dialler, your agency or your offshore call centre is the one pressing send. It also applies to recorded and synthetic voice, which puts AI voice agents squarely inside the rules.

Stratgik is a technology firm, not a law firm. This is an implementation view of the published rules for the people who have to build the consent capture, the DNC check and the suppression logic — not legal advice.

What the rules actually cover

The trigger is not the channel. It is the purpose of the message. Section 37 defines a "specified message" by reference to whether one of its purposes is an "applicable purpose" listed in the Tenth Schedule — broadly, offering, advertising or promoting goods or services, promoting a supplier or prospective supplier, or promoting land, an interest in land, or a business or investment opportunity. The assessment looks at the content, how it is presented, and where the contact details in it lead. Section 37(2) adds that it does not matter whether the thing offered actually exists, so a "coming soon" teaser can still qualify.

Section 38 sets scope by reference to the number, not the sender: the provisions apply to a message addressed to a Singapore telephone number where the sender was in Singapore when sending it, or the recipient was in Singapore when accessing it. A BPO in another market dialling Singapore mobiles is not outside the rules.

Sections 37(3) and 37(4) then deem an organisation that authorises another party to promote its goods or services to have authorised the messages promoting them — unless it took reasonable steps to prevent the sending. Outsourcing the dialling does not outsource the liability. This is the most important clause for anyone running lead generation through partners, and it is why suppression logic belongs in your own systems rather than a vendor's spreadsheet.

Three registers, and the 30-day clock

There is not one list. The DNC Registry maintains a No Voice Call register, a No Text Message register covering SMS and MMS, and a No Fax Message register. You check the register relevant to the channel you are about to use. A number scrubbed clean for SMS tells you nothing about whether you may call it.

Section 43(1) requires that at the time of sending you hold valid confirmation that the number is not on the relevant register. That confirmation can come from your own application to the Commission or from a third-party checker — but if you rely on a checker you must not have reason to believe the information has expired or is inaccurate, and you must not be reckless about it. "Our vendor said it was clean" is not a defence if you never asked when the check was run.

For 50,000 prospects refreshed monthly, the registry cost runs to a few hundred Singapore dollars a year. That is almost never the real cost. The real cost is the engineering work to ensure no campaign can leave the building without a current check attached to it.

The consent route, and why most consent files fail

Section 43(4) removes the duty to check where the subscriber or user "gave clear and unambiguous consent to the sending of the specified message", evidenced in written or other form so as to be accessible for subsequent reference. Consent is the cleaner route for a nurtured funnel, because it does not expire every 30 days.

Two provisions quietly invalidate much of what gets collected in practice. Section 46(1) says consent is not validly given if it was required as a condition of supplying a product or service beyond what is reasonable to supply it — so a tick box you cannot complete a purchase without is weak ground. Section 46(2) says consent obtained through false or misleading information, or deceptive or misleading practices, is not validly given; a pre-ticked box buried under a "Continue" button is the obvious casualty. Section 47 then gives the subscriber a right to withdraw on notice. PDPC guidance for business owners describes an opt-out being honoured within 21 days, through the same medium the message arrived in; treat that as an outer limit, not a target.

For the build this is unglamorous and non-negotiable: store the exact consent wording shown, the timestamp, the source form or URL, the channel scope consented to, and the withdrawal event, all retrievable for a single number years later. If your CRM holds a boolean called marketing_optin and nothing else, you do not have evidential consent. Our Singapore PDPA compliance work almost always starts here, because the consent record is what every other control depends on.

What falls outside the rules

Section 37(5) excludes messages listed in the Eighth Schedule from being specified messages at all. PDPC guidance for business owners sets out the practical categories:

• Business-to-business messages — messages targeting businesses rather than individuals.
• Ongoing relationship — messages about products, services or memberships relevant to an existing ongoing relationship. The PDPC is explicit that a series of one-off transactions is not an ongoing relationship.
• Service and transactional messages — transaction confirmations, warranty information, delivery updates, service reminders about something the individual bought.
• Market research — messages forming part of a market survey or research exercise, provided that is genuinely all they are.
• Charitable and religious causes.

Two cautions. The B2B carve-out is narrower than marketers assume: it turns on whether the message targets a business, not on whether the number sits in a work contract, and a sole trader's mobile used for both purposes is contested territory. And the ongoing-relationship route is where "we had a relationship" becomes a judgement call made two years after the last purchase — so fix the window in written policy and enforce it in the data. Separately, the Personal Data Protection (Exemption from section 43) Order 2013 provides a route for certain text and fax messages tied to an ongoing relationship, conditional on an opt-out facility; its conditions are precise, so read the Order and take advice rather than relying on a summary.

Sender identity, calling line identity and AI voice

The consent exemption only removes the duty to check the register. It does not switch off sections 44 and 45, which apply to consented sends too.

Section 44 requires a specified message to include clear and accurate information identifying the individual or organisation that sent or authorised the sending, clear and accurate information on how the recipient can readily contact them, and that the information be reasonably likely to remain valid for at least 30 days after sending. A short link to a landing page you plan to retire with the campaign does not meet that. Section 45 prohibits concealing or withholding the sender's calling line identity on a voice call carrying a specified message, and prohibits any operation or instruction having the purpose or effect of concealing it.

This is where AI changes the exposure rather than the rules. Section 36(1) defines "voice call" to include a call made using a recorded or synthetic voice, so an AI voice agent making outbound marketing calls is doing legally what a human telemarketer does — at a volume where one misconfigured suppression list produces thousands of contraventions instead of dozens. If you are deploying one, the DNC check has to be a hard gate in the call-initiation path, not a nightly batch reconciliation. We apply the same principle across conversational channels in our AI solutions work: the compliance check sits upstream of the send, in code, with a refusal path.

Email and messaging apps: a different statute

The DNC Registry concerns telephone numbers. Bulk marketing email sits under the Spam Control Act instead, and the two regimes are often conflated. Under that Act, unsolicited commercial email sent in bulk attracts labelling and unsubscribe duties: "<ADV>" before the subject line, a working address for unsubscribe requests, and an obligation to stop sending within 10 working days of a request. Enforcement runs principally through a private right of action, with reported damages of S$25 per message capped at S$1 million.

The Act has been extended to commercial messages sent to instant messaging accounts, so WhatsApp broadcast programmes are not an unregulated channel. Where such a message reaches a Singapore telephone number, PDPC guidance has treated app-delivered messages as text messages, so the prudent build runs the DNC check and unsubscribe handling on the same pipeline.

One further gate applies to SMS. Since 31 January 2023, SMS from alphanumeric Sender IDs not registered with the Singapore SMS Sender ID Registry are labelled "Likely-SCAM" on the handset, under IMDA's anti-scam measures. That is not a PDPA requirement, but an unregistered Sender ID will destroy campaign performance however clean the consent file is.

Penalties

For contraventions on or after 1 October 2022, the maximum financial penalty under the Do Not Call provisions is up to S$200,000 for an individual and up to S$1 million for other organisations, as summarised by Allen & Gledhill. The 2020 amendments also created an offence for sending messages to numbers generated through dictionary attacks or address-harvesting software, so list-building by enumeration is not a grey area.

Enforcement is not theoretical. In the widely reported Star Zest Home Tuition matter, the agency and its director were each fined S$39,000 after pleading guilty to 13 of 37 charges relating to the Do Not Call provisions — a reminder that individual officers, not only the entity, can be in the frame.

Implementation checklist

1. Open a DNC Registry account for the sending entity, and record which entities each check is performed on behalf of.
2. Map every outbound channel — dialler, AI voice agent, SMS gateway, WhatsApp broadcast, fax — and which register each must be checked against.
3. Make the DNC check a blocking step in the send path: if confirmation is missing or older than 30 days, the campaign does not launch.
4. Store each check result with its retrieval date and expiry against the number, so you can reconstruct what you knew at the time of sending.
5. Rebuild the consent record to hold exact wording, timestamp, source, channel scope and withdrawal events — not a boolean — and audit capture against sections 46(1) and 46(2).
6. Wire opt-out into the same medium the message arrived in, and propagate suppression across every channel and vendor within hours.
7. Confirm every message carries sender identity and contact details still valid 30 days later, and that nothing masks calling line identity.
8. Impose contractual and technical controls on partners, given sections 37(3) and 37(4). Require evidence of checks, not assurances.
9. Register alphanumeric SMS Sender IDs with the SSIR, document which exclusion each campaign relies on, and have Singapore counsel sign off the interpretations you have embedded in code.

Most organisations fail this not because they disagree with the rules but because the rules live in a PDF while the sending lives in four disconnected systems. The fix is architectural: establish where the gate goes, then build the suppression service once so every channel inherits it. Our custom software teams do exactly that.

Frequently asked questions

How long is a Singapore DNC Registry check valid?

Up to 30 days. Published DNC Registry guidance for organisations states results were valid for up to 60 days during the registry's first six months of operation and 30 days thereafter, and Singapore government guidance for property agents describes relying on results for up to 30 days before re-submitting. Section 43 requires the confirmation to be valid at the time of sending, so the safe design re-checks before each campaign rather than counting days.

Do I still need to check the DNC Registry if I have consent?

No, if the consent meets section 43(4) — clear and unambiguous consent to the sending of the specified message, evidenced in written or other accessible form. But consent does not remove sections 44 and 45, so the message must still identify you with contact details valid for at least 30 days, and a voice call must not conceal calling line identity.

Do the Do Not Call rules apply to B2B marketing in Singapore?

Messages targeting businesses rather than individuals sit outside the Do Not Call provisions, per PDPC guidance for business owners. The carve-out is narrower than it sounds: it turns on who the message targets, not where the number is listed, and mixed-use numbers belonging to sole traders and small-business owners are the difficult cases. Document the basis on which you treat a list as B2B.

Do the rules apply to AI voice agents and automated diallers?

Yes. Section 36(1) defines a voice call to include one made using a recorded or synthetic voice, so an AI agent making outbound marketing calls is within Part 9. The register check must gate call initiation, the agent must not conceal calling line identity, and the call must convey who is calling and how to contact them.

Am I liable if my agency or offshore call centre does the calling?

Very likely yes. Sections 37(3) and 37(4) deem an organisation that authorises another party to promote its goods or services to have authorised the resulting messages, unless it took reasonable steps to prevent the sending, and section 38 brings an offshore sender within scope where the number is a Singapore number. Contractual indemnities do not substitute for your own controls and evidence.

Does the DNC Registry cover marketing email and WhatsApp?

The registry covers Singapore telephone numbers across voice, text and fax. Bulk marketing email falls under the Spam Control Act, with the "<ADV>" subject label, an unsubscribe facility and a 10-working-day stop obligation. That Act has been extended to commercial messages sent to instant messaging accounts, and PDPC guidance has treated messages delivered to a Singapore telephone number through apps as text messages — so run both the DNC check and unsubscribe handling on messaging-app campaigns.

If you are building or rebuilding outbound in Singapore — a dialler, an AI voice agent, an SMS or WhatsApp programme — the compliance logic is cheaper to design in now than to retrofit after a complaint. Start with our Singapore PDPA compliance page for the implementation view, or the Singapore hub for how we work with teams in the market. Stratgik is a technology firm and not a law firm: we build the controls, and we expect your counsel to confirm the interpretations behind them.

Written by the Stratgik team. Position based on published sources as at 12 October 2026; the PDPA, its subsidiary legislation and PDPC guidance change, so verify against the current official text before relying on any figure here.