Consent, purpose & marketing (DNC)

The core PDPA rule: an organisation may only collect, use, or disclose personal data for purposes the individual has consented to (or where a PDPA exception applies). Consent is the default gate, and it is not a one-time trophy - it must be honoured over the whole life of the data.

The flip side is withdrawal. An individual can withdraw consent at any time, on reasonable notice. When they do, you must:

• Inform them of the likely consequences of withdrawing - for example, "you will stop receiving offers, but your account still works."
• Stop the relevant collection, use, or disclosure within a reasonable time, and cascade the stop to any downstream systems and vendors.
• Never make withdrawal harder than giving consent was - no burying the unsubscribe, no "call this hotline in office hours only."

Consent is only meaningful if the person knew what they were agreeing to, so two more obligations lock it in place.

• Purpose Limitation - you may only collect, use, or disclose personal data for purposes that a reasonable person would consider appropriate in the circumstances. "Because it might be useful later" is not a purpose. And you cannot require consent to more than is reasonably needed to provide a product or service as a condition of that service.
• Notification - you must inform the individual of the purposes at or before collection. No secret second uses. If a new purpose appears later, you notify and, usually, seek fresh consent.

Together these kill the two most common marketing sins: over-collecting "just in case," and quietly repurposing service data into a marketing list.

Consent does not always have to be a checkbox. The PDPA recognises deemed consent and a set of exceptions - but they are narrower than marketers wish.

• Deemed consent by conduct - if a person voluntarily provides data for an obvious purpose (handing over an address to get a delivery), consent for that purpose is deemed.
• Deemed consent by notification - you may notify the individual of a new purpose, give them a reasonable opt-out period, and proceed if they do not object. It requires an assessment that the new use is not likely to cause adverse effect - it is not a shortcut for marketing to a cold list.
• Legitimate interests and business improvement exceptions - allow certain uses without consent when the benefit outweighs adverse effect (legitimate interests) or for internal improvement of goods, services, and operations (business improvement). Direct marketing to consumers generally does not ride on these.

Rule of thumb for a DPO: deemed consent and the exceptions are for reasonable, expected uses - not a back door to skip a real marketing opt-in.

The Do Not Call (DNC) registry lets any Singapore telephone-number holder opt out of unsolicited telemarketing. It is run by the PDPC and split into three separate registers, one per channel:

• No Voice Call register - telemarketing phone calls.
• No Text Message register - marketing SMS and MMS.
• No Fax Message register - marketing faxes.

Your obligation is a check-before-you-send duty: before sending a marketing message to a Singapore number, you must check the register that matches the channel and not send if the number is listed (unless an exemption applies). A confirmation of your check is valid for a set period, so a fresh scrub before each campaign is the safe habit.

You do not always have to check the register. Two main exemptions let you send without a scrub - but each is narrower than it looks:

• Clear and unambiguous consent - if the individual has given clear, specific consent to receive your marketing messages on that channel, and has not withdrawn it, the register check is not required for that number. Weak, bundled, or assumed consent does not qualify.
• Ongoing relationship - you may send messages related to an existing, ongoing relationship (for example, to an existing subscriber about a similar product), within defined limits and only while that relationship is live. Every such message must still offer an easy opt-out.

For a DPO, the safe reading is: treat the register check as the default, and only skip it where you can evidence a qualifying exemption for that specific number and channel.

The DNC rules have teeth. Sending marketing to a listed number without an exemption, or failing to check, exposes the organisation to enforcement action and financial penalties under the PDPA regime.

• Under the PDPA, financial penalties can reach up to S$1M, or 10% of annual Singapore turnover, whichever is higher - the same ceiling that backs the data-protection obligations.
• Enforcement is public: the PDPC publishes decisions, so a fine is also a reputational hit and a gift to competitors.

GDPR does not run a do-not-call list. Instead it raises the bar on consent and hands the individual a powerful right to object:

• Valid consent must be freely given, specific, informed, and unambiguous - a clear affirmative act. Pre-ticked boxes and bundled consent do not count.
• The right to object to direct marketing is absolute. When a person objects, you must stop marketing to them, full stop - there is no balancing test to weigh against it.
• You must tell people about that right clearly, at the first communication at the latest.