Consent vs DNC and exemptions

Consent is not a mood or an assumption. To rely on it, you need consent that is clear and unambiguous and captured in written or otherwise accessible form - something you could show the PDPC later. The test is simple to state and easy to fail.

• It requires a positive action - the person actively opts in. Ticking a box themselves, replying "yes", signing up on purpose.
• Silence and inaction are NOT consent. A pre-ticked box, a "we will assume you agree unless you tell us otherwise", or a failure to opt out - none of these count. The default cannot be "yes".
• It must be evidenced. If you cannot produce a record of when and how the person consented, for enforcement purposes you effectively do not have consent.

Sometimes the law treats consent as given even without an explicit opt-in. This is deemed consent, and there are three routes. A leader does not need the section numbers, but should know these exist so the team neither over-claims nor ignores them.

• By conduct: the person voluntarily provides their data for an obvious purpose - handing over a phone number to receive a delivery, for instance. Consent is deemed for that purpose only.
• By contractual necessity: where sharing the data is reasonably necessary to fulfil a contract the person is party to.
• By notification: you tell the person about a new purpose, do a required assessment that it is not likely to harm them, and give them a reasonable window to opt out. If they do not opt out, consent is deemed for that purpose.

Here is the point most teams miss: the register is not a wall. If a person has given you clear consent to send marketing to their number, you may message them even though that number sits on the Do Not Call Registry. Consent overrides the listing. This is why a well-run marketing operation invests in capturing and storing consent - it turns "we cannot touch listed numbers" into "we can reach everyone who actually said yes." The flip side: without consent, a listed number is off limits, full stop, and the check is what tells you whether a number is listed. Consent and the check are two tools for the same job - reaching a number lawfully - and you only need one of them for any given send.

If you have an ongoing relationship with someone, a message that is on-topic to that relationship can fall outside the DNC rules. But the boundaries matter, and there is a common myth to correct.

• It needs a real relationship. The PDPC looks for continuity, regularity, and frequency of dealings. A single one-off transaction is not an ongoing relationship.
• The message must be on-topic. Reaching an existing customer about the product they already buy can qualify; using the relationship as a doorway to pitch something unrelated does not.
• It covers all three channels. Under the current PDPA, this exclusion applies to voice calls, text messages, AND faxes. The older idea that it only covers text and fax but not voice calls is from the superseded pre-2019 framework - do not teach it.

Three of the exclusions do most of the day-to-day work, because they cover the messages businesses send constantly. Knowing them keeps the team from over-checking.

• Transactional and service messages: a message whose sole purpose is to carry out, complete, or confirm a transaction the person already agreed to, or to give service information - receipts, delivery updates, appointment reminders, account alerts. No selling attached.
• B2B: a message sent to an organisation for the purposes of that organisation - not to an individual for their own use. Marketing to a company's general business line about a business product sits outside DNC.
• The trap: the moment you bolt a promotion onto a transactional message ("your order shipped - and here is 30% off your next one"), the promotional part can pull it back into scope. Keep service and selling separate.

The Eighth Schedule lists the messages that are not specified messages. Alongside transactional/service, B2B, and ongoing-relationship, it covers: emergency messages (urgent safety or public need); market research and surveys, where you are gathering views rather than selling; personal or domestic messages sent by an individual in a private capacity; and public-agency non-commercial messages. The common thread is purpose - none of these exist to market or promote a product or service, so the Do Not Call machinery does not attach to them. For a leader, the value is not memorising all seven. It is recognising that a large share of the messages your organisation sends were never in scope, so the team's DNC energy should be aimed squarely at the ones that are: the promotional sends.