Cold calls and cold email in Singapore: what the rules allow

Yes, you can cold call and email companies in Singapore, because marketing aimed at a business sits outside the Do Not Call rules. Marketing to individuals on Singapore numbers needs a registry check or clear consent.

If you're a sales director building an outbound list, that one sentence hides most of the risk. Three sets of rules apply, they cover different channels, and the line between a company and a person is thinner than most teams assume. We went through the PDPC's guidance and the Spam Control Act so you can see where each one bites.

The registry covers marketing messages sent to Singapore telephone numbers, by voice call, text or fax. The PDPC calls these specified messages, and a message counts if any part of it has a marketing purpose. A delivery update with a discount code is a specified message.

It reaches chat apps too. The PDPC's advisory guidelines say the rules apply to data applications such as WhatsApp, iMessage or Viber that use a Singapore telephone number. So a sales rep blasting offers from a phone is inside the rules, and a WhatsApp sales process has to allow for that.

Before sending, you must check the number against the registry within the previous 21 days, unless you hold clear and unambiguous consent. Consent needs a positive action, such as ticking a box that names the messages. A line buried in your terms won't do.

The exclusion covers messages sent to an organisation for that organisation's purposes. The PDPC's own example is company A marketing its goods or services to company B, for the purposes of company B.

What decides it is the offer. Selling a packaging line to a factory's operations manager is excluded. Selling that same manager a personal insurance plan on the same number isn't, because the PDPC says the rules apply when a message also markets something for the recipient's personal use.

A mobile number is the grey area. PDPC's guide gives an office line as its example of an organisation's contact details, and plenty of Singapore buyers only list a mobile. Our advice is to treat a personal-looking mobile with no business context as a number you check, since a registry check is cheap and a complaint isn't.

Four situations come up often. Here's how we read them.

Yes, with conditions. Email sits outside the Do Not Call rules and falls under the Spam Control Act 2007. The Act's labelling and unsubscribe rules apply to unsolicited commercial email sent in bulk, and we couldn't find a business exclusion like the one in the DNC rules. Bulk means more than any of these, with the same or similar subject matter:

Over that line, each message needs four things: an unsubscribe option, the letters <ADV> before the subject line, an honest subject and headers, and a working email address or phone number for the sender. Unsubscribe requests must be honoured within 10 business days.

One opinion here. A subject line starting with <ADV> rarely gets opened, so the better answer is to stay well under the thresholds. Send fewer, better emails to people you've actually researched. That's also what gets replies. If you want the wider method, see how we approach outreach and prospecting.

Often, yes. The PDPA's data protection rules don't apply to business contact information, which the Act defines as a person's name, title, business phone, address, email or fax, not provided solely for personal purposes. Organisations don't need consent to collect, use or disclose it.

The purpose matters, though. Someone who hands over a card at a trade show has given you business contact information. The same details used to sell them something personal are a different matter under the DNC rules.

Scraping is where teams get careless. The PDPA bans sending messages to numbers obtained through address-harvesting software, and bans dictionary attacks or similar automated means of messaging indiscriminately. That ban applies to any message, so calling it business outreach doesn't help.

Existing customers get some room. If someone has an ongoing relationship with you, such as a subscription, membership or account, a message that relates only to that relationship isn't a specified message. Account statements, warranty and recall notices, and changes to the terms all qualify, and none need a registry check.

It stops there. A new product offer to the same customer may not relate to the subject of that relationship, and PDPC says a message with any marketing purpose stays a specified message even if it also carries service content. When the relationship ends, the check comes back.

For a specified message, the PDPC requires clear information on who sent it and how to contact them, valid for at least 30 days after sending. If someone withdraws consent, stop within 21 days.

Here's the check we'd run before any list goes out:

We hold our own outbound to the same standard: a real reply address and a suppression list checked before each send.

This is a practical reading of the PDPC's published guidance and the Act as of 6 November 2026, not legal advice. For a large campaign or anything aimed at consumers, have your lawyer look at the plan.

The rules are the floor. Buyers delete bad outreach long before the PDPC ever hears about it.