Is LinkedIn outreach legal in Singapore? The Spam Control Act, the PDPA and Do Not Call explained

The rules at a glance

Three sets of rules can touch a LinkedIn sales message to someone in Singapore: the Spam Control Act 2007, administered by IMDA but enforced through private lawsuits; the Personal Data Protection Act 2012 (PDPA), including its Do Not Call (DNC) provisions, enforced by the PDPC; and LinkedIn's User Agreement.

The Spam Control Act: bulk only, opt-out, and maybe LinkedIn

Since 1 February 2021, "electronic address" in the Act has meant "an email address, an instant messaging account or a mobile telephone number to which an electronic message can be sent". An "instant messaging service" is "a messaging service that allows a user to exchange messages with other users who are using the service concurrently" (s2). LinkedIn messages are often read hours later, so whether LinkedIn fits that definition is an open question. We found no IMDA guidance or court decision on it.

The bigger difference is volume. Messages are "deemed to be sent in bulk" if you send or authorise "(a) more than 100 electronic messages containing the same or similar subject matter during a 24-hour period; (b) more than 1,000 … during a 30-day period; or (c) more than 10,000 … during a one-year period" (s6). The Minister can change those numbers by notice in the Gazette. Below them, the Act's rules for unsolicited commercial messages don't apply by their terms.

Above them, it is an opt-out regime. The Act doesn't ban unsolicited commercial messages; it says bulk senders must follow the Second Schedule (s11). Unsolicited means the person didn't ask for or consent to the message, and "a recipient is not to be treated as having … consented … merely because the electronic address of the recipient was given or published" (s5(2)). The Second Schedule asks for an unsubscribe facility with a clear and conspicuous statement in English, valid for at least 30 days, no further messages "after the expiry of 10 business days" from a request, and no passing on of unsubscribe details. The <ADV> subject label applies to email and SMS; it "does not apply to any unsolicited commercial electronic message that is sent to an instant messaging account".

One rule applies at any volume: dictionary attacks and address-harvesting software are banned for all electronic messages, commercial or not (s9). The Act reaches messages that start in Singapore, come from a sender there, or are read by someone in Singapore (s7). And there are no regulator fines. Anyone who "has suffered loss or damage", including internet service providers, can sue (s13), with statutory damages "not exceeding $25 for each electronic message" and "not exceeding in the aggregate $1 million" unless actual loss is proved to be higher (s14(3)).

The PDPA: business contact information, public profiles and Do Not Call

This is the carve-out that matters most for B2B prospecting. Section 4(5) says "Except where business contact information is expressly mentioned, Parts 3, 4, 5, 6 and 6A do not apply to business contact information." Business contact information means "an individual's name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his or her personal purposes" (s2).

The PDPC's guidelines spell it out: "Organisations are not required to obtain consent before collecting, using or disclosing any business contact information or comply with any other obligation in the Data Protection Provisions in relation to business contact information." Its example is a work card. Handed over at a meeting it is business contact information; the same card handed over to join a gym is not, because it was provided "solely for her personal purposes".

Beyond business details, "The PDPA does not require organisations to obtain the consent of the individual when collecting or using personal data that is publicly available." The PDPC's guidelines say a social network profile that is open to the public and "publicly searchable" is "very likely to be personal data that is publicly available", while one visible only to a few approved contacts "is less likely" to be.

Do Not Call is narrower than many people think. It applies to messages addressed to a Singapore telephone number, an 8-digit number starting with 3, 6, 8 or 9 (s36, s38), in any form. The PDPC lists "voice calls, SMS, or any data applications which use a Singapore Telephone Number such as 'Whatsapp', 'iMessage' or 'Viber'." A LinkedIn message goes to a LinkedIn account, and we found nothing that applies DNC to it. B2B messages are excluded anyway: the Eighth Schedule leaves out "any message sent to an organisation other than an individual acting in a personal or domestic capacity, for any purpose of the receiving organisation". The PDPC's example is a call to an employee's business number about her childcare company, which is excluded, until the caller asks "if she has children" and pitches something personal.

The penalties are real when they apply. DNC breaches can cost an individual up to S$200,000 and others up to S$1 million (s48J(4)). Data protection breaches by an organisation with Singapore turnover above S$10 million can reach 10% of that annual turnover (s48J(3)).

What is untested in Singapore

Singapore's rules are clearer on paper than Australia's, but LinkedIn sits in the gaps. We give no verdict on these.

1. Whether LinkedIn messaging is an "instant messaging service", given the definition's "using the service concurrently".
2. How "same or similar subject matter" applies to AI-personalised messages. If each one is written around the same offer, is it still similar? We found no guidance.
3. Whether a LinkedIn profile's name, title and employer count as business contact information when the member also uses the profile for personal networking or job hunting.
4. Whether an email address found through enrichment, rather than shown on the profile, is business contact information or publicly available.
5. How Singapore's opt-out regime sits with Australia's opt-in Spam Act when an Australian sends to a Singapore buyer. Both laws appear to reach the same message, and we found no source that has tested it.

That last point matters for anyone selling from Australia or New Zealand. Being under Singapore's bulk thresholds doesn't take you outside Australia's Spam Act if you send from Australia; see our Australia post and, for the New Zealand rules, LinkedIn outreach in New Zealand.

When to message Singapore buyers

LinkedIn's ad tools showed 5.10 million members in Singapore in late 2025, 101.3% of adults, which DataReportal itself calls "a potential anomaly". These are registered accounts, not active users; we'd guess expats and old accounts inflate the count.

There is no shared buying season. ACRA says "You can choose any date as your company's FYE", with 31 March, 30 June, 30 September and 31 December as common choices, and the year-end sets AGM and annual return deadlines. Ask a prospect when their year ends, or check their filings, rather than assuming June or December.

The year-end school holidays start early. MOE's calendar ends the 2026 school year on Friday 20 November, with the break running from Saturday 21 November to Thursday 31 December 2026; the 2027 year starts on Monday 4 January. That is about four weeks before Australian schools break up, so Singapore buyers can go quiet sooner than your Australian list.

Public holidays from MOM: Deepavali on Sunday 8 November 2026 (Monday 9 November off only for people whose rest day falls on the 8th), Christmas on Friday 25 December, New Year's Day on Friday 1 January 2027, and Chinese New Year on Saturday 6 and Sunday 7 February 2027, with MOE listing Monday 8 February as a public holiday. Later in 2027: Hari Raya Puasa on Wednesday 10 March, Good Friday on 26 March, Labour Day on Saturday 1 May, Hari Raya Haji on Monday 17 May, Vesak Day on Thursday 20 May, National Day on Monday 9 August and Deepavali on Thursday 28 October.

Singapore is on UTC+8 all year. By our arithmetic it is three hours behind Sydney and Melbourne from October to April and two hours behind from April to October, five hours behind Auckland in the New Zealand summer, and always level with Perth. A 9am send from Sydney in November lands at 6am in Singapore.

Tools for LinkedIn outreach in Singapore

Here is what we could check on Bingle's own pages on 24 October 2026. We make Bingle, so weigh this section with that in mind.

Bingle finds people on LinkedIn who are showing buying signals, such as liking or commenting on a competitor's posts, viewing your profile, changing jobs, hiring, raising money or going to events, and ranks them by fit and timing with the reason attached. It drafts each message in your voice and holds it for your approval unless you switch review off for that sequence, so you can check the English opt-out line is there and the volume is what you meant. When someone replies, the sequence stops. Each sequence has its own send window, with hours, days and a timezone, so a Singapore sequence can send on Singapore time even if you work from Melbourne. It sends from your own profile inside LinkedIn's daily limits and works inside Claude and ChatGPT. After a free week with no card, plans run from US$49 to US$149 a month; see pricing.

Where Bingle falls short for Singapore: it only does LinkedIn, so no WhatsApp, SMS, email, contact database or phone numbers, and visits, likes and blank invites skip the review step. LinkedIn's User Agreement doesn't permit third-party software that automates activity on its site, which is a risk with any automated sender. Switch off automatic sending and Bingle puts each step in a Today's sends list for you to send yourself.

To find buyers by what they engage with, see finding people who engage with competitor posts. For invitation numbers, see LinkedIn's connection request limit.

Questions

Sources

1. Singapore Statutes Online, Spam Control Act 2007 (PDF, in force from 1 Apr 2022). read 24 Oct 2026
2. Singapore Statutes Online, Personal Data Protection Act 2012 (PDF, in force from 16 Oct 2026). read 24 Oct 2026
3. PDPC, Advisory Guidelines on Key Concepts in the PDPA. read 24 Oct 2026
4. PDPC, Advisory Guidelines on the PDPA for Selected Topics (revised May 2024). read 24 Oct 2026
5. Federal Register of Legislation, Spam Act 2003 (Australia), s7. read 24 Oct 2026
6. LinkedIn Help, Prohibited software and extensions. read 24 Oct 2026
7. LinkedIn Help, Types of restrictions for sending invitations. read 24 Oct 2026
8. DataReportal, Digital 2026: Singapore. published 5 Nov 2025; read 24 Oct 2026
9. ACRA, Choosing a company's financial year end. read 24 Oct 2026
10. MOE, School terms and holidays for 2026. published 30 Jul 2025; read 24 Oct 2026
11. MOE, School terms and holidays for 2027. published 14 Jul 2026; read 24 Oct 2026
12. Ministry of Manpower, Public holidays. read 24 Oct 2026

More from the blog

• Is LinkedIn outreach legal in Australia? What the Spam Act and Privacy Act mean for your messages
• Is LinkedIn outreach legal in New Zealand? What the spam law and IPP 3A mean for your messages
• How to find people who engage with a competitor's LinkedIn posts
• How many LinkedIn connection requests can you send a week in 2026?
• What to message a prospect who viewed your LinkedIn profile
• How to score LinkedIn leads by fit and intent (with a worked formula)

All posts