Explainer
Singapore's PDPA and Do Not Call rules: what they mean for LinkedIn outreach
7 days free. No card. Then US$79/mo · See pricing
By the Bingle team · Published 28 October 2026 · Researched from the sources listed below, drafted with AI help and checked against those sources
Short answer
Do Singapore's PDPA and Do Not Call rules apply to LinkedIn messages?
The Do Not Call provisions cover marketing messages sent to Singapore telephone numbers, by call, text, fax or a chat app that runs on the number, and the PDPC says they do not apply to messages not sent to a Singapore number, so on its wording a LinkedIn message falls outside them, though the PDPC has never named LinkedIn. The PDPA's data protection rules don't apply to business contact information such as a name, job title and work email given for work, but for other personal data the PDPC expects express consent before direct marketing messages. Bingle suits a careful approach because each drafted message waits for your OK unless you switch review off, and it sends from your own LinkedIn account under your name.
How we researched this
On 28 October 2026 we read the PDPC's Organisation's Guide to Singapore's DNC Provisions (published 22 April 2026), its Advisory Guidelines on the Do Not Call Provisions (revised 1 February 2021), its Advisory Guidelines on Key Concepts in the PDPA (revised 29 April 2026) and IMDA's best-practice page on unsolicited communications. Singapore Statutes Online refused our requests that day (HTTP 403), so for section wording we used the PDPC's own quotations and, marked as secondary, a legal publisher's copies of the PDPA and the Spam Control Act (listed in the sources). We did not contact the PDPC and tested nothing.
What the Do Not Call provisions cover
The PDPC's organisations' guide to the DNC provisions, published on 22 April 2026, defines a specified message as one that advertises, promotes or offers to supply goods, services, land, property interests, or business or investment opportunities, or that promotes a supplier of them. "This applies to voice calls, text messages, and faxes sent to Singapore telephone numbers." A message counts if any part of it has a marketing purpose, so a delivery update with a discount code is in.
Before sending one, section 43 requires a check of the DNC Registry made within 21 days, unless you hold the person's clear and unambiguous consent in written or other form you can produce later. Each specified message must also identify who sent or authorised it and how to reach them. The caps for breaching Part 9, in a secondary copy of section 48J(4), are S$200,000 for an individual and S$1 million for anyone else.
The PDPC's DNC guidelines settle which channels count, on page 48. The provisions "apply equally to all means by which a sender may send a specified message to a Singapore telephone number", including voice calls, SMS and "any data applications … which use a Singapore telephone number". The next sentence draws the line: "the DNC Provisions do not apply to specified messages which are not sent to a Singapore telephone number, e.g. location-based broadcasts that are pushed to mobile phones through data-enabled smart phone applications or data applications that do not use a Singapore telephone number to send messages." The data protection rules, it adds, may still apply to those.
| Do the DNC provisions apply? | Where that comes from |
|---|---|
| Voice call to a Singapore number | |
| Yes, unless an exclusion or valid consent applies | PDPC guide, 22 Apr 2026 |
| Text message or fax to a Singapore number | |
| Yes, on the same terms | PDPC guide, 22 Apr 2026 |
| A chat app that runs on a Singapore number | |
| Yes | DNC guidelines, p48 |
| An app message that doesn't use a Singapore number | |
| No, though the data protection rules may apply | DNC guidelines, p48 |
| LinkedIn message, paid message or connection note | |
| Not named by the PDPC. It goes to a LinkedIn account, not a phone number, so on the p48 wording DNC doesn't reach it. That is our reading | DNC guidelines, p48 |
| Outside DNC, which covers Singapore telephone numbers only (our reading); the Spam Control Act can apply to bulk email | PDPC guide; IMDA |
The business-to-business exclusion
Even for calls and texts, B2B selling has its own carve-out. The Eighth Schedule, as the DNC guidelines quote it on page 19, excludes messages "sent to an organisation other than an individual acting in a personal or domestic capacity, for any purpose of the receiving organisation". The guidelines' gloss: "This exclusion addresses B2B marketing messages and purposes, for example, where company A wishes to market its goods or services to company B, for the purposes of company B." The 2026 guide repeats it with an office landline as the example, and adds that the provisions come back if the message also markets something to the person for personal use.
The exclusion turns on purpose, not on the kind of number. IMDA's best-practice page says telemarketing by voice, text or fax to Singapore numbers, "including mobile, fixed-line, residential and business numbers", must comply with the DNC provisions. So a business line is no pass on its own, and both PDPC examples we read use business numbers. We found nothing on how the exclusion treats a founder's own mobile used for work.
This matters on LinkedIn the moment a conversation moves to the phone. If a prospect shares a mobile number in a LinkedIn thread and you call about something for their company, the B2B exclusion is the likely route; if the call drifts to something for them personally, check the Registry first or rely on consent you can show.
Business contact information sits outside the data rules
Section 4(5) switches off the PDPA's main data protection Parts for business contact information. The PDPC's Key Concepts guidelines (revised 29 April 2026) put it in one line on page 17: "The Data Protection Provisions do not apply to business contact information." That covers a person's name, job title, work phone, work address, work email, work fax and similar details, as long as the person didn't provide them solely for personal purposes.
Purpose is what decides it. In the PDPC's seminar example, Sharon drops her name card in a bowl at a registration booth so she hears about future seminars; the organiser can contact her without her consent and doesn't have to give her access to or correct those details. Sole proprietors count too: a studio owner who hands his details to a property agent for a business search can have them passed among the agent's colleagues without consent. And "in most circumstances, the Commission is likely to consider personal data provided on business/name cards as business contact information."
The guidelines never mention LinkedIn. A profile's name, title and employer look a lot like a name card, which points towards business contact information. The question nobody has answered is a profile kept mainly for job hunting or personal networking: whether its details were provided "solely for … personal purposes" is a fact question the PDPC hasn't addressed. One more gap, and this one is our reading: the post or comment that made someone a lead is not a name, title or contact detail, so it is ordinary personal data even when the person's name and title are not.
Consent, purpose and notice for everything else
For personal data that isn't business contact information, the Key Concepts guidelines set out the obligations, starting on page 34. Consent comes first (sections 13 to 17). Purpose limitation (section 18) allows collection, use or disclosure only "for purposes that a reasonable person would consider appropriate in the circumstances" and, where relevant, that were notified. Notification (section 20) means telling people the purpose before or when you collect.
Section 17 and the First Schedule list exceptions, and publicly available data is one: personal data "generally available to the public", which the PDPC reads as data any member of the public could reach "with few or no restrictions". On page 77 it adds that if the data was publicly available when you collected it, you can still use it without consent after the person makes it private. And on page 82 it says the notification obligation does not apply when you collect or use data without consent under section 17.
Direct marketing pulls the other way. On page 62: "Organisations cannot rely on the legitimate interests exception to send direct marketing messages. In general, organisations must obtain express consent to send direct marketing messages to individuals." On page 51, deemed consent by notification "does not apply to the purpose of sending direct marketing messages", and the PDPC calls pre-ticked opt-out boxes inappropriate for marketing consent.
| How the PDPC's guidance treats it | What it leaves open |
|---|---|
| Name, title, employer and work email, given for work | |
| Business contact information: the data protection provisions don't apply (s4(5)) | Profiles used mainly for job hunting or personal networking |
| The public post or comment that made them a lead | |
| Personal data; collection and use without consent can rest on the publicly available exception | How that sits with the PDPC's express-consent expectation for direct marketing |
| A personal mobile or personal email | |
| Personal data; calls and texts to a Singapore number also bring in DNC | Little: treat it as personal and get consent |
The guidelines don't say how the express-consent expectation for direct marketing meets the publicly available exception when someone sends a LinkedIn pitch about a person's work. We give no view on that. What we'd do while it is open: write to people in their work role about their company's needs, keep lead notes to work facts and the public signal you're answering, and give an easy way to say no.
Where the Spam Control Act fits
IMDA's best-practice page, read on 28 October 2026, describes spam as "unsolicited commercial electronic messages sent in bulk". Its guidance for bulk senders asks for an unsubscribe statement in English, a contact that works for at least 30 days, removal within 10 business days, and an ADV label before the message title. A secondary copy of the Act, synced from the official site on 9 April 2026, shows that an electronic address includes "an instant messaging account", that bulk starts above 100 messages with the same or similar subject matter in 24 hours, 1,000 in 30 days or 10,000 in a year, and, in section 5(2), that a published address is not consent. Whether LinkedIn counts as an instant messaging service under the Act is untested; our Singapore outreach guide walks through that question and the Act's damages.
What this means for a LinkedIn connection note and DM
Putting the PDPC's guidance together for an ordinary sequence to an operations director in Singapore, here is how we read it. None of it is the PDPC's own advice about LinkedIn, because there isn't any.
- The connection note goes to a LinkedIn account, not a Singapore telephone number, so on page 48 of the DNC guidelines the DNC check doesn't arise. Her name, title and employer used in her work capacity read as business contact information.
- The DM: write about her company's needs, not her personal ones, so you stay in the business contact and B2B lanes. Sign with your name and business, and add a plain English line saying she can reply to stop.
- Count your similar messages across the whole team. Above 100 in a day, 1,000 in 30 days or 10,000 in a year, and if LinkedIn turns out to be an instant messaging service, the Spam Control Act's bulk rules would apply.
- If she gives you a mobile number and the conversation moves to calls or texts, check whether the B2B exclusion fits. If it doesn't, check the DNC Registry within 21 days before you call, or hold consent you can show, and identify yourself in each message.
Selling from Australia or New Zealand? The rules where you send from can apply to the same message. See Australia's Spam Act on LinkedIn and New Zealand's anti-spam law and LinkedIn messages.
Where Bingle fits: each LinkedIn message it drafts waits in an approval queue for you to approve, edit or regenerate, unless you switch review off for that sequence, so you can check the wording stays on her company and the opt-out line is there. It sends from your own LinkedIn account with your name on the sign-off, any reply stops the sequence, and you can switch off automatic sending and send each step yourself from Today's sends. It works on LinkedIn only and places no calls or texts, so a DNC check only comes up when you pick up the phone yourself.
Its limits: visits, likes and blank invites go out without the review step, and Bingle's user guide doesn't describe an automatic opt-out line, so put yours in the message step. Bingle is 7 days free with no card, then from US$49 a month; see pricing, or the rest of the Bingle blog.
Questions
If a prospect gives me their mobile number on LinkedIn, can I call or text them?
Calls and texts to a Singapore number are covered by the DNC provisions. If the message is to them for their organisation's purposes, the B2B exclusion is likely to apply; otherwise check the DNC Registry within 21 days or hold clear and unambiguous consent you can produce.
Is the work email on someone's LinkedIn profile business contact information?
It is if they didn't provide it solely for personal purposes, which is the PDPA's test. The PDPC has not applied that test to LinkedIn profiles.
Does the Do Not Call Registry cover business phone numbers in Singapore?
Yes. IMDA says telemarketing to mobile, fixed-line, residential and business numbers must comply, but messages sent to an organisation for its own purposes fall under the B2B exclusion.
Can I rely on legitimate interests to send sales messages to people in Singapore?
No. The PDPC says organisations cannot rely on the legitimate interests exception to send direct marketing messages and should generally get express consent. Business contact information sits outside those rules.
Do I have to tell a Singapore lead where I found their details?
The PDPC says the notification obligation doesn't apply when you collect or use personal data without consent under a section 17 exception, and business contact information is outside the data rules. Saying where you found someone is still a courtesy that costs one sentence.
Sources
- PDPC, Organisation's Guide to Singapore's Do Not Call (DNC) Provisions. published 22 Apr 2026; read 28 Oct 2026
- PDPC, Advisory Guidelines on the Do Not Call Provisions (revised 1 Feb 2021; quotes PDPA s36, s43 and Eighth Schedule para 1(g)). read 28 Oct 2026
- PDPC, Advisory Guidelines on the Do Not Call Provisions (PDF), pp19, 22, 48. read 28 Oct 2026
- PDPC, Advisory Guidelines on Key Concepts in the PDPA (revised 29 Apr 2026; quotes PDPA s2, s4(5), s13 to s20). read 28 Oct 2026
- PDPC, Advisory Guidelines on Key Concepts in the PDPA (PDF), pp17 to 18, 34, 51, 62, 75 to 77, 82. read 28 Oct 2026
- IMDA, Unsolicited communications: best practices for organisations. read 28 Oct 2026
- LawPlayer, Personal Data Protection Act 2012, s43, s44 and s48J(4) (secondary copy of Singapore Statutes Online, synced 19 Jul 2026). read 28 Oct 2026; sso.agc.gov.sg returned HTTP 403 that day
- LawPlayer, Spam Control Act 2007, s2, s5(2) and s6 (secondary copy of Singapore Statutes Online, synced 9 Apr 2026). read 28 Oct 2026; sso.agc.gov.sg returned HTTP 403 that day
More from the blog
- Is LinkedIn outreach legal in Singapore? The Spam Control Act, the PDPA and Do Not Call explained
- Does NZ's anti-spam law apply to LinkedIn messages?
- Is LinkedIn outreach legal in Australia? What the Spam Act and Privacy Act mean for your messages
- What Australia's Privacy Act reforms mean for B2B prospecting on LinkedIn
- Best LinkedIn buying signal tools in 2026
- What are the best Gojiberry alternatives for signal-based LinkedIn outreach?
See who's looking right now
Your first leads show up in minutes, each with its reason. Free for 7 days, no card.