DNC Registry Singapore: Rules for Businesses

The Do Not Call (DNC) Registry is Singapore's list of phone numbers whose owners have opted out of marketing calls, texts and faxes. Before your business sends a marketing call, SMS or WhatsApp message to a Singapore number, the PDPA (Singapore's personal data law) says you must check that number against the Registry within the previous 21 days, unless you hold the person's clear, recorded consent or the message falls under an exclusion. This guide sorts a typical contact list into the groups the rules treat differently, then covers how long a check lasts, what it costs, what to keep on record, how fast to act on an opt-out, and what Singapore's Spam Control Act adds for cold email and bulk SMS.

Take an example: an eight-person renovation contractor in Ubi wants to send a year-end promotion. Its spreadsheet holds 1,200 numbers: 150 people who enquired through its website this month, 500 past clients whose jobs finished in 2024 and 2025, 400 older enquiries that never became jobs, and 150 office lines at condo management offices it would like as partners. It also plans a cold email to 300 interior design firms. Those five groups sit under different rules, and one promotion sent to the whole sheet would reach hundreds of numbers the law says it has to check first.

Cortex Lab AI builds lead generation systems for Singapore SMEs, including old lead reactivation, which checks consent and the DNC Registry before any message goes out (more below).

What is the DNC Registry, and which messages does it cover?

The Registry has three registers: no voice calls, no text messages and no faxes. A number can sit on any of them, and the rules apply to "specified messages", the law's term for marketing, sent to a Singapore number. A message counts if any of its purposes is to advertise, promote or offer goods, services, land, or a business or investment opportunity, or to promote the supplier of any of those (Advisory Guidelines on the DNC Provisions, para 3.1). A free offer still counts (para 3.5).

The channel makes no difference. The PDPC's guidelines say the rules cover voice calls, SMS "or any data applications (such as ‘Whatsapp’, ‘iMessage’ or ‘Viber’) which use a Singapore telephone number" (para 15.3). The voice register also covers video calls and calls made over a data service, so a WhatsApp call falls under it (para 1.8). Email sits outside the DNC rules because it doesn't go to a phone number (para 3.11). Bulk email falls under the Spam Control Act instead, covered further down.

The duty sits with the "sender", and the law counts anyone who causes or authorises a message as a sender (para 16.3). If you hand a list to an agency or a call centre, you and they are both senders (para 16.7). The DNC Registry portal says the same about checking services: "it is their organisations, and not the aggregators, that will be liable".

Which numbers on your list need a DNC check?

Every number you send a marketing message to, unless one of three things applies: the person gave you clear, recorded consent; the message only answers their own request for information; or an exclusion in the Act covers it, such as a message about an ongoing membership or account, or a message to a business for that business's own purposes. For the contractor's list:

• This month's 150 enquiries. A reply about the job they asked for needs no check. The PDPC says a message sent "for the sole purpose of responding to a request from an individual for information about a good or service would not be considered to be sending a specified message" (para 3.16). Adding the same people to the year-end promotion is different: that needs a check, unless the enquiry form had a separate marketing tick box they ticked (para 7.8).
• 500 past clients. A renovation is a one-off job, and the guidelines say "once-off transactions are insufficient to establish an ongoing relationship" (para 4.5). The promotion needs a check or recorded consent. A warranty or safety notice about work the client paid for is excluded and needs no check (para 4.1(d)).
• 400 older enquiries. A new offer months after someone's enquiry reads as a promotion, not a reply. The guidelines set no time limit on "responding", so the contractor checks these numbers. If your follow-ups run for weeks after an enquiry, ask the PDPC where a reply ends.
• Customers with a current relationship. A membership, subscription, account, loan or a course of treatment counts (paras 4.2, 4.4 and 4.5). Messages whose sole purpose relates to that relationship are excluded, such as a renewal offer on the same subscription (para 4.22). A promotion that goes beyond the relationship isn't (para 4.15), though the guidelines count some related offers as part of it, such as a new credit card offered to an existing cardholder (paras 4.5 and 4.6). The PDPC's organisation's guide adds: "If there is no longer an ongoing relationship, then the requirements to check the DNC Registry will apply." The guidelines judge a relationship on continuity, regularity and frequency, and set no cut-off for when a customer who stopped buying stops counting. Ask the PDPC or a lawyer before you rely on it for an old list. Our win-back guide works through the same question for salon clients and gym members who stopped coming.
• 150 condo management office lines. A message to an organisation for that organisation's own purposes is excluded (paras 4.1(g) and 4.29). The exclusion ends where the pitch turns personal. In the PDPC's own example, a salesperson calling a company's business line who then offers the manager a product for her own use has to comply with the DNC rules (para 4.30).
• 300 interior design firms by email. No DNC check, because email doesn't go to a phone number. The Spam Control Act may apply instead.

1. Is it a call, SMS or app message to a Singapore number?No The DNC rules don't apply. Bulk email falls under the Spam Control Act.
2. Does any part of it advertise or promote something?No It isn't a marketing message under the DNC rules.
3. Is it only a reply to this person's own request for information?Yes The PDPC's guidelines say this isn't a marketing message.
4. Is it to a business, for that business's own purposes?Yes Excluded as business-to-business marketing.
5. Is it only about a current membership, subscription or account?Yes Excluded while the relationship lasts.
6. Do you hold clear consent for this kind of message, on record?Yes No check needed until they withdraw it.
7. Check the number on the register for your channel
8. Send within 21 days of the result, and only if the number isn't listed

How long is a DNC check valid?

21 days. The PDPC's guide to checking numbers says "Results are valid for 21 days from the date the check was conducted" and "If you plan to send specified messages after the 21 days, you must re-check the numbers." If the contractor receives its results on 3 November 2026, it can rely on them until 24 November 2026, following the guidelines' own example of results received on 2 February 2021 being valid until 23 February 2021 (para 6.3). A promotion sent in waves through December needs a fresh check before each wave that falls after that date.

Some older guides still give a longer period. The Council for Estate Agencies' December 2020 post says "You may rely on the DNC Registry results for up to 30 days." The 21-day validity applies to results received from 1 February 2021 onwards (para 6.3).

If someone else runs the check for you, the law calls them a "checker". A checker must give you the date it received the results and how long they're valid (section 43A; para 6.6). You can't rely on a result you have reason to believe is more than 21 days old, or wrong (para 6.1). The PDPC's organisation's guide applies the same rule to bought lists sold as "DNC-cleaned": "you must not rely on the checker’s word" if the information may be out of date or wrong.

How do you check numbers against the DNC Registry, and what does it cost?

Open an account on the DNC Registry portal, then submit the numbers. A Singapore-registered company needs its UEN (its business registration number) and a representative with a Corppass account that has access to the DNCR e-Service. Sole practitioners without a UEN, such as insurance and real estate agents, sign up with Singpass. The main account can create sub-accounts for staff, and credits move between them.

The PDPC's guide to checking numbers lists two ways to check on the portal, plus an API:

• Quick check, under 10 numbers: results are immediate.
• Bulk check: upload a CSV file with one column of 8-digit numbers, and results arrive within 24 hours.
• API: instant results for 10 to 100 numbers at a time, after an onboarding step.

Fees include GST, from the PDPC's guide to checking numbers. Overseas organisations pay S$65.40 to set up. Pay-per-use drops to S$0.0251 a number when one submission holds 5,000 numbers or more. Prepaid packs run from 5,000 credits for S$109.00 (S$0.0218 each) to 1,000,000 credits for S$10,900.00 (S$0.0109 each). The 1,000 free credits are used before any paid ones.

Re-checks cost the same as first checks: "There will be a charge for each number checked, regardless of whether the number had been submitted previously." For the contractor, a monthly promotion to its 900 past clients and older enquiries means 10,800 checks a year. The first 1,000 are free, and a 10,000-credit pack at S$163.50 covers the remaining 9,800. With the S$32.70 set-up fee, checking costs S$196.20 in the first year.

What counts as clear consent, and what should you record?

Consent lets you skip the check only if it's "clear and unambiguous" and kept in a form you can produce later (para 5.1). The PDPC looks at whether you told the person, specifically, that you'd send marketing to their number, and whether they agreed by doing something (para 7.3).

• Passes: "you consent to receive information about special offers we may have from time to time, by SMS" (para 7.5). So does a form with tick boxes for phone, SMS, email and mail placed directly above the Submit button (para 7.8).
• Fails: "you consent to the use of your personal data for marketing purposes", which doesn't say messages will go to the person's number (para 7.6). Silence fails too: customers who didn't answer an email saying they'd be signed up unless they replied had not consented (para 7.11).

For consent given online, keep a record of the person's choice, the date and time, the page or form they saw, and the wording they agreed to (para 8.7). Keep it for as long as you rely on that consent (para 8.8). If a complaint comes in and the record is gone, the PDPC weighs whatever other evidence you have (para 8.10).

Two limits catch people out. You can't ask for consent by SMS or WhatsApp to an unchecked number, because the request is itself a marketing message (paras 3.12 and 3.14); ask by email, or check the number first (paras 3.15 and 7.13). And you can't make marketing consent a condition of selling to someone, beyond what's reasonable to provide the service (section 46(1); paras 9.1 and 9.4).

What must every marketing message include?

Your identity and a working way to reach you. Under section 44, each marketing message to a Singapore number must name who sent or authorised it and say how the recipient can "readily contact" the sender, and that information must be reasonably likely to stay valid for at least 30 days after sending (paras 11.1 and 11.2).

• An operational Singapore number that takes calls or texts, or an email address that receives mail, is the simplest contact (para 13.2).
• Short codes and "No-Reply" email addresses don't count (para 13.3), and neither does a physical address on its own (para 13.13).
• "Contact me at [mobile number]" fails, because "me" doesn't identify anyone (para 12.15). Use a business or personal name.
• A marketing call must not hide the caller's number (section 45; para 11.4).

For the contractor, every message carries the company's name and its office number in the text itself, so it works the same by SMS, WhatsApp or voice.

How fast must you act on an opt-out?

Under the DNC rules, within 21 days of the person's notice (section 47(3); para 8.13). You can't stop anyone withdrawing consent (section 47(2); para 10.3). If a reply says "stop" without naming a channel, the PDPC treats it as covering the channel it arrived on (para 8.18). Consent survives a later DNC registration: if someone agreed to your SMS offers and then joins the Registry, their consent to you stands until they withdraw it with you (para 8.22).

The last row is from the PDPC's guide for individuals: "Once your number is registered, it may take up to 21 days to take full effect." The deadlines are the latest you may act, and stopping on the first "STOP" reply keeps you well inside both. For WhatsApp, Meta's opt-in guidance also asks businesses to "Provide clear instructions for how people can opt out of receiving specific categories of messages".

What does Singapore's Spam Control Act require for cold email and bulk SMS?

The Spam Control Act covers unsolicited commercial messages sent in bulk to an "electronic address", which the Act defines to include "an email address, an instant messaging account or a mobile telephone number" (section 2). A message is unsolicited if the recipient didn't request it or consent to it (section 5). It counts as bulk once you send more than 100 messages on the same or similar subject in 24 hours, more than 1,000 in 30 days, or more than 10,000 in a year (section 6). The Act applies when a message has a Singapore link, for example when it's sent from Singapore or by a company with an office here (section 7).

Senders of unsolicited commercial messages in bulk must meet the Act's Second Schedule (section 11):

• An unsubscribe facility in each message: an email address for email, or a mobile number that takes an unsubscribe request by text for SMS. It must work for at least 30 days after the message is sent.
• Stop within 10 business days of an unsubscribe request.
• The <ADV> label: "the letters “<ADV>” with a space before the title in the subject field", or at the start of the message where there's no subject line. Messages to an instant messaging account are exempt from this and the next two requirements (Second Schedule, para 3(3)).
• Honest headers: "header information that is not false or misleading".
• A working contact: "an accurate and functional email address or telephone number by which the sender can be readily contacted."

Under the Act, anyone who suffered loss or damage from a breach can sue the sender (section 13), and a court can award up to S$25 a message, capped at S$1 million in total unless the claimant proves a larger actual loss (section 14).

The contractor's cold email goes to business addresses, so the DNC rules don't apply. The Spam Control Act does, once the sending passes a bulk threshold. Spread over a week, 300 emails stay under 100 in any 24 hours and under 1,000 in 30 days. A campaign that grows past either limit becomes bulk. The contractor puts an unsubscribe email address and a working phone number in every email from the start, and adds the <ADV> label once a send passes a threshold.

What happens if you skip the DNC check?

The PDPC can order a financial penalty. Under section 48J of the PDPA, it can require a person who "intentionally or negligently" breaches the DNC rules to pay a penalty of up to S$200,000 for an individual and S$1 million in any other case, which includes a company (section 48J(4)). DNC breaches have no turnover-based cap. The 10%-of-revenue maximum in our PDPA guide applies to data protection breaches, a different part of the Act.

Getting numbers by generating them at random (a "dictionary attack") or by harvesting them from the web with software is a separate breach under section 48B, even if you then check the Registry (para 20.4). For that breach, a business with more than S$20 million in yearly Singapore revenue faces a cap of 5% of that revenue (section 48J(4A)).

An employee who sent the messages in good faith, as part of the job or on the employer's instructions, isn't caught by the duty to check or the contact-details rule (section 48(2); para 18.1). An officer or partner of the employer, such as a director, loses that protection if they knew or ought to have known the number was on the Registry and the message went out with their consent or connivance, or through their neglect (section 48(4)). For dictionary attacks, the guidelines say directors and partners may also be held liable (para 20.7).

What can go wrong, even after a check?

• Asking permission by text. "Reply Y to get our offers" is itself a marketing message, so the number needs a check first (para 3.14).
• A service message with a promotion in it. The PDPC's organisation's guide lists a "Delivery update that includes a discount code" and an "Order confirmation that offers a referral bonus" as messages that still need a check.
• A recycled number. Consent from a number's old owner stops counting once you know the number has a new owner (para 7.20).
• A wrong digit. Consent recorded against a mistyped number doesn't cover that number, and sending to it unchecked is likely a breach (para 7.23).
• A campaign that outlives its check. Results expire after 21 days, so a sequence that runs for six weeks needs a fresh check partway through.
• An opt-out on one channel. A "stop" by SMS covers SMS. If the person also tells you by email to stop everything, it covers every channel (para 8.20).

How does an automated outreach system build the DNC check in?

It puts a gate in front of every marketing send, so no message goes out without a valid reason to send it. Whatever tool you use, the setup comes down to five parts.

1. One record per number with where it came from, what the person agreed to (wording, date and time), the latest DNC result and its date, and any opt-out with its date and channel.
2. A gate before each marketing message. The system blocks the number if it has opted out, or if it has no consent record and its DNC result is missing, older than 21 days, or shows the number listed on the register for that channel.
3. Replies kept separate from promotions. A reply to a new enquiry goes out at once and sticks to what was asked. Anything promotional goes through the gate.
4. Opt-outs acted on at once. A "STOP" reply marks the number the moment it arrives, well inside 21 days.
5. A log of each result file and each send time, so you can show the check came before the message.

The PDPC's bulk upload returns results within 24 hours, and its API returns them at once for 10 to 100 numbers, so a system can check a list the day before each send or check new numbers as they arrive.

Questions to ask any outreach vendor

1. Which register do you check for each channel we use: voice, text or both?
2. Does the check run before every send, and will the system refuse to send on a result older than 21 days?
3. Whose account runs the check, and can we download each result file with its date?
4. How do you capture an opt-out from a reply, and how fast does it stop every later message?
5. What consent record do you keep for each contact: the wording, the date and time, and the form?
6. Does each message carry our business name and a contact number that takes calls or texts?
7. For email, is there an unsubscribe email address in every message, the <ADV> label where the Spam Control Act requires it, and a stop within 10 business days?

Where should a small team start?

Match the method to how many numbers you send to.

• A handful of numbers at a time: use the quick check on the DNC portal, which gives immediate results for under 10 numbers, and record the date next to each number.
• A monthly campaign from a spreadsheet: run a bulk check in the week of the send, and buy prepaid credits once your checks pass the 1,000 free ones. At the contractor's volume that's S$163.50 a year.
• Daily sends across calls, SMS, WhatsApp and email, or several staff sending: build the gate into the system. Once several people send from several tools, an expired check or a missed opt-out is hard to catch by hand.

Where Cortex Lab AI fits

Our lead generation systems cover the outreach in this guide. Voice speed-to-lead and WhatsApp speed-to-lead contact only people who have just sent you an enquiry, within a minute of it arriving (calls go out in the hours you set). Old lead reactivation checks each person against your consent records, your opt-outs and the DNC Registry before any message is sent, and removes anyone who says stop. Cold email outreach sends B2B email from your own address, with an opt-out in every email and the <ADV> label where the Spam Control Act requires it. We're a Singapore team and we follow the PDPA.

Bring your contact list to a free 30-minute consultation and we'll sort it with you into the groups above.

Frequently asked questions

Does the DNC Registry cover WhatsApp messages?

Yes. The PDPC says "The DNC Registry rules apply to specified messages sent to your Singapore telephone number, even on WhatsApp and Telegram." Its Advisory Guidelines also name WhatsApp, iMessage and Viber as covered when they use a Singapore number (para 15.3).

How long is a DNC check valid?

21 days from the date of the check. To send after that, check the numbers again. Guides that say 30 days are out of date: the 21-day period applies to results received from 1 February 2021.

How much does it cost to check numbers against the DNC Registry?

S$32.70 to open an account (S$65.40 for overseas organisations), with 1,000 free checks a year. After that, pay-per-use costs S$0.0273 a number with a S$10 minimum, and prepaid credits cost S$0.0109 to S$0.0218 a number. Fees include GST.

Do I need to check business phone numbers?

Not for business-to-business marketing. A message to an organisation for that organisation's own purposes is excluded. If the message offers something for the person's own use, the DNC rules apply again.

What is the penalty for breaking the DNC rules?

The PDPC can require a financial penalty of up to S$1 million for a business, or S$200,000 for an individual, when a breach is intentional or negligent (PDPA section 48J). The turnover-based cap that applies to data protection breaches doesn't apply to DNC breaches.

Does the Spam Control Act apply to cold emails to businesses?

Yes, when the emails are unsolicited, commercial and sent in bulk: more than 100 on the same subject in 24 hours, more than 1,000 in 30 days, or more than 10,000 in a year. The Act's definition of an electronic address includes email addresses, so business inboxes are covered.

Sources checked 26 October 2026: PDPC, Advisory Guidelines on the Do Not Call Provisions (revised 1 February 2021) (regulator); PDPC, Organisation's Guide to Singapore's Do Not Call (DNC) Provisions (22 April 2026) (regulator); PDPC, How To Check Numbers Against Do Not Call (DNC) Registry (22 April 2026) (regulator); PDPC, Individual's Guide to the Do Not Call (DNC) Registry (regulator); DNC Registry portal (regulator); Personal Data Protection Act 2012, sections 43 to 48J (statute); Personal Data Protection (Do Not Call Registry) Regulations 2013 (regulations); Personal Data Protection (Enforcement) Regulations 2021 (regulations); Spam Control Act 2007 (statute); Council for Estate Agencies, Check the Do Not Call Registry Before Sending Marketing Messages (28 December 2020) (regulator, quoted for its out-of-date 30-day figure). Source checked 16 October 2026: Meta, getting opt-in (platform owner).