B2B cold calling is legal in Singapore. The PDPA's Do Not Call rules apply to marketing messages (specified messages) sent to Singapore telephone numbers, but the Eighth Schedule excludes messages sent to an organisation rather than to an individual acting in a personal or domestic capacity. Personal offers, numbers obtained by dictionary attacks or harvesting software, and bulk commercial email under the Spam Control Act are still covered.
This guide is for B2B companies, in Singapore or calling in from Australia, that prospect Singapore businesses by phone and email. It is general information, not legal advice. Get advice from a Singapore lawyer for your own situation.
Is cold calling legal in Singapore?
Yes. Two laws shape B2B outbound into Singapore:
| Law | What it covers | Regulator |
|---|---|---|
| Personal Data Protection Act 2012 (PDPA), Do Not Call provisions (Parts 9 and 9A) | Marketing calls, texts and faxes to Singapore telephone numbers; messages to numbers obtained by dictionary attacks or harvesting software | Personal Data Protection Commission (PDPC) |
| Spam Control Act 2007 | Unsolicited commercial email, instant messages and texts sent in bulk. Not voice calls. | Civil action by those who suffer loss |
What do the Do Not Call rules cover?
They cover specified messages sent to Singapore telephone numbers.
- Singapore telephone number: PDPC's guidelines describe an eight-digit number beginning with 3, 6, 8 or 9.
- Specified message: a message where one of its purposes is to offer, advertise or promote goods, services, land or a business or investment opportunity, or a supplier of them.
Singapore's Do Not Call Registry lets people opt out of marketing calls, texts and faxes. If the rules apply to your message, you check the number against the registry before you call.
Are B2B calls excluded from Singapore's Do Not Call rules?
Yes, genuine business-to-business messages are. The Eighth Schedule to the PDPA lists messages that are not specified messages, and one of them is a message sent to an organisation other than an individual acting in a personal or domestic capacity.
PDPC's guidelines give an example. A caller rings an HR manager on her business number to promote a product for her company's childcare centres. That is not a specified message. If the caller then asks about her own children and offers a product for her personal use, the exclusion no longer applies, and the Do Not Call rules do.
What this means in practice:
- Keep the call about the business and the person's role.
- Don't switch to personal offers mid-call.
- If your list mixes business contacts with personal numbers, or you sell anything a person could buy for themselves, treat the Do Not Call rules as applying and check the registry.
The Eighth Schedule also excludes some other messages, including messages relating to the subject of an ongoing relationship between the sender and recipient.
When do you need to check the DNC Registry, and for how long are results valid?
When you send a specified message, you must check the register first, unless the person has given clear and unambiguous consent. Since 1 February 2021:
- Check within 21 days before sending. The PDPC guidelines say the prescribed duration is 21 days.
- Results are valid for 21 days from receipt. PDPC's example: results received on 2 February 2021 were valid until 23 February 2021.
- Consent must be clear, unambiguous and evidenced. It must be in written or other form accessible for later reference. Failing to opt out is unlikely to count as clear and unambiguous consent. Keep the evidence for as long as you rely on it.
- Third-party checkers have duties too. A checker who checks the register for you must give you accurate information, and tell you when the results were received and how long they are valid.
What must every marketing call or message include?
For specified messages, two rules apply on every contact:
- Identification and contact details. The message must identify the sender and give contact information reasonably likely to be valid for at least 30 days. PDPC says short codes and "no-reply" email addresses don't count as contact information.
- No hidden numbers. A sender making a voice call must not conceal or withhold the calling line identity.
Even on B2B calls, where the exclusion applies, these are good habits: say who you are, who you are calling for and why, and call from a number people can call back.
What changed in the 2020 amendments?
The Personal Data Protection (Amendment) Act 2020 made several changes to the Do Not Call regime:
- Dictionary attacks and harvesting software are banned. Section 48B prohibits sending an applicable message, meaning a message with a Singapore link sent to a telephone number generated or obtained through a dictionary attack or address-harvesting software. This applies to any message sent to those numbers, so the B2B exclusion does not help. A dictionary attack is an automated way of generating numbers by combining digits into many permutations.
- Checkers must give accurate information about registry results.
- Enforcement moved to the PDPC's administrative regime, so the Commission can deal with breaches through directions and financial penalties.
- The Spam Control Act was extended to cover messages sent to instant messaging accounts.
Practical rule: never call or text from a list of generated or scraped numbers. Build lists from named people at real companies.
What are the penalties?
From 1 October 2022, the maximum financial penalties are:
| Contravention | Individual | Others |
|---|---|---|
| Do Not Call provisions (Part 9) | S$200,000 | S$1 million |
| Dictionary attacks and harvested numbers (section 48B) | S$200,000 | 5% of Singapore annual turnover where that turnover exceeds S$20 million, otherwise S$1 million |
PDPC publishes its enforcement decisions, including a 2023 decision on a breach of section 48B by an individual.
Does the Spam Control Act apply to B2B cold email?
Yes, if you send in bulk. The Spam Control Act 2007 covers electronic messages sent to an email address, an instant messaging account or a mobile telephone number. A message sent by a voice call is not an electronic message under the Act, so cold calls fall outside it.
Bulk means more than 100 messages with similar subject matter in 24 hours, more than 1,000 in 30 days, or more than 10,000 in a year. The Act's definitions don't carve out business recipients, and it applies to messages with a Singapore link, such as messages accessed by a recipient in Singapore.
If you send unsolicited commercial messages in bulk, the Second Schedule applies. As summarised in the Singapore Journal of Legal Studies, it requires:
- an unsubscribe facility shown clearly and conspicuously
- "
" at the start of the subject line, or at the start of the message if there is no subject - title and header information that is not false or misleading
- a working email address or phone number for contact
Under section 5(3), a recipient who unsubscribes is treated as not consenting to messages sent more than 10 business days later. Section 9 also bans sending to addresses obtained through dictionary attacks or address-harvesting software. Anyone who suffers loss can sue, with statutory damages of up to S$25 per message and up to S$1 million in aggregate unless actual loss above that is proved.
Practical rule: keep cold email small, personal and below the bulk thresholds, or meet the Second Schedule in full. Our guide to cold email deliverability covers the technical side.
A compliance checklist for calling Singapore
- Build lists of named people at real companies. No generated or scraped number lists.
- Keep every call about the business and the person's role.
- Check the DNC Registry for any number where the call might be a specified message, and recheck within 21 days.
- Identify yourself and your company on every call, and never hide your number.
- Keep evidence of consent if you rely on it.
- Action opt-outs immediately, on calls and emails.
- Keep cold email below the bulk thresholds, or meet the Spam Control Act requirements in full.
- Call in Singapore business hours. Singapore runs 2 to 3 hours behind Sydney, depending on daylight saving.
- Get Singapore legal advice for anything unusual.
How Nousu calls Singapore
We run phone-first campaigns into Singapore from Sydney, with Australian callers who all work in-house in Sydney. We build lists in-house, keep calls about the business, scrub numbers against the Do Not Call Register where required and action opt-outs immediately. See our Singapore cold calling service, Singapore telemarketing and our Singapore market overview.
Pricing is starting at $7,000 a month (ex GST), with the exact fee quoted after a 30-minute call. The initial term is 3 months, then rolling monthly, and first calls go out within 2 weeks. Calling New Zealand as well? Read our New Zealand cold calling laws guide. For Australia, see our Australian cold calling laws guide.
Frequently asked questions
Is cold calling legal in Singapore? Yes. B2B cold calling is legal in Singapore. The PDPA Do Not Call rules cover marketing messages to Singapore telephone numbers, but messages sent to an organisation, rather than to an individual acting in a personal or domestic capacity, are excluded. Keep the call about the business, identify yourself and don't hide your number. This is general information, not legal advice.
Do I need to check the DNC Registry for B2B calls in Singapore? Not for a genuine business-to-business call, which the Eighth Schedule excludes from the DNC rules. You do need to check if the message is aimed at someone in their personal capacity, or if your list mixes business and personal contacts. PDPC's example: offering an HR manager a product for her company's childcare centres is B2B, but offering her a product for her own children is not.
How long are DNC Registry results valid in Singapore? 21 days. Since 1 February 2021, a sender must check the register within 21 days before sending a specified message, and results are valid for 21 days from receipt, unless the person has given clear and unambiguous consent evidenced in written or other accessible form.
What are the penalties for breaching Singapore's Do Not Call rules? Under the amended PDPA, maximum financial penalties for Do Not Call contraventions are S$200,000 for an individual and S$1 million in other cases. For sending messages to numbers obtained by dictionary attacks or address-harvesting software, the cap is S$200,000 for an individual, and for others 5% of Singapore annual turnover above S$20 million, or S$1 million.
Does the Spam Control Act apply to B2B cold email in Singapore? Yes, if you send in bulk. It covers unsolicited commercial electronic messages sent in bulk to email addresses, instant messaging accounts and mobile numbers, and its definitions do not carve out business recipients. Bulk means more than 100 similar messages in 24 hours, 1,000 in 30 days or 10,000 in a year. Voice calls are excluded.
Can an Australian company cold call Singapore businesses? Yes. The Do Not Call rules apply to specified messages sent to Singapore numbers, wherever the caller is. Keep calls about the business, don't conceal your calling line identity, and never use numbers generated by dictionary attacks or harvesting software. Call in Singapore business hours, which run 2 to 3 hours behind Sydney.
Sources
- Personal Data Protection Commission, Advisory Guidelines on the Do Not Call Provisions (revised 1 February 2021): https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Advisory-Guidelines/Advisory-Guidelines-on-the-DNC-Provisions-1-Feb-2021.pdf
- Singapore Statutes Online, Personal Data Protection Act 2012 (Parts 9 and 9A, Eighth Schedule): https://sso.agc.gov.sg/Act/PDPA2012
- Personal Data Protection Commission, Do Not Call Registry and your business: https://pdpc.gov.sg/Overview-of-PDPA/Do-Not-Call-Registry/Business-Owner/Do-Not-Call-Registry-and-Your-Business
- Personal Data Protection Commission, Breach of section 48B of the PDPA (prohibition on use of dictionary attacks by an individual): https://www.pdpc.gov.sg/organisations/regulations-decisions/enforcement-decisions/breach-of-section-48b-of-the-pdpa-prohibition-on-use-of-dictionary-attacks-by-an-individual
- Allen and Gledhill, Increased maximum financial penalties under the PDPA from 1 October 2022: https://www.allenandgledhill.com/sg/publication/articles/22617/increased-maximum-financial-penalties-under-personal-data-protection-act-2012-from-1-october-2022
- Society for Computers and Law, Singapore's PDPA: a review of the major changes (Part 4): https://www.scl.org/12145-singapore-s-personal-data-protection-act-a-review-of-the-major-changes-ahead-part-4/
- Singapore Statutes Online, Spam Control Act 2007: https://sso.agc.gov.sg/Act/SCA2007
- Singapore Journal of Legal Studies, article on the Spam Control Act 2007 (Second Schedule requirements): https://law.nus.edu.sg/sjls/wp-content/uploads/sites/14/2024/07/1943-2007-sjls-dec-361.pdf
Book a 30-minute call
Selling into Singapore? Book a 30-minute call with Harry Constant, our founder, and we'll talk through your target list and how we call Singapore from Sydney.