PDPA and Do Not Call rules for automated calls in Singapore

The distinction that decides everything: is it a marketing call?

Singapore's Do Not Call provisions sit inside the Personal Data Protection Act and cover what the Act calls a "specified message" — broadly, a voice call, text or fax sent to a Singapore telephone number to offer, advertise or promote goods, services, land, or a supplier of them.

If your call is a marketing message and the number is on the Do Not Call Registry, you generally may not make it unless an exemption applies. If the call is not a marketing message at all, the DNC provisions are not the operative question — though the rest of the PDPA still is.

This is why the same voice agent, calling the same list, can sit in two completely different regulatory positions depending on what it says. "Your appointment is on Thursday at 2:30, can you still make it?" and "We have a promotion on this month, would you like to book?" are not the same call.

The exemptions worth knowing

PDPC publishes several situations where you do not need to check the registry before sending a marketing message. The ones that matter most for appointment-based businesses are:

• Service calls and reminders Service calls, or reminder messages regarding services bought by the individual, are exempt. This is the cleanest lane, and it is why reminder and confirmation calls are the usual place to start.
• Ongoing relationship Messages about products, services and memberships relevant to individuals your organisation has an ongoing relationship with are exempt. PDPC is explicit that a series of one-off transactions does not amount to an ongoing relationship — this is the exemption most often over-claimed.
• Clear and unambiguous consent You do not need to check the registry if you hold the recipient's clear and unambiguous consent to send marketing messages to that Singapore telephone number.
• Business-to-business Messages directed at organisations rather than individuals are exempt.

PDPA obligations do not stop at the registry

Passing the DNC question does not end the analysis. An automated call still involves personal data — a name, a number, an appointment, sometimes a recording and a transcript — and the general obligations under the Act continue to apply.

In practice that means being able to answer, before launch, what the call is for, what data the agent receives, what it may say aloud, whether the call is recorded, who can access those recordings and transcripts, how long they are kept, and whether anything leaves Singapore.

The operational checklist

These are the questions we work through with a client before any workflow calls a real customer. They are operational, not legal advice, but a business that can answer all seven is in a considerably better position than one that cannot.

• 1. Purpose State in one sentence what this specific call is for. If the sentence contains "and also promote", you have two workflows, not one, and they may sit in different lanes.
• 2. Audience and basis Who is on this list, what relationship do they have with you, and which exemption or consent basis are you relying on? Write it down.
• 3. Data minimisation Decide what the agent receives, what it is permitted to say out loud, and what it must never record.
• 4. Identification Agree how the agent introduces itself and on whose behalf it is calling.
• 5. Restricted topics and escalation List what the agent must refuse — clinical advice, results, billing disputes, complaints — and where those calls go instead.
• 6. Opt-out handling A request to stop calling should be honoured immediately, without argument, and suppress the number from that workflow permanently.
• 7. Access and retention Decide who can see recordings, transcripts and outcomes, where they live, and when they are deleted.

Where this leaves AI calling specifically

Nothing in the Do Not Call provisions turns on whether a human or a system places the call. That cuts both ways: automation does not create a new obligation, and it does not dissolve an existing one. A marketing call is a marketing call whoever dials it.

What automation does change is scale and consistency. A workflow that is correctly scoped will apply the same wording, the same restricted topics and the same opt-out handling on every single call, which is more than can be said for a busy front desk working from memory. A workflow that is incorrectly scoped will do the wrong thing hundreds of times before anyone notices. That asymmetry is the real argument for settling the questions above before launch rather than after.