You will be able to describe what the PDPA expects when you collect an email address for marketing, and how a person withdraws consent.
Open your email list, or the spreadsheet where you keep customer addresses, and next to each address note where it came from: a website order form, a signup sheet, a customer who emailed to ask a price. Where an address came from tells you what the person agreed to. Under Singapore's PDPA (Personal Data Protection Act), what they agreed to decides what you may send them.
The PDPA covers how organisations collect, use and disclose personal data. An email address tied to a person counts as personal data. A home business counts as an organisation, so the rules apply to you just as they apply to a bank. What follows is a plain-language overview to help you ask the right questions. It is not legal advice, which comes from a lawyer.
The Act rests on two linked ideas. You tell people the purpose you are collecting their data for, and you get their consent for that purpose. Consent is tied to the purpose you named. Someone who agreed to receive order confirmations has not automatically agreed to a monthly newsletter.
Take Mei Ling, who bakes custom cakes from her flat in Punggol. Over two years she has collected a few hundred email addresses from three places: her website order form, a signup sheet at a weekend market, and parents who emailed to ask about prices. She wants to email all of them about her new festive range. First she has to work out which of them agreed to hear from her about that.
The parents who asked for a quote gave their email to get a price back. The customers who ordered gave theirs for a confirmation and a receipt. Neither group asked for marketing email. Treating every address you hold as a marketing address is the most common mistake small businesses make.
The wording beside a form matters too. "Sign up for updates" is vague. Mei Ling could write: "Get our monthly email with new flavours, order dates for festive seasons and the occasional offer." That tells people what they are agreeing to and how often. A clear purpose gives you clear consent, so later you know exactly what you may send.
The fix is to ask for marketing consent separately from the order or booking. The steps are:
Decide the specific purpose: what you will send and how often. State it clearly next to the form. Make the email field required only for the transaction, such as an order or a booking. Add a separate, unticked checkbox for marketing email. Send marketing only to people who ticked it. Everyone else gets transactional messages only.
On Mei Ling's order form, the address field is required so the order can go through, and underneath sits an unticked box: "Also send me the monthly cake email." A customer who ticks it has given marketing consent. A customer who leaves it blank gets the receipt and nothing else.
Priya, who runs a maths tuition centre in Tampines and whom you may know from earlier marketing courses, uses the same method on her trial class booking form. Every parent who books a trial gets the booking details. Only parents who tick the box get her termly email about new classes.
Avoid pre-ticked boxes. A box the person never touched says little about what they agreed to, and it is a weak record if anyone asks.
Consent is not permanent. Under the PDPA a person can withdraw consent, and after that you must stop using their data for that purpose. For email, this means that when someone unsubscribes or replies "please stop", they stop getting marketing email. Treat a request through any channel as withdrawal of consent, including a WhatsApp message.
The withdrawal has to follow the address everywhere it is stored. Two failures are common. In the first, a list is exported to a spreadsheet, left on a laptop for six months, then re-imported into a new email tool with the unsubscribed people still in it. In the second, a customer asks on WhatsApp to be removed and nobody updates the email list.
Most email tools keep unsubscribed contacts on a suppression list so they cannot be emailed again by accident. This is one reason to keep your list inside the tool and avoid exporting to and re-importing from loose files. When a request comes in, stop the marketing email, then update every other place the address is kept.
If a customer or the Personal Data Protection Commission (PDPC) asks why someone was emailed, you should be able to show it. A consent record has four parts: when the person signed up, where they signed up (which form, page or event), what they were told at the time, and how they agreed, such as ticking a box or clicking a confirmation link.
Email tools capture part of this on their own. A form built inside the tool usually stores the signup date and the form name. Double opt-in, covered in Lesson 2.3, adds the confirmation click. Tools do not store the wording people saw, so when you change a form, save a dated screenshot of the old version. For paper signup sheets, such as the one Mei Ling uses at the market, keep the sheet or at least a photo of it, with the consent line printed at the top.
The PDPC publishes advisory guidelines on the Act's key concepts, consent included, along with guides written for small businesses. They are free on the PDPC website. Summaries, including blog posts and these notes, leave things out, and the guidelines are updated from time to time. For a specific decision, such as whether you can email people who handed you a business card at an event, read what the PDPC says. If your business handles sensitive data or large lists, ask a lawyer.
The PDPA is one of two laws that apply to marketing email. The second, the Spam Control Act, is covered in the next lesson, Lesson 1.3, "The Spam Control Act and unsolicited email".
For now, look at your own signup point. In the activity below you will write the consent line that goes under your form, the one sentence that tells people what they will get and how often, and then hold it up against the PDPC's published guidance.
Write the consent line for under your signup form, saying what you will send and how often. Then check it against the PDPC's published guidance.
Junxiong-WFG Organisation is an authorised representative of AIA Financial Advisers Private Limited (Reg. No. 201715016G).