# B2B outreach in Singapore: what PDPA and the Do Not Call rules allow

> What PDPA and the Do Not Call rules allow for B2B marketing in Singapore: the B2B exclusion, business contact information, dictionary attacks and spam.

Source: https://www.fyadvisers.com/blog/b2b-outreach-pdpa-dnc-singapore/  
Author: Fiona Wang, FYAdvisers  
Published: 2026-10-05  
Last updated: 2026-10-05

In Singapore, a marketing message sent to an organisation, for that organisation's purposes, is excluded from the Do Not Call (DNC) provisions of the Personal Data Protection Act (PDPA). Separately, the PDPA's data protection rules do not apply to business contact information, such as a work email or office number, unless it was given solely for personal purposes. Together, these mean genuine business-to-business outreach has more room than consumer marketing.

That room has edges. The B2B exclusion depends on the purpose of the message, not just who receives it. Numbers obtained by address-harvesting software or dictionary attacks are prohibited for any message, B2B or not. And bulk commercial email is governed by a different law, the Spam Control Act.

This guide sets out what the rules say, with links to the official sources. It is general information, not legal advice. If you are planning a large campaign or are unsure about a specific case, check with a qualified adviser and read the PDPC guidance in full.

## The two parts of the PDPA that matter for outreach

The PDPA has two sets of rules that affect sales outreach:

| Rules | What they cover | Key B2B point |
|---|---|---|
| Data protection provisions | Collecting, using and disclosing personal data | Do not apply to business contact information |
| Do Not Call provisions | Marketing messages to Singapore telephone numbers by voice, text or fax | Exclude messages sent to an organisation for its own purposes |

They are separate tests. A message can pass one and still need to satisfy the other.

## The Do Not Call provisions

The main reference is PDPC's [Advisory Guidelines on the Do Not Call Provisions](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/advisory-guidelines-on-the-dnc-provisions-1-feb-2021.pdf) (revised 1 February 2021). The points below come from those guidelines.

### What a "specified message" is

The DNC rules apply to "specified messages" sent to Singapore telephone numbers. In brief, a message is a specified message if one of its purposes is to advertise, promote or offer goods, services, land, or a business or investment opportunity, or to advertise or promote a supplier of those. The guidelines note that in most instances a marketing message of a commercial nature will be a specified message.

Whether a message is a specified message depends on its content and presentation, and on what the recipient could obtain by using the numbers, links or contact details in it. Offering something free does not take it outside the definition.

A "Singapore telephone number" is defined as an eight-digit number beginning with 3, 6, 8 or 9 under the national numbering plan. The DNC provisions apply where the sender is in Singapore when the message is sent, or the recipient is in Singapore when it is accessed.

There are three DNC registers: the No Voice Call Register, the No Text Message Register and the No Fax Message Register.

### What senders of specified messages must do

If your message is a specified message, the guidelines summarise these duties:

1. **Check the DNC Register** before sending. A check with the DNC Registry must have been made within the previous 21 days, unless you hold clear and unambiguous consent from the user or subscriber of the number, in written or other accessible form.
2. **Identify yourself.** Include information identifying the sender and how the recipient can readily contact you. This must be reasonably likely to remain valid for at least 30 days after the message is sent.
3. **Do not hide your number.** For voice calls, you must not conceal or withhold your calling line identity.

### The B2B exclusion

The Eighth Schedule to the PDPA lists messages that are not specified messages. Paragraph 1(g) covers messages sent to an organisation, other than an individual acting in a personal or domestic capacity, for any purpose of the receiving organisation.

PDPC's guidelines say this exclusion addresses B2B marketing, for example where company A wants to market its goods or services to company B, for company B's purposes. Their example:

- A salesperson calls the HR manager of a childcare company on her business contact number to promote a product the company might buy for its childcare centres. **This is not a specified message**, so the DNC rules do not apply.
- During the same call, the salesperson asks whether she has children and offers her something for personal use. **The salesperson can no longer rely on the exclusion** and must comply with the DNC provisions.

What this means in practice:

- **The test is the purpose.** The question is whether you are offering something to the organisation for the organisation's use, not simply whether the recipient works at a company.
- **Keep business offers business.** Do not mix a personal or consumer offer into a B2B call or message.
- **Be careful where business and personal overlap.** Owners of very small firms often use one mobile number for everything. If your offer could reasonably be for personal use, treat it as a consumer message and follow the DNC rules.

### Messages that are not marketing

The guidelines also say that messages sent solely to promote an employment opportunity, to solicit donations for a charitable cause or to promote a political cause, with no marketing elements, are not specified messages. Other messages listed in the Eighth Schedule, such as those confirming a transaction the recipient has already agreed to, are also excluded.

## The 2020 amendments: dictionary attacks and address-harvesting

Amendments to the PDPA that came into force on 1 February 2021 added a prohibition in section 48B. Under it, a person must not send, cause to be sent, or authorise the sending of any message to a telephone number obtained by a dictionary attack or by address-harvesting software.

The DNC guidelines explain the terms, based on the definitions in section 48A:

- **Dictionary attack:** obtaining phone numbers by automated means that generate possible numbers by combining digits into many permutations. This includes generating eight-digit numbers in sequence or at random, and applies even if the recipients never published their numbers.
- **Address-harvesting software:** software specifically designed or marketed for searching the Internet for telephone numbers and collecting, compiling or harvesting them.

Three points matter for B2B teams:

1. **It applies to any message, not only specified messages.** The guidelines give the example of a company using address-harvesting software to find numbers for a message promoting a job opening, with no marketing at all, and say this still breaches section 48B. So the B2B exclusion does not protect you here.
2. **Checking the DNC Register does not help.** In another example, a company generates new numbers by adding 1 to the end of existing customers' numbers and checks them against the DNC Register first. The guidelines say this is still a dictionary attack and a breach.
3. **Senior people can be liable.** The guidelines say the primary responsibility lies with the organisation, and employees acting in good faith on instructions are not liable, but directors, partners and similarly senior officers may be.

In plain terms: do not buy or build phone lists by scraping the web with tools designed for harvesting numbers, and do not generate numbers. Find business contact details through ordinary research, such as a company's own website, a business card someone gave you or a direct introduction, and record where each one came from.

## Penalties

PDPC's [Advisory Guidelines on Enforcement of the Data Protection Provisions](https://www.pdpc.gov.sg/-/media/Files/PDPC/PDF-Files/Advisory-Guidelines/Advisory-Guidelines-on-Enforcement-of-DP-Provisions-1-Feb-2021.pdf?la=en) say that for any intentional or negligent breach of the DNC provisions, which in those guidelines include section 48B, PDPC may require a financial penalty of up to S$200,000 for an individual and up to S$1 million for an organisation.

The same guidelines said that, from a later date to be notified, the cap for an organisation breaching section 48B would become S$1 million or 5% of its annual turnover in Singapore, whichever is higher, where that turnover exceeds S$20 million. PDPC [announced amendments to enforcement](https://www.pdpc.gov.sg/news-and-events/announcements/2022/09/amendments-to-enforcement-under-the-personal-data-protection-act-in-updated-advisory-guidelines-and-guide) in September 2022; check PDPC's current guidance for the figures in force.

## Business contact information under the PDPA

The data protection provisions govern how organisations collect, use and disclose personal data. PDPC's [Advisory Guidelines on Key Concepts in the PDPA](https://www.pdpc.gov.sg/-/media/files/pdpc/pdf-files/advisory-guidelines/ag-on-key-concepts/advisory-guidelines-on-key-concepts-in-the-pdpa-17-may-2022.pdf) (revised 29 April 2026) say these provisions do not apply to business contact information.

The PDPA defines business contact information as an individual's name, position name or title, business telephone number, business address, business email address or business fax number and similar information, not provided by the individual solely for personal purposes.

What the guidelines say about it:

- **No consent needed** to collect, use or disclose business contact information, and the other data protection obligations do not apply to it.
- **Name cards usually count.** PDPC is likely to consider personal data on business cards to be business contact information in most circumstances.
- **Purpose can change the answer.** If someone hands over a business card solely for a personal purpose, such as signing up for a gym membership, the details on it are treated as personal data.
- **Sole proprietors and partners are covered too.** Their contact information is business contact information where it was not provided solely for personal purposes.

PDPC's own [page on spam](https://www.pdpc.gov.sg/complaints-and-reviews/before-you-lodge-a-complaint-with-us-3/spam) puts it simply for individuals: organisations can use your business contact information to send marketing related to your work without consent, but cannot use it to market personal or consumer products to you.

Anything that is not business contact information, such as a personal mobile number found on a social profile or notes about someone's family, is personal data. Collecting and using it for marketing needs a proper basis under the data protection provisions.

## Email and the Spam Control Act

The DNC registers cover voice calls, text messages and faxes to Singapore telephone numbers. Email is handled differently.

According to [PDPC's spam page](https://www.pdpc.gov.sg/complaints-and-reviews/before-you-lodge-a-complaint-with-us-3/spam):

- Unsolicited commercial electronic messages sent in bulk, such as emails, are regulated under the **Spam Control Act**, which is regulated by the Infocomm Media Development Authority (IMDA), not PDPC.
- Enforcement of the Spam Control Act is through civil action by people or organisations that have suffered loss or damage, rather than a complaint to an authority.
- Spam emails without an unsubscribe option breach the Act, and unsubscribe requests must be processed within **10 business days**.

The Act sets out further requirements for unsolicited commercial messages beyond the unsubscribe facility. If you plan to send commercial email in bulk, read the [Spam Control Act](https://sso.agc.gov.sg/Act/SCA2007) itself or [IMDA's guidance](https://www.imda.gov.sg/regulations-and-licensing-listing/the-spam-control-act-cap-311a).

For signal-based outreach, where each message is written to one company about one specific event, volumes are usually low. Even so, give every recipient an easy way to say no, and honour it at once.

## A practical checklist for B2B outreach in Singapore

Before you contact anyone:

1. **Is the offer for the organisation's use?** If yes, the DNC B2B exclusion may apply. If it could be for personal use, follow the DNC rules.
2. **Where did the contact details come from?** Record the source. Never use numbers from address-harvesting software or generated numbers.
3. **Is it business contact information?** A work email or office number from a company website or a business card usually is. A personal number or account usually is not.
4. **Are you identifying yourself clearly?** Name, company and a working way to reach you, in every message. Do not hide your number on calls.
5. **Is there an easy opt-out?** Offer one and act on it promptly. Keep a suppression list everyone can see.
6. **Sending bulk email?** Check the Spam Control Act requirements.
7. **Someone else sending for you?** Agree in writing how contacts are sourced, which channels are used and who approves messages.
8. **Still unsure?** Read the PDPC guidance in full or take advice.

## How this fits signal-based outreach

Signal-based outreach sits comfortably within these rules when it is done properly: one company, one relevant reason, a message about the company's own needs, sent to a business contact found through ordinary research. Our guide to [signal-based prospecting](/blog/signal-based-prospecting/) shows how to write that kind of message, and our guide to [buying signals](/blog/what-are-buying-signals/) explains how to choose which events to act on.

At FYAdvisers, outreach for a client is planned around the PDPA and the Do Not Call provisions, and we agree the contacts, channels and wording with the client before any campaign starts. Nothing is sent without the client's approval.

This article is general information based on PDPC and IMDA materials available in October 2026. It is not legal advice.

## Frequently asked questions

### Do I need to check the DNC Registry before calling a business?

Not if the message is sent to an organisation for that organisation's purposes. PDPC's guidelines say such B2B marketing messages are excluded from the meaning of specified message under paragraph 1(g) of the Eighth Schedule. If the message is aimed at the person in a personal capacity, the DNC rules apply.

### Does the PDPA apply to business email addresses?

The PDPA's data protection provisions do not apply to business contact information, such as a name, job title, business phone number and business email, unless it was provided solely for personal purposes.

### Are cold B2B emails covered by the Do Not Call rules?

The DNC registers cover voice calls, text messages and faxes to Singapore telephone numbers. Unsolicited commercial emails sent in bulk are covered by the Spam Control Act, which IMDA regulates, rather than the DNC registers.

### Does the B2B exclusion allow me to use scraped phone numbers?

No. Section 48B of the PDPA prohibits sending any message to a telephone number obtained through address-harvesting software or a dictionary attack. PDPC's guidelines show this applies even to messages that are not specified messages.

### What are the penalties for breaking the DNC rules?

PDPC's enforcement guidelines say it may impose a financial penalty of up to S$200,000 on an individual and up to S$1 million on an organisation for intentional or negligent breaches of the DNC provisions, with a higher turnover-based cap for some organisations that breach section 48B.