Singapore runs two separate regimes for marketing messages, with different rules, different regulators and different deadlines. Confusing them is the most common compliance mistake made here, and it is easy to do because most guides treat them as one thing.
- The Spam Control Act 2007 governs email, SMS and instant messages sent in bulk. It is an opt-out regime, and it is enforced by private civil action — there is no regulator fine.
- The Personal Data Protection Act 2012, Part 9, creates the Do Not Call Registry. It is an opt-in regime, it covers calls, texts and faxes to Singapore phone numbers, and it is enforced by the PDPC with substantial penalties.
Email marketing sits under the first. Anything to a phone number sits under both.
The rule almost everyone gets wrong: the <ADV> prefix
Singapore still legally requires unsolicited commercial email sent in bulk to carry <ADV> at the start of the subject line. It is in the Second Schedule to the Spam Control Act and it has not been repealed.
“Bulk” is defined numerically: more than 100 substantially similar messages in 24 hours, more than 1,000 in 30 days, or more than 10,000 in a year. Almost any real email programme clears those thresholds.
In practice, if you have consent you are not sending unsolicited mail and the prefix does not apply. But for genuinely unsolicited bulk commercial email to Singapore addresses, it remains a live requirement that international senders routinely miss.
Email: an opt-out regime, with one important exclusion
Unlike the EU, Nigeria or Kenya, Singapore does not require prior consent to send commercial email. You may send, provided you honour opt-outs and meet the labelling and identification rules.
The exclusion that catches people: section 5(2) states that publishing an address does not constitute consent. An address scraped from a company website or directory is not an address that agreed to hear from you. This differs sharply from Australia and New Zealand, where a conspicuously published business address can create inferred or deemed consent.
The two deadlines
This is where the dual regime bites hardest, because the numbers differ:
- Email opt-out under the Spam Control Act: 10 business days. Section 5(3) and the Second Schedule, paragraph 2(7).
- DNC withdrawal under the PDPA: 21 days. Section 47(3). This was reduced from 30 days on 1 February 2021 — older guides still cite 30.
The frequent error is applying “10 business days” to the DNC Registry, or 21 days to email. They are different obligations under different statutes.
The Do Not Call Registry — phone numbers only
If you send marketing to a Singapore telephone number — SMS, voice or fax — you must check the number against the DNC Registry before sending, unless you have clear and unambiguous consent in written or recorded form.
Email addresses are outside the DNC Registry entirely. An email programme does not need to check it.
Jurisdiction: opening the email in Singapore is enough
The Spam Control Act reaches messages where the recipient accesses the message on a device in Singapore. Not where your company is, not where your server is, not what the address domain says.
A subscriber who signed up in London and opens your campaign while on holiday in Singapore has, on the face of the Act, brought that message into scope. In practice enforcement follows real targeting rather than incidental travel — but the statutory reach is genuinely broad.
Enforcement: private lawsuits, not regulator fines
This is the structural oddity of Singapore’s email regime. The Spam Control Act has no regulator that levies fines for spam. It is enforced by the recipient, or an affected party, suing.
The Act provides statutory damages of S$25 per message, capped at S$1 million, so a claimant does not need to prove actual loss. That structure makes bulk non-compliance a genuine litigation exposure rather than a regulatory one.
The PDPA is different and is actively enforced by the PDPC. Under section 48J the maximum financial penalty is the higher of S$1 million or 10% of annual turnover in Singapore — and the 10% limb only applies where Singapore turnover exceeds S$10 million. Most published summaries quote the 10% figure without that threshold, which materially overstates exposure for smaller businesses.
DNC-specific breaches carry up to S$1 million for an organisation and S$200,000 for an individual.
What a compliant email to Singapore looks like
- An accurate sender identity and a valid Singapore or overseas contact address
- A working, free unsubscribe using the same channel — reply-to-email for email
- Opt-outs actioned within 10 business days
- <ADV> in the subject line if the mail is genuinely unsolicited and clears the bulk thresholds
- No reliance on scraped or published addresses as consent
- Separate DNC checking for anything sent to a phone number, with 21-day withdrawal handling
Frequently asked questions
Do I need consent to send marketing email in Singapore?
No — email is an opt-out regime under the Spam Control Act. But publishing an address does not create consent, and marketing to phone numbers requires DNC checking or express consent under the PDPA.
Is the <ADV> label still required?
Yes, for unsolicited commercial email sent in bulk. It has not been repealed. If you have consent, the message is not unsolicited and the requirement does not apply.
How quickly must I honour an unsubscribe in Singapore?
Ten business days for email under the Spam Control Act. Twenty-one days for DNC withdrawal under the PDPA. Different statutes, different clocks.
What is the penalty for spam in Singapore?
For email, there is no regulator fine — it is private civil action with statutory damages of S$25 per message up to S$1 million. PDPA breaches are regulator-enforced at up to the higher of S$1 million or 10% of Singapore turnover, where turnover exceeds S$10 million.
Does the law apply to overseas senders?
Yes. The Act attaches where the recipient accesses the message on a device in Singapore, regardless of where the sender is based.
Related reading
- Best email marketing software in Singapore — platforms and SGD billing
- Email marketing rules by country
- Australia’s Spam Act explained — where published addresses do create consent
- GDPR and email marketing
- Email list cleaning
Verified against the Spam Control Act 2007, the PDPA 2012 and PDPC guidance, September 2026. General information, not legal advice.
Bluey Email includes suppression handling and one-click unsubscribe on every plan, and bills in 128 currencies including SGD. Start free.