WhatsApp automation in Singapore: what you may automate, and what the rules say

Updated 31 October 2026. This is general information, not legal advice. For your own case, check PDPC's guidance or ask your lawyer.

The short answer: WhatsApp automation in Singapore is lowest-risk for one job first: replying to someone who messaged you. PDPC says a message sent only to answer a person's request for information is generally not a marketing message. A later promotion is different. It falls under the Do Not Call rules, which PDPC says cover WhatsApp, and under WhatsApp's own opt-in rule. So the line to draw is between answering and marketing, not between a bot and a person.

If you are here because WhatsApp enquiries sit unanswered for hours, you are not alone. "Agents not responding to my inquiries" is the title of a whole thread on r/askSingapore. Automation fixes the slow reply. It can also create a new problem if the same system starts sending promotions to people who never asked. This guide separates the two, using only the rule books themselves.

Three rule books apply to one WhatsApp message

A single WhatsApp message from your business can be read against three sets of rules at once.

1. The Do Not Call (DNC) Provisions of the PDPA. These cover marketing messages ("specified messages") sent to a Singapore telephone number. PDPC sets out how it reads them in its DNC advisory guidelines (last revised 1 February 2021) and its guide for organisations.
2. The Spam Control Act 2007. Its long title describes spam as "unsolicited commercial communications sent in bulk by email or by text or multimedia messaging to mobile telephone numbers" (Spam Control Act 2007). A message is unsolicited when the recipient did not request it or consent to it. So the Act is about unsolicited commercial messages sent in bulk, and a reply to a customer's own request is a different thing. Its current bulk test is "more than 100 electronic messages containing the same or similar subject matter during a 24-hour period", more than 1,000 in 30 days, or more than 10,000 in a year; the Minister can change these numbers by order. Section 4A adds that a message to an instant messaging account counts as sent to that account, not to the phone number or email address the account is named after. The text we read does not name WhatsApp, so whether a WhatsApp broadcast falls inside the Act is a question for your lawyer.
3. WhatsApp's own Business Messaging Policy. This is not law, but WhatsApp says that if you break its terms or policies, it "may limit or remove your access" to its services. The version we read was "Last updated: September 23, 2026" (WhatsApp Business Messaging Policy).

A message can pass one set of rules and fail another. A WhatsApp-approved template, for example, says nothing about whether you have DNC consent. WhatsApp itself leaves the choice of opt-in method, and compliance with the law, to the business.

Replying to an enquiry: what PDPC says

This is the part most businesses can automate first, and it is the part the rules are kindest to. PDPC's guidelines state:

"Generally speaking, a person who sends a message to a Singapore telephone number for the sole purpose of responding to a request from an individual for information about a good or service would not be considered to be sending a specified message." (PDPC, 2021)

In plain words: if a customer asks "how much for a 4-room package?" and your system sends the price list, opening hours and a booking link, that reply is answering a request. It is generally not marketing under the DNC rules.

The key words are "sole purpose". A reply that answers the question and then adds "and here is our Deepavali promotion" has a second purpose. Keep automated replies to what the person asked.

The other PDPA duties still apply to the data you collect in the chat: why you collect it, how you protect it, how long you keep it. WhatsApp's policy also makes the business responsible for the notices, permissions and consents it needs, and that includes a published privacy policy. If your website has no privacy policy, publish one before you connect a chatbot to your site.

Marketing on WhatsApp: the Do Not Call rules

Does the Do Not Call Registry apply to WhatsApp?

Yes. Some answers online call this unsettled, or say WhatsApp is only covered by "general principles". PDPC's own guidelines are direct:

The DNC Provisions "apply equally to all means by which a sender may send a specified message to a Singapore telephone number", including "any data applications (such as 'Whatsapp', 'iMessage' or 'Viber') which use a Singapore telephone number". (PDPC, 2021)

So before you send a promotion to a Singapore number, the guidelines say you must check it against the DNC Registry, unless you hold "clear and unambiguous consent" that is "evidenced in written or other form so as to be accessible for subsequent reference". The registry is split into three: a No Text Message Register, a No Voice Call Register and a No Fax Message Register. PDPC runs an e-service to check numbers against the registry.

Two time limits matter for an automated system:

• A DNC check result is good for 21 days. PDPC sets this "prescribed duration" at 21 days.
• When someone withdraws consent, you have 21 days to act on it. PDPC calls this the "prescribed period".

If you send commercial messages in bulk, and the Spam Control Act reaches your WhatsApp messages (your lawyer should confirm), it adds its own deadline for people who had agreed to receive them. Once such a person submits an unsubscribe request, the Act stops treating them as having agreed to messages sent more than 10 business days later (Spam Control Act 2007). An automated opt-out that takes effect at once is the safest way to meet them.

If a customer messaged first, can I send promotions later?

Not on the strength of the enquiry alone. The enquiry lets you answer the enquiry. A promotion next month is a new message with a new purpose.

PDPC does exclude some messages from the DNC rules. One applies "while the sender is in an ongoing relationship with the recipient", and only for a message sent solely for a purpose that "relates to the subject matter of the ongoing relationship". Another is a message whose sole purpose is market research. These are narrow. In our reading, an enquiry that never became a sale is a weak basis for calling something an ongoing relationship. Read the guidelines or ask your lawyer before you lean on an exclusion.

Can I send a message asking for consent?

This is the trap. It seems polite to send "Would you like to receive our offers?" PDPC can treat that as marketing too:

"a message sent to a Singapore telephone number where the purpose, or one of the purposes, is to obtain clear and unambiguous consent for the sending of specified messages, would be considered a specified message." (PDPC, 2021)

So a consent request sent to a number on the registry can need the same DNC check first.

The cleaner way is to ask inside a conversation the customer started, or on your website form, with a box they tick. PDPC says consent needs "some form of positive action", and is unlikely to come "from a mere failure to opt out".

WhatsApp's own rules: opt-in, templates, 24-hour window

Even when you meet the law, WhatsApp has its own rules. The opt-in rule applies to every business on WhatsApp:

"You may only contact people on WhatsApp if: (a) they have given you their mobile phone number or username; and (b) you have received opt-in permission from the recipient confirming that they wish to receive subsequent messages or calls from you." (WhatsApp Business Messaging Policy)

Note the two parts. A number you collected is not enough. You also need the person's permission to receive "subsequent messages". The policy also makes you honour every request to block you or stop your messages, whether the person asks inside WhatsApp or elsewhere. An opt-out given by phone or email counts too.

If you use the WhatsApp Business Platform, three more rules apply:

• Message templates. Any conversation you start has to use a Message Template that WhatsApp has approved.
• The 24-hour customer service window. Each message from the customer opens the window, or starts it again. Inside it you can reply freely; outside it, only approved templates are allowed.
• A way to reach a person. Automated replies are allowed inside the window, as long as the customer has a prompt, clear and direct way to escalate. The policy lists in-chat transfer to a human agent, a phone number, email, web support, an in-store visit or a support form.

That last rule is easy to miss. A chatbot that loops forever with no way to reach a person breaks WhatsApp's policy, whatever the law says.

Which rule applies to which message

What to automate, and what to keep with a person

This is our working practice from building enquiry systems, not legal advice. We would automate:

• the first reply, sent at once, with the answers people ask for most;
• routing: which staff member or branch gets the chat;
• collecting the basics you need to quote (size of job, location, date);
• a clear "talk to a person" option in every flow, as WhatsApp requires;
• the opt-out: one word, acted on at once, and logged;
• a record of every opt-in: the number, the words they agreed to, the date and the channel.

We would keep a person on:

• anything that sells: discounts, upgrades, package changes;
• anything that promises: dates, prices outside your published list, warranties;
• complaints and refunds;
• any reply where the customer seems unsure who they are talking to.

That last point matters more than it looks. In one HardwareZone thread, a user who got an unexpected WhatsApp survey request from a company's marketing team asked other members: "Scam or Legit ah?" It shows how some people react to messages they did not expect. An unexpected automated message can read like a scam, even when it is real.

You may not need a system at all. A small team can start with the WhatsApp Business app's greeting and away messages, or keep replying by hand if volume is low. Other WhatsApp providers can build the flows above, and the same rules apply to all of them. Before any marketing campaign, read PDPC's guide or ask your lawyer.

If your site sends every enquiry to WhatsApp, read what happens when WhatsApp is your only contact option and how Singapore websites route enquiries.

A checklist before you switch on WhatsApp automation

1. Write down which messages your system will send. Mark each one "answer" or "marketing".
2. Keep every automated answer to what the customer asked. No offers added on.
3. For marketing, decide your basis: DNC check (good for 21 days) or consent in a form you can show later.
4. Collect consent by a positive action, such as a ticked box or a typed "yes". Silence is not consent.
5. Do not send consent requests to numbers you have not checked against the registry.
6. Get WhatsApp opt-in for "subsequent messages", separate from the number itself.
7. On the Business Platform, use approved templates outside the 24-hour window.
8. Put a route to a person in every flow.
9. Make opt-out one step, act on it at once, and honour opt-outs given off WhatsApp too.
10. Identify your business in marketing messages so people can tell who sent them.
11. Count your bulk marketing sends: more than 100 unsolicited commercial messages with similar content in 24 hours is the current bulk test in the Spam Control Act, if the Act reaches WhatsApp (ask your lawyer). Answers to customers' own requests are a different thing.
12. Publish a privacy policy and keep the opt-in log.

What we build for clients

SingRank sells AI automation and software work, so this section is about our own service. It is short on purpose.

Before automating replies, we measure where enquiries come from. Every client gets a live app that records each WhatsApp tap and form on their site, with the date, the time and where the person came from (SingRank). For one commercial vehicle client in Singapore, that app showed "975 enquiries tracked so far" (screenshots taken 29 October 2026). In that app, an enquiry is a WhatsApp tap or a form sent on the client's website. The tracking runs on SingRank Pixel, which records WhatsApp-button clicks and form submissions.

For chatbots and links between forms, spreadsheets and your CRM, see our AI automation and software page. Automation and software are priced by quote once we see the scope. We do not promise more enquiries, and we do not give legal advice.

Want a second opinion on your WhatsApp set-up? Send us a WhatsApp with how enquiries reach you today. We will tell you what we would automate and what we would leave with your staff. Any build is quoted per job. You can also see all SingRank services.

FAQ

Is a WhatsApp chatbot legal in Singapore?

None of these rules bans using automation to answer customers. PDPC's guidelines say a message sent only to answer a person's request for information is generally not a marketing message under the Do Not Call rules. WhatsApp allows automation inside the 24-hour customer service window, as long as there is a prompt, clear and direct way to reach a person. Marketing messages bring in the DNC and opt-in rules. This is not legal advice; check PDPC's guidance or your lawyer.

Does WhatsApp template approval mean I have consent?

No. Template approval is a WhatsApp process under its own terms and policies. It is not consent from the customer, and it is not a DNC check. WhatsApp's policy leaves the opt-in method, and meeting the law, to the business. Under PDPC's rules you still need a DNC check, or clear consent you can show later, before sending marketing to a Singapore number.

How many automated follow-ups can I send?

None of the rule books gives a safe number. What they give is a test. PDPC asks whether the message's sole purpose is answering the customer's request. WhatsApp's Business Platform needs an approved template once 24 hours pass after the customer's last message. If the Spam Control Act reaches WhatsApp (ask your lawyer), it covers unsolicited commercial messages sent in bulk, currently counted from more than 100 similar messages in 24 hours; a reply to a customer's own request is not that. Stop at once when someone opts out.