This is not legal advice. It is a practical checklist based on the sources listed at the end. Each item says what it rests on and whether we checked it against an official source or it reflects general understanding. For your own situation, speak to a lawyer.
In short
- Name a Data Protection Officer and publish a business contact for them.
- Follow up the enquiry the customer made. Marketing to them later is a different purpose with its own rules.
- Keep chats on a business account, not staff's personal phones, and remove access when people leave.
- Have a written agreement with any software provider that holds your customers' data, and know your breach notification deadline.
Who this is for
A small business in Singapore whose sales team receives enquiries on WhatsApp, replies, sends quotes and follows up. The Personal Data Protection Act (PDPA) applies to the names, phone numbers, addresses, photos and chat history you collect along the way.[1] The checks below are grouped so you can work through them in one sitting.
People and policies
1. Name a Data Protection Officer
Appoint at least one person to be responsible for PDPA compliance, and make a business contact for them available to the public, for example on your website. General understandingPDPA sections 11(3) and 11(5).[1]
2. Say why you collect details, and get consent for that
When someone enquires, they expect you to use their number to answer and to follow up that enquiry. Your website form, chat greeting or privacy policy should say what you use their details for. Our own forms ask people to tick a box agreeing to be contacted about their request. General understandingPDPA consent and purpose obligations.[1]
3. Publish a privacy policy that covers WhatsApp
Say that you receive messages, photos and files on WhatsApp, which providers help you (for example a CRM or chat tool), and how long you keep the data. If data goes outside Singapore, say so (see check 9). General understandingPDPA openness and transfer obligations.[1]
Following up and marketing
4. Keep follow-ups to the enquiry the customer made
Answering a customer's question, sending the quote they asked for and checking whether they want to go ahead are part of the enquiry. Adding them to a list for promotions is a different purpose, and needs its own consent. General understandingPDPA purpose limitation.[1]
5. Check the marketing rules before you send promotions
Before sending marketing messages to Singapore numbers, check the Do Not Call provisions in Part 9 of the PDPA. Before sending instant messages in bulk, check the Spam Control Act, which was amended to cover them. General understandingPDPA Part 9.[1] Spam Control Act amendment; we have not verified its exact scope.[5]
6. Let people opt out, and act on it
If a customer asks you to stop messaging them or to stop using their details, record it on their contact record and stop within a reasonable time. Tell your team, so nobody messages them again from another phone. General understandingPDPA section 16, withdrawal of consent.[1]
Keeping chats safe
7. Keep chats on a business account, not personal phones
When enquiries live on staff's personal phones, you can't control who sees them, and the history leaves with the person. A shared business inbox with individual logins lets you give and remove access by role. General understandingPDPA section 24, protection obligation.[1]
8. Set how long you keep data, and delete the rest
Decide how long you keep enquiries, chats and quotes, and delete or anonymise them after that. For example, our own policy keeps website enquiries for up to 24 months. Accounting records have their own, longer, legal periods. General understandingPDPA section 25, retention limitation.[1]
9. Put your software providers under a written agreement
A CRM, chat tool or AI provider that stores your customers' data for you is processing it on your behalf. You stay responsible for it, so have a written agreement that covers security, breach notice, sub-processors and deletion at the end. If the data is stored outside Singapore, the transfer needs legally binding protection comparable to the PDPA. CheckedPDPA sections 4(2) and 4(3), and the PDPC's guide on data protection clauses.[3] General understandingSection 26 on transfers.[1]
Breaches and AI
10. Know your breach notification deadline
If a data breach is likely to cause significant harm to the people affected, or affects 500 or more people, notify the PDPC no later than 3 calendar days after you decide it is notifiable. Where there is significant harm, also tell the people affected. CheckedPDPC, “Required to Notify”.[2]
11. If an AI replies, be open about it
Tell customers when they are chatting with an automated assistant, let your staff take over at any time, and don't let the AI make promises about price or timing that a person hasn't approved. General understandingPDPC advisory guidelines on AI systems (transparency).[4]
12. Follow WhatsApp's own rules on data and AI
Meta's terms for the WhatsApp Business Platform say WhatsApp data must not be used to train AI models, and they ban AI providers whose AI is the primary function of what they offer. Check that your chat tool's AI follows these rules. CheckedMeta Terms for WhatsApp Business Platform, §4.7.[6]
Where to start
If you do only three things this month: name your Data Protection Officer (check 1), move sales chats off personal phones (check 7), and write down your breach notification steps (check 10). Then work through the rest.
WorkLink's Team Inbox and CRM keep chats on one business account with individual logins and roles, and our Terms include Data Processing Terms. We do not use your WhatsApp conversations to train AI models. None of this replaces your own obligations under the PDPA.
Sources
Every fact in this guide comes from one of these sources, read on the date shown. Rules and prices change: check the source before you rely on it.
- [1] Personal Data Protection Act 2012 (Singapore), as amended in 2020; sections 4, 11, 16, 24, 25, 26 and Part 9 · read 21 Oct 2026 · items marked “general understanding” were not checked against the text of the Act
- [2] PDPC website: data breach notification, “Required to Notify” page · read 21 Oct 2026 · checked
- [3] PDPC: Guide on Data Protection Clauses for Agreements Relating to the Processing of Personal Data (2016) · read 21 Oct 2026 · checked, with section 4(2) and 4(3) of the Act
- [4] PDPC: Advisory Guidelines on the Use of Personal Data in AI Recommendation and Decision Systems (2024) · read 21 Oct 2026 · general understanding
- [5] Spam Control Act 2007, as amended (instant messages sent in bulk, in force 1 Feb 2021) · read 21 Oct 2026 · secondary source; exact scope not verified
- [6] Meta Terms for WhatsApp Business Platform, §4.7 · read 21 Oct 2026 · last modified 23 Sep 2026