Cold email laws
Singapore PDPA: What It Means for Cold Email
Yes. Singapore's PDPA does not apply its consent rules to business contact information. If you send in bulk, the Spam Control Act requires <ADV> in the subject, an unsubscribe address and honest headers. Anyone harmed can sue for up to SGD 25 per email, capped at SGD 1 million.
Not Legal Advice
Not legal advice. We checked this page against the law's text and the regulator's guidance on October 17, 2026; it has not been reviewed by a lawyer.
Can You Send B2B Cold Email Under Singapore's PDPA and Spam Control Act?
In short Yes: the PDPA's consent rules do not apply to business contact information, but bulk unsolicited commercial email must carry an <ADV> subject label, an unsubscribe address and accurate sender details under the Spam Control Act.
Under PDPA section 4(5), the consent, notice and access rules (Parts 3 to 6A) do not apply to business contact information: a person's name, position or title, business phone, business address, business email or business fax, unless they gave it solely for personal purposes (section 2). The PDPC says organisations do not need consent to collect, use or disclose business contact information. Personal addresses still need consent, and the PDPC says the legitimate interests exception cannot be used to send direct marketing.
The Do Not Call rules in Part 9 cover only messages to Singapore telephone numbers, not email (section 38). The Spam Control Act covers unsolicited commercial email with a Singapore link sent in bulk, meaning more than 100 messages with the same or similar subject matter in 24 hours, more than 1,000 in 30 days or more than 10,000 in a year (section 6). It has no B2B exemption.
Bulk senders must give an unsubscribe email address, start the subject with <ADV> and a space, use an accurate subject and headers, and give a working email address or phone number (Second Schedule). Sending to addresses from harvesting software or dictionary attacks is banned at any volume (section 9).
What Do You Need to Do Under Singapore's PDPA and Spam Control Act?
In short 7 rules apply to a cold email program under Singapore's PDPA and Spam Control Act.
| Requirement | What it means | How to do it | Section |
|---|---|---|---|
| Business contact information only | The PDPA's consent, notice and access duties do not apply to work contact details, unless the person gave them solely for personal purposes. | Target work addresses, and treat personal addresses as needing opt-in consent. | PDPA s 2 and 4(5) |
| No harvesting or dictionary attacks | Do not send to addresses generated by a dictionary attack or obtained with address-harvesting software, at any volume. | Do not use scrapers or pattern-guessing address generators, and log where each list came from. | Spam Control Act s 9 |
| Know the bulk threshold | Bulk means more than 100 messages with the same or similar subject matter in 24 hours, more than 1,000 in 30 days or more than 10,000 in a year. | Assume your cold email program is bulk and apply the Second Schedule. | Spam Control Act s 6(1) |
| Unsubscribe facility | Give an email address where the recipient can send an unsubscribe request, with a statement in English. | Keep the unsubscribe mailbox working for at least 30 days and stop within 10 business days. | Spam Control Act Second Schedule para 2 |
| <ADV> label and honest subject and headers | Start the subject with <ADV> and a space, and do not use a misleading subject or header. | Begin bulk subject lines with <ADV> and use real From details and domains. | Spam Control Act Second Schedule para 3(1) |
| Sender contact details | Give an accurate, working email address or phone number where the sender can be readily contacted. | Sign off with a monitored email address or phone number. | Spam Control Act Second Schedule para 3(1)(d) |
| Honor opt-outs where the PDPA applies | For personal data under the PDPA, an unsubscribe request withdraws consent and you must stop using the data for that purpose. | Keep one global suppression list. | PDPA s 16 |
What Are the Penalties Under Singapore's PDPA and Spam Control Act?
In short Maximum penalty: SGD 1 million or 10% of Singapore turnover (PDPA).
| Penalty | Maximum | In USD | Section |
|---|---|---|---|
| PDPA financial penalty, organisations with annual Singapore turnover above SGD 10 million | Up to 10% of annual turnover in Singapore | Not a fixed amount | PDPA s 48J(3) |
| PDPA financial penalty, other organisations | SGD 1,000,000 | about USD 781,700 | PDPA s 48J(3) |
| Spam Control Act statutory damages in a civil claim | SGD 1,000,000 in total (up to SGD 25 per email), unless the claimant proves a higher actual loss | about USD 781,700 | Spam Control Act s 14(3)(b) |
USD amounts are approximate, converted at the European Central Bank reference rates of 2026-10-16.
The PDPC enforces the PDPA, and anyone who suffers loss directly from a PDPA breach can sue (section 48O). No regulator enforces the Spam Control Act against senders: anyone who suffers loss or damage can sue for an injunction, damages and costs (sections 13 to 15).
What Enforcement Has There Been Under Singapore's PDPA and Spam Control Act?
In short 2 cases from regulator and court records, newest first.
We found no court judgment awarding Spam Control Act damages. These PDPC decisions concern marketing to personal contact data, which the PDPA covers.
| Date | Company | What happened | Outcome | Source |
|---|---|---|---|---|
| 2019-08-30 | Amicus Solutions Pte. Ltd. | A data broker sold lists of individuals' contact details without notice or consent, and the buyer used them for telemarketing. | SGD 48,000 penalty from the PDPC | PDPC grounds of decision |
| 2018-04-30 | Aventis School of Management Pte. Ltd. | Sent marketing emails without consent and took about a month to act on an unsubscribe request. | SGD 12,500 penalty from the PDPC | PDPC grounds of decision |
Cold Email Checklist for Singapore's PDPA and Spam Control Act
- Target work addresses, and treat personal addresses as needing opt-in consent.
- Assume your campaign counts as bulk under the Spam Control Act.
- Start every bulk subject line with <ADV> and a space.
- Include an unsubscribe email address with an English statement, keep it working for 30 days and stop within 10 business days.
- Use accurate From details and subject lines, with a working email address or phone number.
- Do not use harvesting software or pattern-guessed addresses.
- Keep a global suppression list of everyone who unsubscribed.
How Ken Helps
In short Ken Campaigns handles opt-outs, suppression and sending limits; it does not make your emails lawful, and the law stays your responsibility.
- Campaign emails must include a legally appropriate opt-out or unsubscribe mechanism unless Ken approves another lawful approach in writing, and Ken can run the unsubscribe links, reply-based opt-outs and suppression for you (Ken Terms of Service, section 7.3).
- Ken's anti-spam policy puts opt-outs, abuse complaints, spam-trap notices and hard bounces on a suppression list that applies across every domain and mailbox Ken operates, and never expires it.
- Ken tracks every bounce, unsubscribe and spam report, and every campaign rotates across several inboxes to stay under daily send limits.
- You give Ken your legal entity name and mailing address for the email footer, and Ken will not knowingly use materially false or misleading headers, sender details or subject lines (Terms, section 7.2).
- Ken's anti-spam policy bars purchased and scraped lists, and accounts found sending unsolicited bulk email are suspended (section 6).
- Ken's terms leave the legality of your offer, audience and data, and any consents and notices the law requires, with you (section 7.1). Under Singapore's rules, that includes the <ADV> label on bulk sends and consent for personal addresses.
FAQ
Is B2B cold email legal in Singapore?
Yes. The PDPA's consent rules do not apply to business contact information such as a work email (section 4(5)), but bulk unsolicited commercial email must follow the Spam Control Act's Second Schedule.
Do I need <ADV> in the subject line?
Yes, if you send in bulk: more than 100 similar messages in 24 hours, 1,000 in 30 days or 10,000 in a year (Spam Control Act section 6). The subject must start with <ADV> and a space.
Does the Do Not Call Registry apply to email?
No. Part 9 of the PDPA covers only messages to Singapore telephone numbers (section 38).
Can I email addresses found on websites?
Work addresses are business contact information outside the PDPA's consent rules, but addresses collected with harvesting software or a dictionary attack are banned under the Spam Control Act (section 9).
What if I ignore an unsubscribe?
Under the Spam Control Act you must stop within 10 business days, and anyone who suffers loss can sue for up to SGD 25 per message (section 14). Where the PDPA applies it also breaches section 16; the PDPC fined Aventis SGD 12,500 partly for this.
The new Ken opens to the waiting list in batches.
Related
- Cold email laws by country
All 12 laws compared
- Spam Act 2003 (Australia): What It Means for Cold Email
Consent first; inferred consent for published work addresses
- DPDP Act (India): What It Means for Cold Email
Consent first, once the core rules start
- CAN-SPAM Act: What It Means for Cold Email
Allowed, opt-out
- Ken anti-spam policy
Sources
Changelog
- Page published.