Is It Legal to WhatsApp Your Customers? PDPA for Singapore and Malaysia

A clinic owner in Singapore told me she had stopped following up leads on WhatsApp entirely. She had read about a company fined under the PDPA, panicked, and decided the safest thing was to send nothing. Her enquiries now got one reply and then silence — not because she didn't care, but because she was afraid the second message was illegal.

She had asked herself the right question — is it legal to WhatsApp your customers? — and arrived at exactly the wrong answer, because the question hides two completely different activities inside one sentence. One of them carries real regulatory risk. The other is the most normal thing a business does, and stopping it costs you money for no legal benefit at all.

This is not legal advice — check with the PDPC in Singapore or Malaysia's Personal Data Protection Department, or a lawyer, before you rely on anything specific. But the shape of the rules is clear enough to stop being afraid of the wrong thing.

Two activities, one question

"WhatsApping your customers" is really two jobs that the law treats very differently:

1. Broadcasting. You take a list of numbers and send the same promotional message to all of them — a sale, a new launch, a seasonal offer. This is marketing, and this is where almost all the rules, and all the fines, live.
2. Following up. Someone messaged you about a specific thing — a price, a room, a treatment, a quote. You reply, and later you continue that same conversation: "still holding the unit for you," "your quote is ready," "shall I book you in Saturday?" This is conversational, and it is a different animal.

Nearly everyone who searches "is WhatsApp marketing legal" is worried about job 2 and reads rules written for job 1. Then they stop doing the safe, profitable thing to avoid a risk that was never attached to it.

What the rules actually target

Both countries regulate marketing messages — unsolicited promotion pushed at people. Here is the honest summary, and the difference between the two markets matters.

Read that table and the pattern is obvious: it is built for bulk promotion to people who did not ask for it. A DNC registry, a consent record, an opt-out line — these are the machinery of broadcasting. None of it describes you answering a question someone put to you an hour ago.

The myth that freezes people: "they messaged me first"

Here is the part that gets misread in both directions.

"They messaged me first, so I have consent" — false. In Singapore and Malaysia alike, the fact that someone contacted you does not license you to add them to a broadcast list or push unrelated promotions at them later. Contact is not consent to market.

"They messaged me first, so I can't reply" — also false, and this is the expensive mistake. Replying to a person's own enquiry, and continuing that thread, is not a marketing broadcast. You are answering the question they asked. The clinic owner who went silent had confused these two and chosen the version that loses deals.

The line is not whether you may message them. It is what the message is. Continue their conversation: safe and expected. Blast them something they never asked for: that is when the rules wake up.

Singapore's exemption, and where it stops

Singapore gives businesses one more door: the ongoing-relationship exemption. If you have a continuing relationship with a customer, you may send them marketing about related products by text without a fresh DNC check — provided the message genuinely relates to that relationship.

But read the limits, because they are where people get caught:

• A series of one-off transactions is not an ongoing relationship. Three separate walk-in sales do not make someone a "customer" you can market to freely.
• The exemption covers the DNC check, not every obligation — you still need an opt-out, and the message must relate to the relationship.
• Any DNC check you do rely on is only valid for 30 days. A monthly campaign needs a fresh check each month.

Malaysia has no equivalent registry to exempt yourself from. There, everything rests on consent that specifically named WhatsApp and marketing when you collected it — and you must be able to prove you obtained it, not merely assert it.

Where this leaves you this week

You do not need to hire a compliance team. You need to sort your messages into the two piles.

• Replying to live enquiries and continuing those threads — do this freely, today. It is your safest and most profitable activity, and stopping it (like the clinic owner did) is the only guaranteed way to lose money here.
• Broadcasting to a list — treat this as the regulated activity it is. Collect consent that names WhatsApp and marketing, keep the record, check the DNC registry in Singapore, add an opt-out, and don't blast dormant one-off buyers as though they opted in.
• When in doubt, ask: did this person ask me about this thing? If yes, you're following up. If no, you're marketing, and the rules apply.

The quiet cost nobody fines you for

There is a penalty in all this that no regulator issues, and it is the one that actually hurts most businesses: the deals you lose by treating follow-up as if it were forbidden.

The rules exist because unsolicited broadcasting is a real nuisance and a real risk. But the reflex to "just send nothing" throws out the safe activity along with the risky one. The person who asked about your treatment on Monday and got one reply and then silence didn't need to be protected from you. They needed you to remember to continue the conversation they started.

That is the entire problem, and it is a memory problem, not a legal one. In a business running hundreds of WhatsApp threads, the enquiry that went quiet on Monday is buried under two hundred newer chats by Thursday — not blasted, not followed up, just forgotten.

Dokwise reads the WhatsApp conversations you already have and each morning tells you which live enquiries have gone quiet and are due a reply — the follow-up pile, the safe and profitable one. It does not build broadcast lists or send bulk promotions, because that was never the part that made you money. Same number, same app, no migration. You write the messages. You just stop losing the people who already raised their hand.

In short

• Is it legal to WhatsApp your customers? Yes — but separate the two activities first.
• Broadcasting is marketing: consent, DNC check (Singapore), opt-out, and real penalties in both countries.
• Following up a live enquiry is conversational, expected, and the thing you should never have stopped doing.
• "They messaged me first" is not consent to broadcast — but it is more than enough to reply.
• The biggest cost here is the silent one: deals lost to caution, not to fines.