AI Sales Outreach and the PDPA: Consent, DNC and the Pre-Send Gate

AI sales outreach in Singapore is legal when each message clears the rules that apply to it at the moment of sending. Three rule sets apply: the PDPA's consent and purpose rules, its Do Not Call (DNC) rules, which need a register result under 21 days old for phone channels, and the Spam Control Act for bulk email and texts. Some business-to-business messages escape one or two, so the answer is per message. An agent's speed turns one stale record into thousands of bad sends in an afternoon. The fix for sales leaders and CTOs: a pre-send gate the agent must call before every message, keeping the evidence it produces.

On 20 July 2026, PDPC's Advisory Guidelines on Use of Personal Data in Generative AI used an agentic sales assistant to illustrate its expected safeguards, and said deployers "bear primary responsibility for ensuring that the Generative AI Systems they have chosen to use can meet their obligations under the PDPA."

What does Singapore law require before an AI agent sends a sales message?

Singapore regulates an AI agent's sales message under three rule sets, each asking a different question. The PDPA's data protection rules ask whether you may use this person's data for this purpose. The PDPA's Do Not Call rules ask whether this phone number was clear of the register when you sent. The Spam Control Act asks whether bulk commercial email or texts carry the required labels and opt-outs.

This is general information, not legal advice.

The data protection layer is the familiar one. Section 13 of the Personal Data Protection Act 2012 bars using personal data without consent or a legal exception, and section 18 limits use to purposes "that a reasonable person would consider appropriate in the circumstances" that the person was told about. Bought lists do not stretch to new purposes.

The DNC layer (Part 9 of the same Act) is more mechanical. Section 43(1) says a person "must not send a specified message addressed to a Singapore telephone number unless the person has, at the time the person sends the specified message, valid confirmation that the Singapore telephone number is not listed in the relevant register." A specified message is one where at least one purpose is promotional, judged even on what its links lead to (section 37). The Eighth Schedule carves out some messages, such as transactional ones and messages solely about an ongoing relationship with the recipient.

The DNC Regulations as amended in 2021 make a register result valid for 21 days from receipt. The other route past the register check is consent that is "clear and unambiguous" and "evidenced in written or other form so as to be accessible for subsequent reference" (section 43(4)).

The Spam Control Act 2007 covers unsolicited commercial email and texts sent in bulk: under section 6, more than 100 messages with the same or similar subject matter in 24 hours, 1,000 in 30 days or 10,000 in a year. Above that line, each message needs a working unsubscribe facility, the letters "<ADV>" in the subject field before the title, and honest headers. Unsubscribes must take effect within 10 business days.

Count the clocks: 21 days for DNC results and for acting on DNC withdrawals, 10 business days for email unsubscribes. A withdrawal of PDPA consent has no grace period: section 16(4) says you must cease, and cause your agents to cease. Wire the shortest clock into the send path.

Why is "B2B outreach is exempt" only partly true?

"B2B is exempt" is true for one of the three rule sets, partly true for the second and false for the third. Genuine business contact information is outside the PDPA's consent rules. Messages to an organisation for its own purposes are outside the DNC check. The Spam Control Act has no business exclusion in its bulk-message rules, so bulk cold email to work addresses still needs the label.

Start with the data protection rules. Section 4(5) of the PDPA switches them off for business contact information: work contact details "not provided by the individual solely for his or her personal purposes." PDPC's Advisory Guidelines on Key Concepts (revised 29 April 2026) say the definition "is dependent on the purpose for which such contact information may be provided." A business card dropped in a seminar bowl qualifies; the same card handed over to join a gym does not.

Our reading, which no PDPC example addresses: a director's personal mobile that an enrichment service pulls from a consumer data source is probably not business contact information. Your agent cannot tell unless provenance travels with the record. Either way the DNC duty applies, because section 4(5) does not switch off Part 9.

The DNC exclusion is narrower. Paragraph 1(1)(g) of the PDPA's Eighth Schedule excludes "any message sent to an organisation other than an individual acting in a personal or domestic capacity, for any purpose of the receiving organisation." PDPC's Advisory Guidelines on the Do Not Call Provisions (revised 1 February 2021) give the test case: a salesperson pitching a childcare company's HR manager on her business number is fine, until he asks whether she has children and pitches something for her own use. Then the DNC rules apply.

Generative agents drift. A model told to "build rapport" will pivot from the company's budget to the buyer's weekend, and that pivot is a specified message to an individual. So the gate classifies the purpose of each drafted message, not of the campaign.

What changes when an agent does the outreach?

An agent changes the arithmetic of outreach compliance, not the rules. Every DNC duty applies per message, so an agent sending ten times the volume multiplies any defect by ten. It also enriches and remembers prospects, which can move records from business contact information into personal data.

PDPC's July 2023 decision on Wee Jing Kai Leon (2023 SGPDPC 8) shows the human-scale baseline. A property salesperson held 2,918 numbers, 1,224 of them on the No Text Message Register. Sending one SMS a month from November 2022 to March 2023, he sent about 6,120 messages to registered numbers without valid confirmation. PDPC found a negligent breach of section 43(1) and issued a warning, crediting his cooperation, registered sender ID and unsubscribe option.

An agent with a messaging API could send that many in an afternoon, and Leon shows the floor, not the ceiling. Section 48J(4) of the PDPA allows up to S$1 million for an organisation and S$200,000 for an individual for an intentional or negligent Part 9 breach. The dictionary-attack ban in section 48B has its own cap, reaching 5% of Singapore turnover above S$20 million.

The data protection cap differs only for larger firms (10% of Singapore turnover above S$10 million; see our PDPA liability analysis). The Spam Control Act sits outside this machinery: its remedy is a court claim by anyone who suffered loss. For Part 9, section 48J(6) tells PDPC to weigh whether the organisation "had, despite the non-compliance, implemented adequate and appropriate measures for compliance." A per-message gate log answers that question.

Enrichment brings a quieter risk. Part 9A of the PDPA bans sending any message, commercial or not, to phone numbers produced by a dictionary attack (automated permutations) or address-harvesting software. PDPC's guidelines say adding 1 to a customer's number and calling the result is a dictionary attack even after a clean DNC check. For email, the Spam Control Act covers addresses generated "by combining names, letters, numbers, punctuation marks or symbols into numerous permutations." On a plain reading, an "email finder" cycling firstname.lastname patterns until one does not bounce sits uncomfortably close. We have found no ruling on it. We would not let an agent do it.

The generative AI guidelines add the deployer's view. Paragraph 9.3 lists "agent or tool activity data" among the data deployers must safeguard, and the paragraph 9.5 sales-assistant example adds "escalating protocols to humans for complex or high-risk tasks." That example concerns data access, not DNC checks, and the guidelines are not legally binding. We read them as a signal of how PDPC views agentic deployments (our breakdown of the guidelines).

What it means by role:

• CTO or technical lead: compliance logic lives in the send path as tested code, not in the agent's instructions. Prompts drift. Gates fail closed.
• MD or owner: a vendor's "PDPA-compliant" badge does not move the duty. Section 37(3) deems a business that authorises others to promote its goods to have authorised their messages, unless it took reasonable steps to stop them (section 37(4)). A gate you control is a step you can point to.
• Compliance lead: ask for evidence per message. If nobody can produce the DNC result date for a message sent last Tuesday, the control does not exist.

Which controls should the agent call before every send?

A pre-send gate is a service the agent's send tool must call, returning pass, hold or block for one message to one contact. It runs five checks in a fixed order, including a DNC result under 21 days old, then writes the evidence. Any failed check holds the message for a person. Nothing is retried blind.

Order matters. Identity runs first because one person can be a business contact on email and a private individual on WhatsApp. Suppression runs after consent so an opt-out on one channel stops every channel.

Each legal obligation maps to a control the agent calls and to evidence you keep (general information, not legal advice on your facts):

Illustrative example: an agent runs a three-touch WhatsApp sequence to 5,000 Singapore mobiles, with touches on days 1, 12 and 26. The team ran the DNC check once, on day 0. Say 1,500 contacts gave evidenced consent. Days 1 and 12 are fine. On day 26 the results are 26 days old, so 3,500 follow-ups go out without valid confirmation to a list the team calls "DNC-cleaned". A gate comparing result date with send time would have held them. A DNC check run when the list was built is not valid confirmation for a message sent 22 days later. Validate at send time.

Two design choices, ours rather than the statute's, separate a working gate from a decorative one. It fails closed: if the register service or consent store is unreachable, the answer is hold. And every messaging and email vendor sits behind it, or one forgotten integration becomes the whole compliance programme.

WhatsApp, SMS, email or AI voice: what differs by channel?

The channel decides which of the three rule sets bite. WhatsApp and SMS to a Singapore number fall under the DNC rules. AI voice calls do too, because the PDPA counts a synthetic voice as a voice call. Email sits outside the DNC register but inside the Spam Control Act once volumes cross its bulk thresholds.

Per channel, the gate runs these register and spam checks. PDPA consent and purpose rules apply on every row unless the detail is genuine business contact information:

PDPC's DNC guidelines say the rules "apply equally to all means by which a sender may send a specified message to a Singapore telephone number," naming WhatsApp among others. Section 36 of the PDPA defines a voice call to include "a call that involves a recorded or synthetic voice," so an AI voice agent's marketing call is a voice call under Part 9. The WhatsApp row rests on the Spam Control Act treating an instant messaging account as an electronic address; paragraph 3(3) of its Second Schedule lifts the labelling rules for those accounts.

Our reading, not tested by any ruling we found: a personalised email still counts towards the bulk thresholds when it is the same pitch rewritten. Section 6(1) counts messages with "the same or similar subject matter", not identical wording, and only unsolicited commercial messages count.

In the US, the FCC's Declaratory Ruling FCC-24-17, adopted 2 February 2024 and released 8 February, confirmed that the US robocall law's limits on "artificial or prerecorded voice" cover AI-generated voices, which need the called party's prior express consent. One ruling is not a full US rulebook, so route numbers by country inside the gate.

Where Origin Pi stands

The agent is the wrong place for compliance. A model can be told the 21-day rule and still send on day 26, because instructions are suggestions to a model and the register is a fact about a number. The rule belongs in the send path.

We build the agent-ready layer that sits between a sales agent and every messaging channel: a gate the send tool must call, bounded permissions so the agent cannot reach a vendor directly, and an audit trail that records, per message, the DNC result date and the consent behind it. When a check fails, the gate routes the message to a person through a confirm step instead of guessing. It is the pattern behind what to automate and what to gate in an agentic SDR and our sales automation work.

Your first step: pull ten messages your outreach tools sent last week and, for each, try to produce the DNC result date and the consent record behind it. If you cannot do that in an hour, put a hold on automated phone-based sends until the gate exists.