Is cold email legal in Singapore?
Yes, for B2B email, if you follow the Spam Control Act. The PDPA generally doesn’t require consent to email a business address for business reasons, and the Do Not Call rules don’t cover email at all. Here is what each law actually says, with links to the text.
This is a plain-language guide, not legal advice. It is written for B2B sales teams sending email from or into Singapore. For a decision that matters to your business, ask a Singapore lawyer.
The short answer
| Law | Applies to B2B cold email? | What you must do |
|---|---|---|
| Spam Control Act 2007 | Yes, when unsolicited commercial email is sent in bulk | Label with <ADV>, show accurate sender details, include a working unsubscribe and honour it |
| PDPA 2012, data protection rules | Generally not, for business contact information | Use work contact details for business purposes only |
| PDPA Do Not Call rules | No, email is not covered | Check the rules if you also call or text Singapore numbers |
The Spam Control Act
The Spam Control Act 2007 governs unsolicited commercial electronic messages, including email, that have a Singapore link.
Which emails it covers
- Commercial: the email’s primary purpose is, for example, to offer goods or services (section 3).
- Unsolicited: the recipient did not ask for it or consent to it (section 5). A cold sales email is unsolicited.
- Sent in bulk: more than 100 emails on the same or similar subject in 24 hours, more than 1,000 in 30 days, or more than 10,000 in a year (section 6).
- Singapore link: for example, the recipient is in Singapore or is an organisation that carries on business in Singapore (section 7).
The Act has no general exemption for business-to-business email. If you email Singapore companies at volume, assume it applies.
What bulk senders must do
Section 11 requires bulk senders of unsolicited commercial email to meet the Act’s Second Schedule. IMDA summarises those requirements as:
- an unsubscribe facility, with the statement in English, that stays valid for at least 30 days after the message is sent;
- removing an address within 10 business days of an unsubscribe request;
- <ADV> before the subject line;
- header information that is correct and not misleading.
Banned list-building methods
Section 9 prohibits sending email to addresses generated or obtained through a dictionary attack (guessing addresses by combining names and domains) or address-harvesting software (scraping addresses from websites).
The PDPA and business contacts
The Personal Data Protection Act 2012 defines business contact information as a person’s name, position or title, business phone, business address, business email and similar details, “not provided by the individual solely for his or her personal purposes” (section 2).
Section 4(5) says the PDPA’s main data protection parts do not apply to business contact information. PDPC’s guidelines on key concepts confirm that organisations are not required to obtain consent before collecting, using or disclosing business contact information. Their example: an organiser who received a business card at a seminar does not need consent to contact that person about future seminars.
The line is personal use. Details someone gave for a personal purpose, such as a gym membership, are not business contact information, and the normal PDPA rules apply.
Do Not Call rules
The PDPA’s Do Not Call rules (Part 9) apply to marketing messages sent to Singapore telephone numbers: voice and video calls, text messages and faxes. They also apply to messaging apps when a Singapore number is used. PDPC’s Do Not Call guidelines say a message sent to an email address is not a message to a Singapore telephone number, so cold email is outside these rules.
Even for calls and texts, messages sent to an organisation for the purposes of that organisation are excluded, which PDPC says addresses B2B marketing. The exclusion stops applying if you pitch something for the person’s own personal use.
Since 1 February 2021, Part 9A of the PDPA also bans sending messages to phone numbers obtained through dictionary attacks or harvesting software. For email, the equivalent ban is section 9 of the Spam Control Act.
Penalties
| Breach | Possible consequence |
|---|---|
| Spam Control Act, sections 9 or 11 | A civil claim by anyone who suffers loss: an injunction, damages, or statutory damages of up to S$25 per message, capped at S$1 million unless actual loss is higher (sections 13 to 15) |
| PDPA Do Not Call rules | Financial penalties of up to S$200,000 for an individual or S$1 million for an organisation |
| PDPA dictionary attacks or harvesting (phone numbers) | Up to S$200,000 for an individual; for an organisation, up to 5% of Singapore turnover if that exceeds S$20 million, otherwise S$1 million |
Checklist before you send
- The email goes to a work address, about the recipient’s business, not a personal offer.
- The subject line starts with <ADV> if the email is unsolicited and sent in bulk.
- Your name, company and a working reply address are shown accurately.
- Every email has a clear way to unsubscribe, stated in English, that keeps working for at least 30 days.
- Unsubscribes are honoured well within 10 business days.
- No addresses came from guessing tools (dictionary attacks) or scraping software (address harvesting).
- If your sequence also calls or texts Singapore mobile numbers, you have checked the Do Not Call rules.
Let an AI SDR handle the rules for you. Michael, ShiftRight’s AI SDR, sends from your own mailbox in each prospect’s working hours, stops a sequence as soon as someone replies, and writes to each buyer about their own business.
Questions
Is cold email legal in Singapore?
Yes, B2B cold email is legal in Singapore if you follow the Spam Control Act. That means, for unsolicited bulk email, an <ADV> label, accurate sender details and a working unsubscribe that you honour. The PDPA generally does not require consent to email someone’s business contact information for business purposes.
Do I need consent under the PDPA to email a work address?
Generally no. Business contact information, which includes a business email address, is excluded from the PDPA’s consent and other data protection obligations, as long as the person did not give it solely for personal purposes.
Does the Do Not Call Registry apply to email?
No. The Do Not Call rules cover calls, text messages and faxes to Singapore telephone numbers. PDPC’s guidelines say a message sent to an email address is not a message to a Singapore telephone number.
How many emails count as “bulk”?
Under section 6 of the Spam Control Act, more than 100 messages with the same or similar subject matter in 24 hours, more than 1,000 in 30 days, or more than 10,000 in a year.
What happens if I break the Spam Control Act?
It is enforced through civil claims. Someone who suffers loss can sue for an injunction, damages or statutory damages of up to S$25 per message, capped at S$1 million unless actual loss is proven to be higher.
Sources
- Spam Control Act 2007, Singapore Statutes Online (sections 1 to 7); later sections read from a reproduction of the SSO text
- Personal Data Protection Act 2012, Singapore Statutes Online; quotes read from a reproduction of the SSO text
- IMDA, best practices for organisations on unsolicited communications
- PDPC, Advisory Guidelines on Key Concepts in the PDPA
- PDPC, Advisory Guidelines on the Do Not Call Provisions
Checked 23 October 2026. The Scams Countermeasures and Other Matters Act 2026 was passed in September 2026 and amends other laws; we will update this page if it changes the rules above.