Short answer: Before you launch a WhatsApp chatbot in Singapore, check twelve things. Tell people it is a bot and why you collect their details. Collect only what you need and avoid NRIC numbers. Record opt-in, check Do Not Call rules, sign a vendor contract, name a DPO and offer a human.
This checklist turns the PDPC’s published guidance and Meta’s WhatsApp Business Messaging Policy into practical checks. Tick every item before your chatbot talks to a real customer. For the reasoning behind each point, read our longer guide: is a WhatsApp chatbot PDPA-compliant?
1. Open with a clear notice
Tell people they are talking to a virtual assistant, what you will use their details for, and where to read your privacy policy. The PDPA’s Notification Obligation requires you to tell individuals the purposes on or before collecting their data, and Meta’s policy requires a published privacy policy.
Source: PDPC Key Concepts Guidelines WhatsApp Business Messaging Policy
2. Ask only for what the task needs
A booking bot needs a name, a contact number and a time. It rarely needs a date of birth or an address. The Purpose Limitation Obligation lets you collect, use or disclose personal data only for purposes a reasonable person would consider appropriate in the circumstances.
Source: PDPC Key Concepts Guidelines
3. Do not collect NRIC numbers or card numbers
The PDPC’s guidelines say organisations are generally not allowed to collect NRIC numbers, except where the law requires it or where it is necessary to verify identity to a high degree of accuracy. Meta also tells businesses not to ask people to share full payment card numbers, financial account numbers or personal ID card numbers.
Source: PDPC NRIC Guidelines WhatsApp Business Messaging Policy
4. Record opt-in, by type of message
Meta’s policy says you may contact people on WhatsApp only if they gave you their number and opted in to hear from you. Its best practices suggest a separate opt-in for each category of message, such as order updates or offers. Keep a record of when and how each person opted in.
Source: WhatsApp Business Messaging Policy
5. Make opting out easy, and honour it
You must respect any request to block, stop or opt out of messages, and Meta recommends giving clear instructions for opting out of specific message categories. Add a simple “stop” route in the chat and check that it works.
Source: WhatsApp Business Messaging Policy
6. Check the Do Not Call Register before marketing messages
The PDPC says the Do Not Call Provisions apply to all means of sending a specified message to a Singapore telephone number, including WhatsApp. Before a marketing message you generally must check the DNC Register, unless you hold clear and unambiguous consent, and the message must identify your business and how to contact you.
Source: PDPC DNC Guidelines
7. Use approved templates outside the 24-hour window
On the WhatsApp Business Platform you may reply to a customer without a template only within the 24-hour customer service window, which resets with each customer message. To start a conversation, or to write after the window closes, you may use only approved message templates.
Source: WhatsApp Business Messaging Policy
8. Give customers a clear path to a human
Meta lets you use automation within the 24-hour window, but you must also provide a prompt, clear and direct escalation path, such as an in-chat transfer to a human agent, a phone number, an email address, a support form or web support.
Source: WhatsApp Business Messaging Policy
9. Sign a written contract with your chatbot provider
If a vendor processes personal data for you, it may be your data intermediary, and you keep the same PDPA obligations for that data as if you handled it yourself. Ask where chat data is stored, who can access it, how long it is kept and how breaches are reported. The Transfer Limitation Obligation applies if data leaves Singapore.
Source: PDPC Key Concepts Guidelines
10. Set a retention schedule for chat logs
The Retention Limitation Obligation requires you to stop keeping personal data once it no longer serves the purpose it was collected for and is not needed for legal or business reasons. Decide how long chat logs are kept, and delete or anonymise them when the time is up.
Source: PDPC Key Concepts Guidelines
11. Appoint a DPO and publish the contact details
Every organisation must designate at least one data protection officer and make that person’s business contact information available to the public, for example on your website. Check that your chatbot’s opening message or privacy policy points people to it.
Source: PDPC Data Protection Obligations PDPC: Getting started as a DPO
12. Have a data breach plan
A breach is notifiable if it is likely to cause significant harm or affects 500 or more people. You must notify the PDPC no later than three calendar days after you determine it is notifiable.
Source: PDPC: Report your organisation’s data breach
Quick tick-list
- Open with a clear notice
- Ask only for what the task needs
- Do not collect NRIC numbers or card numbers
- Record opt-in, by type of message
- Make opting out easy, and honour it
- Check the Do Not Call Register before marketing messages
- Use approved templates outside the 24-hour window
- Give customers a clear path to a human
- Sign a written contract with your chatbot provider
- Set a retention schedule for chat logs
- Appoint a DPO and publish the contact details
- Have a data breach plan
Frequently asked questions
Do I need a checklist if my chatbot only answers questions?
Yes, because even a simple chat can collect a name and mobile number, and those are personal data. A question-only bot has fewer duties than one sending promotions, but you still need a clear notice, a minimal data approach, a retention plan and a path to a human.
Can my chatbot send promotions on WhatsApp?
Only with the right permissions. Meta requires opt-in before you contact people, and the PDPC’s Do Not Call Provisions apply to marketing messages sent to Singapore numbers, including on WhatsApp. Plan opt-in records and DNC checks before you send any promotion.
Can a WhatsApp chatbot ask for a customer’s NRIC?
Generally no. The PDPC allows NRIC numbers to be collected only where the law requires it or where it is necessary to verify identity to a high degree of accuracy. Design the chatbot to ask for a name and contact number instead.
Who is responsible if my chatbot provider loses data?
You remain responsible. Under the PDPA, your organisation has the same obligations for data processed by a data intermediary on its behalf as if it processed the data itself. That is why a written contract and clear security terms matter.
Is this checklist legal advice?
No. It is general information based on the PDPC’s and Meta’s published guidance, which can change. For advice on your specific situation, consult a qualified professional.
Want a chatbot built with these checks in mind?
Book a free 20-minute discovery call with AAA Digital & AI Studio. We will go through your use case, your consent flow and your data handling before anything goes live.
- WhatsApp: +65 8762 0006
- Call: +65 8762 0006
- Email: enquiry@aaacorpsvc.com
This checklist is general information and is not legal advice. Guidance from the PDPC and Meta can change. For advice on your specific situation, consult a qualified professional.