Here is the short answer. A WhatsApp chatbot is not compliant or non-compliant on its own. Compliance depends on how your business sets it up and uses it. The same tool can be run responsibly by one company and carelessly by another.
Singapore's Personal Data Protection Act (PDPA) sets a baseline standard for how organisations collect, use, disclose and care for personal data. It also set up the national Do Not Call (DNC) Registry (PDPC: PDPA Overview). Both matter when a chatbot is talking to your customers.
This guide walks through the questions to ask before you switch one on.
Does the PDPA apply to chats on WhatsApp?
Yes, where personal data is involved. A customer's name, mobile number and the details they share in a chat can all be personal data. The PDPA's data protection obligations apply when an organisation collects, uses or discloses personal data (PDPC Advisory Guidelines on Key Concepts in the PDPA).
The PDPC lists these obligations, including consent, notification, purpose limitation, protection, retention limitation, transfer limitation and data breach notification (PDPC: Data Protection Obligations).
Have you told people why you are collecting their data?
Under the Notification Obligation, you must tell individuals the purposes for which you intend to collect, use or disclose their personal data, on or before doing so. Under the Consent Obligation, you need their consent for those purposes (PDPC Advisory Guidelines on Key Concepts in the PDPA).
In practice, that means a short, clear opening message. For example: "Hi, I'm the virtual assistant for [Company]. We use your details to answer your enquiry and arrange appointments. See our privacy policy: [link]."
Meta's rules point the same way. Businesses must secure the notices, permissions and consents needed to collect and use people's information, and must maintain a published privacy policy (WhatsApp Business Messaging Policy).
Are you only collecting what you need?
The Purpose Limitation Obligation means you may only collect, use or disclose personal data for purposes a reasonable person would consider appropriate in the circumstances (PDPC Advisory Guidelines on Key Concepts in the PDPA).
So design your chatbot to ask only for what the task needs. A booking bot needs a name, a contact number and a time slot. It rarely needs a date of birth.
Be especially careful with NRIC numbers. The PDPC's guidelines say organisations are generally not allowed to collect, use or disclose NRIC numbers, except where the law requires it or where it is necessary to verify a person's identity to a high degree of accuracy (PDPC Advisory Guidelines for NRIC and Other National Identification Numbers). Meta also tells businesses not to ask people to share full payment card numbers, financial account numbers, ID card numbers or other sensitive identifiers (WhatsApp Business Messaging Policy).
Do the Do Not Call rules apply to WhatsApp messages?
They can. The PDPC's DNC guidelines state that the DNC Provisions apply to all means of sending a specified message to a Singapore telephone number. That explicitly includes data applications such as WhatsApp that use a Singapore number (PDPC Advisory Guidelines on the Do Not Call Provisions).
A "specified message" is broadly a marketing message, such as one offering or promoting goods or services. Before sending one, you generally must check the DNC Register, unless you hold clear and unambiguous consent in written or other accessible form. Your message must also identify your business and how to contact you (PDPC Advisory Guidelines on the Do Not Call Provisions).
Replying to a customer's own question is different from pushing a promotion. If your chatbot will send marketing broadcasts, plan the DNC checks and consent records first.
Does WhatsApp have its own opt-in rules?
Yes. Meta's policy says you may only contact people on WhatsApp if they have given you their number and opted in to receive messages from you. You must also honour any request to opt out (WhatsApp Business Messaging Policy).
Meta's best practices suggest getting opt-in for each category of message, such as order updates or offers, and making opt-out simple (WhatsApp Business Messaging Policy). Meeting Meta's rules does not replace the PDPA. You need to satisfy both.
Is your chatbot provider handling data on your behalf?
Probably. If a vendor processes personal data on your behalf, it may be your data intermediary. The PDPC explains that your organisation has the same PDPA obligations for data processed by a data intermediary as if you processed it yourself (PDPC Advisory Guidelines on Key Concepts in the PDPA).
Put a written contract in place. Ask where chat data is stored, who can access it, how long it is kept and how breaches are reported. If data is transferred outside Singapore, the Transfer Limitation Obligation applies (PDPC Advisory Guidelines on Key Concepts in the PDPA).
What if the chatbot uses AI?
If your chatbot uses AI to make recommendations or decisions based on personal data, the PDPC's AI guidelines say consent and notification still apply unless an exception does. Notifications should help people understand how their data is used, without being overly technical (PDPC Advisory Guidelines on Use of Personal Data in AI Recommendation and Decision Systems).
Also, keep chat logs only as long as you need them. The Retention Limitation Obligation requires you to stop retaining personal data once it no longer serves its purpose and is not needed for legal or business reasons (PDPC Advisory Guidelines on Key Concepts in the PDPA).
A quick PDPA checklist for your WhatsApp chatbot
- A clear opening message that explains purpose and links to your privacy policy
- Only the data fields the task needs, and no NRIC numbers unless legally justified
- Recorded opt-in, plus an easy opt-out
- DNC checks before any marketing message
- A written contract with your chatbot provider
- A retention schedule for chat logs
- A clear path to a human
Frequently asked questions
Is WhatsApp itself PDPA-compliant?
The PDPA places obligations on organisations that collect and use personal data. Whether your use of WhatsApp complies depends on your notices, consents, data handling and contracts.
Can my chatbot send promotions on WhatsApp?
Only with proper opt-in under Meta's policy, and after meeting the DNC requirements for marketing messages to Singapore numbers, unless an exemption applies (PDPC DNC Guidelines).
Can my chatbot ask for a customer's NRIC?
Generally no. The PDPC permits it only where required by law or where needed to verify identity to a high degree of accuracy (PDPC NRIC Guidelines).
Who is responsible if my chatbot vendor leaks data?
Your organisation keeps its PDPA obligations for data a data intermediary processes on its behalf, so choose vendors carefully and set clear contract terms (PDPC Key Concepts Guidelines).
Want a chatbot that is built with compliance in mind?
Book a free 20-minute discovery call with AAA Digital & AI Studio. We will review your use case, your consent flow and your data handling before anything goes live.
- WhatsApp: +65 8762 0006
- Email: enquiry@aaacorpsvc.com
About the author
Andrew Tan founded AAA Digital & AI Studio, part of AAA Corporate Services, a Singapore corporate services firm with a Chartered Accountant-led team. He brings a governance-first mindset to AI adoption, helping SMEs use automation without losing sight of controls and compliance.
This article is general information and is not legal advice. For advice on your specific situation, consult a qualified professional.