PDPA and AI voicebots: what Singapore businesses must know
AI voicebots are legal in Singapore. The PDPA doesn't care whether a human or an AI makes the call — it cares how you handle personal data, and whether marketing calls respect the Do Not Call (DNC) registry. Service calls to your own customers (reminders, confirmations, order updates) sit in a different, easier category than promotional calls. Get four things right — DNC handling, consent & notification, recording disclosure, and vendor security — and you're on solid ground.
This guide is practical orientation, not legal advice. For rulings on your specific call flows, consult counsel or the PDPC's published guidance.
1. The DNC registry — the rule that actually bites
The PDPA's Do Not Call provisions cover "specified messages" — calls and messages whose purpose is to advertise or promote goods, services, land, or business opportunities. Before making that kind of call to a Singapore number, you must either check the number against the DNC registry (results are valid for a limited period) or hold the recipient's clear consent.
What most SMBs miss is the flip side: purely service or transactional calls generally aren't specified messages. That includes:
- Appointment reminders and no-show reduction calls
- Delivery confirmations and order-status updates
- Payment-due reminders on existing obligations
- Post-service follow-ups without promotional content
The trap: mixing purposes. A delivery confirmation that ends with "…and would you like to hear about our new package?" can turn a service call into a specified message. Keep flows single-purpose, and run DNC checks on anything promotional.
2. Consent and notification
Under the PDPA you need to notify individuals of the purposes for which you collect, use, and disclose their personal data, and obtain consent — or rely on a recognised basis. In voicebot terms:
- Existing customers: calling them about their own order, booking, or account is squarely within the purposes they'd reasonably expect. Keep your privacy notice current so it says so.
- New numbers: if a lead fills in your form, tell them a call may follow — one line on the form does it.
- During the call: the bot should identify the business, and — our standing recommendation — identify itself as an AI assistant. Singapore's Model AI Governance Framework points the same direction on disclosure.
3. Call recording
If you record calls (most deployments do, for quality and dispute resolution), disclose it — the familiar "this call may be recorded" line, delivered by the bot at the start. Store recordings with the same care as any personal data: limited retention, access controls, and deletion when the purpose is served.
4. Your vendor's security is your problem
The PDPA's protection obligation follows the data — outsourcing the call doesn't outsource the responsibility. Ask any voicebot vendor:
- Where is call data stored and for how long?
- What certifications back their claims? (The voice platform behind Omni.io is SOC 2 and ISO 27001 certified, and our deployments are structured for PDPA compliance.)
- Can retention and deletion match your policy, not just theirs?
- Is data used to train models beyond your deployment?
The 6-point compliance checklist
| # | Check | Applies to |
|---|---|---|
| 1 | Classify every call flow: service vs marketing | All deployments |
| 2 | DNC registry check or clear consent | Marketing calls only |
| 3 | Purpose notification in privacy policy + forms | All deployments |
| 4 | Bot identifies the business (and itself as AI) | All calls |
| 5 | Recording disclosure at call start | Recorded calls |
| 6 | Vendor security review: storage, retention, certifications | All deployments |
FAQ
Are AI voicebots legal in Singapore?
Yes — no rule prohibits AI making or answering calls. The obligations are the same data-protection and DNC rules that bind human callers.
Do I have to say it's an AI?
It's not an explicit PDPA requirement, but it's best practice, aligns with Singapore's AI governance guidance, and in our experience improves rather than hurts completion rates. Every Omni.io bot introduces itself as an assistant.
Who handles all this in an Omni.io deployment?
We build it into the call flows: recording disclosures, single-purpose scripts, DNC-aware campaign logic for promotional work, and data-retention settings — reviewed with you during setup.