Loyalty Programs and the PDPA: What Customer Data You Can Collect in Singapore
By Alva Chew · Updated
In short Under Singapore's Personal Data Protection Act, a loyalty program can collect the data a reasonable person would see as appropriate for running it, and you must tell members why you collect it. A points program needs very little, usually a name or email and a purchase record. PDPC's guidelines (revised 29 April 2026) also require you to stop retaining data once it is no longer needed.
What does the PDPA say about a loyalty program?
The PDPA does not have a section for loyalty programs. It sets ten obligations that apply whenever an organisation collects, uses or discloses personal data, and a points program triggers them the moment a customer gives you a name, email or phone number.
PDPC’s Advisory Guidelines on Key Concepts in the PDPA (issued 2013, revised 29 April 2026) list the ten. The ones that shape a loyalty program most are below.
| Obligation | PDPA section | What it asks of you |
|---|---|---|
| Consent | 13 to 17 | Get consent before collecting, using or disclosing personal data for a purpose |
| Purpose Limitation | 18 | Collect only for purposes a reasonable person would consider appropriate, and notified where applicable |
| Notification | 20 | Tell the individual the purposes on or before collection |
| Access and Correction | 21, 22, 22A | On request, give a member their data and fix errors |
| Protection | 24 | Make reasonable security arrangements |
| Retention Limitation | 25 | Stop retaining data once the purpose and any legal or business need end |
| Data Breach Notification | 26A to 26E | Assess a breach and notify where it is notifiable |
| Accountability | 11 and 12 | Have policies and make information about them public |
Source: PDPC, Advisory Guidelines on Key Concepts in the PDPA, revised 29 April 2026, Part III. The other two obligations, Accuracy (section 23) and Transfer Limitation (section 26), are in the same list. We could not open the Act itself on sso.agc.gov.sg from our tools, so section numbers here are as PDPC cites them.
What customer data can you collect?
The PDPA does not publish a list of permitted fields. It sets a test. Under section 18, you may collect personal data only for purposes that a reasonable person would consider appropriate in the circumstances. PDPC describes a reasonable person as someone who exercises appropriate care and judgement, judged on an objective standard. It suggests viewing the situation from the individual’s side and asking what they would think is fair.
Apply that to a points program. The purpose is to credit points for purchases and let the member redeem them. Data that serves that purpose is easy to defend:
- An email address or phone number to identify the member and let them sign in
- A name, if staff greet members by name
- The date, amount and outlet of each purchase, so points can be credited
- The points balance and redemption history
Data that does not serve the purpose needs a separate reason. A birth date, home address, marital status or income has no role in crediting points. If you want it, you need a stated purpose and the customer’s consent for it, and you should ask whether the answer would change anything you do. A field you never use is a liability you hold for no benefit.
PDPC also notes that you need not describe every activity. The retailer in its example only needs to state the objective, such as delivering the products bought, and does not need to explain how records are stored internally. For a loyalty program, state the objective plainly: “to record your purchases, add points and let you redeem them.”
How does consent work when a customer scans a QR code?
PDPC recognises deemed consent by conduct. Where an individual voluntarily provides personal data, section 15(1) treats consent as given by the act of providing it. The purposes are limited to those that are objectively obvious and reasonably appropriate from the surrounding circumstances.
A customer who scans your QR code and types an email to join a points program has made the purpose obvious. Crediting and redeeming points is covered. Using that email for a purpose the customer would not expect, such as passing it to another business, is not. For anything beyond the obvious purpose, say it on the sign-up screen and let the customer choose.
Section 14(2) sets the limit on bundling. You must not require consent to collection, use or disclosure of data beyond what is reasonable to provide the service as a condition of providing it. PDPC adds that consent obtained this way is not valid under section 14(3). You may still ask for broader consent, provided joining does not depend on it. In practice, a marketing tick box should be separate and unticked.
What if a customer says “stop”?
You must allow and facilitate withdrawal of consent on reasonable notice. PDPC does not fix a deadline but says that, as a rule of thumb, at least ten business days from the day you receive the notice would be considered reasonable. If you need longer, it is good practice to tell the person when the withdrawal will take effect.
PDPC advises having a clear, easy-to-find withdrawal policy that says how to submit a notice and to whom. For a small shop this can be one line on the sign-up page and in the member’s email: where to write, and what you will do. If the member asks to withdraw from the whole program, you will usually need to close the account and stop holding the data, subject to the retention rules below.
PDPC also covers deemed consent by notification. If you add a new purpose for existing members, you can notify them and give a reasonable opt-out period. PDPC’s own examples use 10 days for a hotel membership and 14 days for a bank, and say the period must suit the channel and the data. Members must still be able to withdraw after the period ends. Do not treat these examples as a legal minimum.
How long can you keep member data?
Section 25 says to stop retaining documents containing personal data, or remove the means of linking them to individuals, as soon as it is reasonable to assume two things. The purpose for collection is no longer served by keeping it, and retention is no longer necessary for legal or business purposes.
PDPC does not set a number of years for loyalty data. You decide one and record it. A common approach is to define when a member counts as inactive, such as no purchase for a set number of months, and what you do then. How this interacts with a points balance is covered in our guide to points expiry. If points expire, a clear schedule also gives you a clear point at which to delete or anonymise the account.
What must you do if the member list leaks?
Under the Data Breach Notification Obligation you must assess whether a breach is notifiable. PDPC’s guidelines say a breach is of significant scale when it involves the personal data of 500 or more individuals, and you must then notify the Commission. A smaller breach must also be notified if it is likely to result in significant harm to the affected individuals.
PDPC’s own worked example is relevant: an online retailer’s customer database, holding names, membership numbers, contact information and loyalty point balances for 700 customers, is breached. The retailer proceeds to notify the Commission.
| Breach detail | PDPC guidance |
|---|---|
| 500 or more individuals affected | Notify the Commission |
| Fewer than 500, likely significant harm | Notify |
| Exact number unknown at the start | Use an estimate from a preliminary assessment and update later |
Source: PDPC, Advisory Guidelines on Key Concepts in the PDPA, revised 29 April 2026, Chapter 20.
The Protection Obligation (section 24) is what you do beforehand: reasonable security arrangements against unauthorised access, copying, disclosure or loss. For a small shop that means choosing a system where staff sign in individually, not keeping member lists in a shared spreadsheet or photo of a paper card.
What about promotional texts and calls?
Sending marketing to Singapore phone numbers is governed by the Do Not Call provisions, which sit in Parts 9 and 9A of the PDPA, separate from the data protection obligations above. They set up three registers covering calls, text messages and faxes. PDPC refers organisations to its separate Advisory Guidelines on the Do Not Call Provisions, which we have not reviewed for this page. If you plan to text members, read those first.
Which program design keeps your PDPA workload small?
Collect less. A points program works on an email address and a purchase record, so you can stop there. Fewer fields means a shorter notice, fewer access and correction requests to handle, and less to lose in a breach. This is another reason to keep the program simple: stamps, tiers and games tend to invite extra profile questions to run them, while points need only the balance.
Practical steps for the counter:
- Put one sentence about purposes on the sign-up screen.
- Keep any marketing consent as a separate, optional choice.
- Name a person or email address for withdrawal and access requests.
- Write down your retention rule for inactive members.
- Keep staff access to the member list limited and individual.
Our guides on launching a program at the counter, getting customers to join and a loyalty card with no app cover the sign-up flow. If you are comparing software, see best loyalty apps in Singapore.
This page summarises PDPC guidance for owners and is not legal advice. Check the current text of the Act and PDPC’s guidelines before you finalise your notice.
How Gimify handles sign-up data
Gimify members join by scanning a QR code and entering their email, with no form, app download or password, and the points card sits in Google Wallet. The free plan covers one outlet and unlimited members, and what you tell members about why you hold their email remains your decision as the business running the program.
Questions owners ask
Do I need consent to collect customer details for a loyalty program in Singapore?
Yes, in general. PDPA sections 13 to 17 set the Consent Obligation. When a customer voluntarily gives you their details to join, PDPC's guidelines say consent can be deemed, but only for purposes that are objectively obvious from the situation, such as running the points account.
Can I make customers agree to marketing in order to join?
Not as a condition. Section 14(2) bars an organisation from requiring consent to collection, use or disclosure beyond what is reasonable to provide the service. You may ask for extra consent if joining does not depend on it.
How long may I keep a lapsed member's data?
Only as long as the purpose is still served or retention is needed for legal or business reasons (section 25). PDPC does not set one number of years, so write down your own period and follow it.
What if a member asks to leave the program?
You must allow and facilitate withdrawal of consent on reasonable notice. PDPC treats at least ten business days from receipt as reasonable as a rule of thumb, and advises telling the person if you need longer.
Do I have to report a leak of my member list?
You must assess whether it is notifiable. PDPC's guidelines say a breach affecting 500 or more individuals must be notified to the Commission, and smaller breaches that are likely to cause significant harm also must be.
Does the PDPA cover sending promotional SMS to members?
Messages to Singapore phone numbers fall under the separate Do Not Call provisions in Parts 9 and 9A. Check the Do Not Call guidelines before you text or call members for marketing.
Read next
Start free
Gimify is free for one outlet with unlimited members and no time limit. Unlimited outlets are one flat monthly price.
See plans