The PDPA Question: Is Your Referral Program Collecting Data Legally?

You ask a happy customer for their friend's name and phone number so you can follow up. It feels harmless. It's also exactly the kind of data handling that the Personal Data Protection Act (PDPA) was written to cover.

Most SMEs in Singapore never think about this. They're focused on growth, not compliance. But a referral program that collects a third party's contact details without consent is a liability sitting quietly in your spreadsheet.

Why This Applies to You, Not Just Big Companies

The PDPA doesn't have a small business exemption. If you collect, use, or disclose personal data, including a friend's phone number given to you by someone else, the rules apply.

The tricky part is that the person whose data you're collecting (the friend) never gave it to you directly. Your customer did. That's where most referral programs quietly step into grey territory.

The Core Problem: Consent Belongs to the Friend, Not the Referrer

Your customer can consent to you contacting them. They cannot consent on behalf of their friend. Only the friend can agree to have their own data collected and used.

So when a customer fills in a form with their friend's name and number, and you then call or WhatsApp that friend directly, you're using personal data you never got consent for. This is the exact scenario PDPA complaints are made of.

How Singapore SMEs Usually Get This Wrong

• Cold contacting the friend. Calling or messaging someone who never opted in, just because their friend mentioned them.
• No source disclosure. The friend has no idea how you got their number, which immediately feels invasive even if your intentions are good.
• Storing data indefinitely. Keeping referred contacts in a spreadsheet for months with no retention policy or way to delete them on request.
• No audit trail. If someone complains, there's no record of consent, timing, or how the data was used.

The Fix: Let the Referrer Make the Introduction, Not You

The safest and most effective model is simple: the referrer shares a link or code directly with their friend. The friend clicks, opts in, and gives consent themselves.

This flips the entire flow. Instead of you reaching out to a stranger using data you collected secondhand, the friend arrives already aware of your business and already consenting to be contacted.

It also happens to convert better. A friend who clicks a referral link because someone they trust sent it to them is warmer than a friend who gets a surprise call from a business they've never interacted with.

Practical Steps to Make Your Program PDPA Friendly

1. Use referral links or codes instead of collecting the friend's contact details upfront.
2. Let the referrer do the outreach through WhatsApp, Instagram, or wherever they naturally talk to their friend.
3. Capture consent at the point the friend signs up, not before.
4. State clearly in your privacy notice how referral data is collected, used, and for how long it's kept.
5. Set a retention period and actually delete data once it's no longer needed.

None of this requires a lawyer or a compliance team. It mostly requires rethinking the mechanics of how referrals flow into your business.

Why This Matters Beyond Avoiding Fines

PDPA penalties can hurt, but the bigger risk for most SMEs is reputational. A friend who feels their number was passed around without consent won't become a customer. They'll become someone who warns others about you.

A referral program should build trust, not quietly erode it. The businesses that get this right treat the friend's consent as seriously as the referrer's reward.

The Takeaway

If your referral program involves customers handing you a friend's contact details, it's worth checking how that data moves after you receive it. A link-based, opt-in model protects both your business and the people you're trying to reach.

Good referral mechanics and good data practices aren't separate goals. Get the flow right, and both take care of each other.

Want a referral program structure that's built around consent-first, link-based referrals from day one? Join the ReferSales founding members program and set it up the right way from the start.