The PDPA Referral Trap: Asking for Contacts Without Breaking the Law

You ask a happy customer, "Know anyone else who'd want this?" They say yes, and hand over their friend's phone number. You save it, and call the friend the next day.

It feels harmless. In Singapore, it can actually breach the Personal Data Protection Act (PDPA).

Where the Trap Is Hiding

PDPA requires consent before you collect, use, or disclose someone's personal data. A phone number or email address counts as personal data, even if a friend handed it to you with good intentions.

The problem is simple: the friend who was referred never gave you consent. Your customer gave you their contact, not their permission.

Most SMEs never think about this until something goes wrong, like an annoyed lead reporting an unsolicited call, or a complaint landing with the Personal Data Protection Commission (PDPC).

The Three Common Mistakes

• Collecting third-party numbers directly. Asking "What's your friend's number?" and keying it into your CRM.
• Cold-calling referred leads. Reaching out before the person has agreed to be contacted by you.
• Forwarding WhatsApp chats. Screenshotting a conversation that includes someone else's number and saving it as a lead.

None of these are done with bad intent. But intent does not change what the law requires.

The Safe Way to Run Referrals

1. Let the Referrer Make the Introduction

Instead of asking for a number, ask your customer to introduce you. A simple WhatsApp message they send to their friend works well:

"Hey, I used [Business Name] and thought you'd like them too. Here's their link if you want to check it out."

This way, the first contact comes from someone the friend already trusts, not a stranger with their number.

2. Use a Trackable Referral Link Instead of a Contact Form

A referral link lets your customer share with their network, and the friend chooses to click through on their own. No number changes hands until the friend decides to act.

This also solves a tracking problem many SMEs face: knowing exactly which referral led to which sale, without needing to manually log a name and number first.

3. Get Consent at the Point of Sign-Up

When the referred friend fills in a form or messages you directly, that is the moment they are giving you consent. This is the version of their contact information you are legally safe to act on.

4. Avoid Asking Customers to Hand Over Their Contact Lists

Some SMEs ask loyal customers to "just send a list of friends who might be interested." Avoid this. It puts the compliance burden on your customer, and the data still was not collected with the friend's consent.

Why This Matters More as You Grow

A small referral program run manually through personal WhatsApp might fly under the radar. But as your referral program scales and more customers start sharing your business, the volume of third-party data moving through informal channels increases.

One complaint to the PDPC is enough to trigger a formal review of how your business collects data. Fines for non-compliance in Singapore range widely depending on severity, but the reputational damage with customers is often worse than the fine itself.

Build the Habit Early

The fix is not complicated. Structure your referral program so the introduction happens through your customer, not through you collecting a stranger's number.

A referral link does this automatically. It removes the awkward step of asking for someone else's contact, and it gives you clean, trackable data on who referred whom, all without touching a phone number you were never given consent to hold.

Start Clean From Day One

If you're setting up or rebuilding your referral program, build it around links and self-service sign-ups rather than manual contact collection. It protects your business and makes tracking referrals far easier.

ReferSales is built for Singapore SMEs who want a referral program that runs cleanly, with trackable links and proper consent built into every step. Join the founding members list here to get early access.