Email Marketing in Singapore: The Rules, the Numbers and What Actually Works

Last updated: 23 August 2026. Written by Adrian Tan, Singapore Digital Marketing (SDM).

Almost every Singapore SME we talk to has an email list. Almost none can answer three questions about it: who is legally allowed to be on it, whether the messages are arriving, and which number on the dashboard is telling the truth. Those three decide whether email is your cheapest channel or a slow-burning compliance liability, and none of them has anything to do with subject lines.

This guide answers them. It covers what the Personal Data Protection Act and the Spam Control Act each require — different laws doing different jobs, which most local advice blurs — what Gmail, Yahoo and Microsoft now demand before they will deliver your mail at all, what the benchmark numbers mean now that Apple has broken the open rate, and what the whole thing costs to run properly.

It sits inside our content marketing guide for Singapore businesses. Email is the only channel in that guide you own outright: no algorithm sits between you and the recipient, and nobody can change your reach overnight. That is exactly why the rules around it are stricter than anywhere else.

Two laws, and the one most people get backwards

Singapore regulates commercial email through two instruments that are often treated as one thing.

The Personal Data Protection Act (PDPA) governs the data. An email address belonging to an identifiable individual is personal data, so collecting it, storing it, using it for marketing and passing it to a third-party platform all fall under the PDPA’s consent, purpose limitation, protection and access obligations. The Personal Data Protection Commission can impose financial penalties of up to S$1 million, or 10% of annual Singapore turnover where that turnover exceeds S$10 million.

The Spam Control Act 2007 (SCA) governs the message. It applies to unsolicited commercial electronic messages sent in bulk, and dictates format: an unsubscribe facility, a statement explaining it, an accurate sender contact, and the <ADV> label.

And here is the part that trips up most Singapore marketers: the Do Not Call Registry does not apply to email. The DNC provisions sit inside the PDPA and cover Singapore telephone numbers — voice calls, SMS, MMS and fax. There is no DNC list to screen email against. We have watched businesses delay an email programme for months waiting for a process that was never required, while running SMS campaigns that genuinely did need one.

What “in bulk” actually means

The SCA’s obligations attach to messages sent in bulk, and the Act puts numbers on it. Messages are deemed sent in bulk where a person sends, causes to be sent or authorises the sending of more than 100 messages with the same or similar subject matter in a 24-hour period, more than 1,000 in 30 days, or more than 10,000 in a year. The Minister can vary those figures by order.

Three consequences follow. A B2B outreach programme of thirty carefully written emails a day sits under all three ceilings and outside the SCA — but squarely inside the PDPA, which is the harder test anyway. A monthly newsletter to 400 subscribers crosses the 1,000-in-30-days line by the third send. And “same or similar subject matter” means splitting one blast across four days does not help you.

What the Second Schedule requires

Where the SCA applies, the message must carry:

• An unsubscribe facility. An email address, a web address, a phone number, a fax number or a postal address the recipient can use to opt out.
• A statement saying so — that the recipient may use that address or number to submit an unsubscribe request, or words to that effect.
• Thirty days of validity. The unsubscribe address or link must stay valid and capable of receiving requests for at least 30 days after the message is sent. A link that dies when you archive the campaign fails this.
• An accurate, functional sender contact — an email address or phone number by which the sender can readily be contacted. A bare no-reply address is a problem.
• The <ADV> label, placed with a space before the title in the subject field, so the message is clearly identifiable as an advertisement.

Then the deadline that catches people: once an unsubscribe request is submitted, the sender has 10 business days to stop. If your platform syncs suppression to your CRM weekly and someone runs a manual export in between, you can breach that window without noticing.

The nuance worth understanding: solicited mail is a different animal

The SCA regulates unsolicited commercial messages. A subscriber who filled in your form and asked for your newsletter has, on any ordinary reading, requested those messages — which is why well-run opt-in newsletters in Singapore do not carry <ADV> in the subject line, and why nobody is suing them.

That is the legal theory, and it is the right one. It is also a poor thing to be wrong about, because the distinction depends entirely on how the address was obtained — and the businesses most confident their list is opt-in are usually the ones who bought a tranche of it in 2021, scraped a conference delegate list, or imported “contacts we’ve met” from someone’s Outlook. Any such segment is unsolicited, and it needs the label or it needs deleting. Where real money rides on the answer, get it checked by counsel rather than by a marketer.

Our own rule is simpler than the law and easier to defend: if you cannot point to the moment a person asked for the email, do not send it. That standard also produces better numbers, for reasons the next two sections make obvious. The same logic runs through PDPA and marketing tracking in Singapore, which covers consent in more depth.

The layer nobody budgets for: getting delivered at all

Compliance keeps you out of court. It does not get you into the inbox. Since February 2024 the mailbox providers have enforced their own requirements, and they are now stricter than the law.

Google’s published sender requirements ask every sender to set up SPF or DKIM authentication, transmit over TLS, hold valid forward and reverse DNS records for the sending IP, format messages to RFC 5322, and keep the spam rate reported in Postmaster Tools below 0.3%. Bulk senders — roughly 5,000 or more messages a day to Gmail addresses — must additionally set up both SPF and DKIM, publish a DMARC record (a policy of p=none satisfies it), align the From: header domain with the SPF or DKIM domain, and support one-click unsubscribe via the RFC 8058 List-Unsubscribe-Post: List-Unsubscribe=One-Click header alongside a visible unsubscribe link. Yahoo mirrors these; Microsoft has moved the same way for high-volume senders.

Two things about that spam-rate number matter more than they look. It is measured by recipient complaints, not by your own definition of spam, so one badly-targeted campaign to a stale segment can spike it. And it is domain-level: the transactional receipts your finance system sends inherit the reputation your marketing list earns. We have seen a Singapore services firm lose order confirmations to the spam folder for a fortnight after one re-engagement blast to a four-year-old list.

The 90-minute technical setup most SG SMEs have never done

1. Publish SPF for your sending domain, listing every service that sends on your behalf. Watch the ten-lookup limit — a domain carrying a CRM, a helpdesk, an invoicing tool and a booking system usually blows past it.
2. Enable DKIM in your email platform and add the CNAME records it gives you. Signing with your own domain rather than the platform’s is the point.
3. Publish a DMARC record at p=none with a reporting address, and read the reports for a month before tightening to quarantine. Going straight to p=reject is how businesses discover, painfully, that their accounting software was sending as them.
4. Split the sending domains. Marketing from one subdomain, transactional from another. Costs nothing, contains the blast radius.
5. Verify one-click unsubscribe is live. Most platforms enabled it in 2024; some legacy accounts and almost all home-built senders did not.
6. Register for Google Postmaster Tools so you can see the spam rate rather than guess at it.

It is a one-afternoon job with your IT provider, and the highest-return afternoon in the whole channel.

Why your open rate is fiction, and what to read instead

Open tracking works by loading a one-pixel image. Since Apple introduced Mail Privacy Protection, Apple Mail pre-loads that image on delivery whether or not a human ever looks at the message. Anyone using Apple Mail — a large slice of any Singapore consumer list — registers as an open automatically.

Published open-rate benchmarks are therefore a blend of real and machine opens, which is why “average” open rates are quoted anywhere between 20% and 45% depending on whose data you read and whether they filtered. Mailchimp’s published all-industry figures put the average open rate around 35.6% with a click rate of 2.62% and unsubscribes at 0.22%, with e-commerce lower on opens (29.8%) and clicks (1.74%) and non-profits higher (40.0% and 3.27%). Useful for shape, not for scoring yourself — and that set carries a 2023 data date.

What to do instead:

• Use clicks and conversions as your primary metrics. Mail Privacy Protection does not affect delivery, bounces or clicks. A click is a deliberate human action.
• Watch click-to-open only as a directional signal, since its denominator is contaminated.
• Track revenue or qualified enquiries per send, not per campaign — per-send normalises for list growth.
• Watch deliverability separately — hard bounce rate, complaint rate, unsubscribe rate. Those are the leading indicators of a problem that eventually surfaces as “the emails stopped working”.

For the wider frame, conversion tracking for Singapore businesses and attribution models cover how email credit gets assigned when the same person also clicks an ad and a search result.

The structural point: flows beat campaigns

The biggest difference between an email programme that pays for itself and one that does not is not copy quality. It is the ratio of automated flows to broadcast campaigns.

A campaign goes to a list on a date you choose. A flow goes to one person the moment they do something — subscribe, abandon a cart, book and not turn up, buy and go quiet for 90 days. Published e-commerce benchmark sets consistently show automated flows generating a majority of email revenue from a small minority of send volume, with welcome and cart-recovery sequences accounting for the bulk of automation-driven orders. The mechanism is not mysterious: a flow arrives when the person is already thinking about you.

For a Singapore B2B or services business without a cart, the equivalent set is smaller and just as effective:

Note what the last row is doing. The newsletter is rarely the revenue driver; it is the maintenance that keeps addresses valid and recipients willing to open. Build the flows first — most Singapore SMEs do it the other way around and wonder why a monthly send produces no enquiries.

Building a list you are allowed to email

The compliant methods are also the ones that produce lists that convert, which makes this an unusually easy trade-off.

• A genuine exchange. Something worth an email address — a pricing guide, a checklist, a benchmark set, a template. Not “subscribe to our newsletter”, which asks for something and offers nothing.
• Separate the tick-boxes. Consent to be contacted about an enquiry is not consent to receive marketing. Ask separately, and store the timestamp and source with the record. When someone eventually challenges you, that record is the whole defence.
• No pre-ticked boxes and no bundling. Making marketing consent a condition of a service the person is buying is not meaningful consent.
• Never buy a list. Beyond the PDPA problem, purchased lists produce complaint rates that will take your sending domain’s reputation with them.
• Be careful with events. A namecard dropped in a fishbowl at a trade show is not consent to a monthly newsletter unless the sign said so. Put the wording on the card or the form.
• Re-permission an inherited list once, then let it go. Send one message asking people to confirm, and delete everyone who does not. It feels like destroying an asset. It is closer to disposing of a liability.

What it costs to run

Email is the cheapest channel to operate and one of the more expensive to set up properly — the reverse of what most budgets assume.

Platform. Published list pricing at the time of writing, in US dollars, gives the shape: entry plans start around USD 13–19 a month; a list of 10,000 subscribers sits near USD 96 a month on Mailchimp’s contact-based pricing and around USD 150 a month on Klaviyo’s email-only tier at 10,000 active profiles. Brevo prices on sends rather than stored contacts, which changes the maths substantially for a business with a large list it emails infrequently, while Klaviyo moved to billing on total active profiles in February 2025, raising costs for brands carrying large unengaged lists. Check current pricing directly — the billing model matters more than the headline rate.

Setup. The authentication work is a few hours with an IT provider. Building the flow set above — writing it, testing it, connecting it to your CRM — is where the real cost sits, and it is a project, not a retainer line.

Running it. Once flows exist, ongoing effort is mostly the newsletter and quarterly reviews. That is why email tends to have the best marginal economics of any channel in the mix, and why we usually recommend building it before increasing paid social budgets. For the comparison on a cost-per-acquisition basis, see customer acquisition cost in Singapore.

On grants: ongoing marketing retainers and ad spend are generally not claimable. Only pre-approved solutions under the Productivity Solutions Grant are — and some e-commerce and CRM packages that include email capability do appear on that list. SDM is a pre-approved PSG vendor; businesses apply for and manage the grant themselves. Enterprise Singapore has indicated the EDGE framework will consolidate EDG, PSG and MRA from the second half of 2026, so confirm current scheme details on the official channels before planning around them.

The mistakes we see most often in Singapore

1. Treating the DNC Registry as an email obligation — and, worse, reading its absence as meaning email is unregulated.
2. Marketing and transactional mail on the same subdomain, so one bad campaign takes the invoices down with it.
3. Chasing the open rate — A/B testing subject lines against a metric Apple partly generates.
4. A newsletter with no flows. All the effort in the lowest-yield format.
5. Unsubscribes handled manually. Someone replies “please remove me”, it sits in an inbox, and the 10-business-day clock runs out.
6. One list, one message. Existing customers receiving the acquisition offer they already bought is the fastest route to a complaint.
7. Never suppressing the dead. Five years of non-openers kept because the list size looks better, quietly wrecking deliverability for the people who do want to hear from you.

A realistic 30-day start

Week 1 — foundations. SPF, DKIM, DMARC at p=none, split subdomains, Postmaster Tools registered. Audit where every address came from and quarantine anything you cannot trace.

Week 2 — permission and plumbing. Fix the sign-up forms: separate consent, honest description, stored timestamp and source. Confirm one-click unsubscribe is active, and wire suppression back to the CRM so an opt-out anywhere is an opt-out everywhere.

Week 3 — the first two flows. Welcome and enquiry-nurture. Two flows properly written beat six half-built ones, and these two touch every new contact.

Week 4 — measure and re-permission. Set up click and conversion tracking. Send the single re-permission message to the untraceable segment, then delete the non-responders. Book a quarterly review in; that recurring slot is what stops the programme decaying.

Frequently asked questions

Do I need to put <ADV> in the subject line of my newsletter?
Only if the message is an unsolicited commercial electronic message sent in bulk. The Spam Control Act’s Second Schedule requires the <ADV> label, placed with a space before the title in the subject field, for messages within its scope. A newsletter going to people who asked for it is not unsolicited, which is why compliant opt-in newsletters in Singapore generally do not carry the label. The distinction turns entirely on how each address was obtained, so a bought, scraped or inherited segment is a different case — and if the answer matters commercially, take legal advice.

Does the Do Not Call Registry apply to my email list?
No. The DNC provisions under the PDPA cover Singapore telephone numbers — voice calls, SMS, MMS and fax. There is no register to screen email addresses against. Email is governed by the PDPA for the data and the Spam Control Act for the message format. If you also run SMS marketing, that is a separate obligation with real screening duties, and it is the one that generates most of the enforcement news.

How long do I have to action an unsubscribe?
Ten business days from the day the request is submitted, and the unsubscribe facility itself must stay valid for at least 30 days after the message was sent. In practice, the risk is not the platform — every major platform suppresses instantly — it is the manual paths: someone who replies to the email asking to be removed, or an opt-out recorded in the CRM but not in the sending tool. Make suppression one-way-syncs-everywhere and the deadline takes care of itself.

Why did our emails suddenly start going to spam?
Usually one of four things: authentication that was never set up or has drifted (an SPF record over the ten-lookup limit is a common culprit), a complaint rate crossing the 0.3% threshold Google publishes, a re-engagement send to an old list, or marketing and transactional mail sharing a subdomain. Register for Google Postmaster Tools before you theorise — it shows the actual spam rate and authentication pass rates.

What is a good open rate in Singapore?
It is the wrong question now. Apple Mail Privacy Protection pre-loads tracking pixels on delivery, so a meaningful share of recorded opens are machines, and published averages ranging from roughly 20% to 45% are measuring different mixes of real and artificial opens. Use click rate, conversion rate and revenue or enquiries per send instead — none of which Mail Privacy Protection touches. Track your own trend rather than an industry average, because the composition of your list matters more than your sector.

Should we build flows or send a newsletter first?
Flows, in almost every case. Automated sequences triggered by what a person actually did consistently outperform scheduled broadcasts per email sent, because they arrive at the moment of interest rather than on your content calendar. Start with welcome and enquiry-nurture, which between them touch every new contact, then add the newsletter as the maintenance layer that keeps addresses valid and recipients willing to open.

Where to go next

Email distributes work you are already producing, so the next question is what to put in it: repurposing content in Singapore covers how one substantial piece feeds a newsletter, a social calendar and a nurture flow, and how often to publish settles the cadence argument. To justify the channel internally, content marketing ROI in Singapore gives the measurement frame and social media ROI the comparison.

When the strategy is settled and the platform is the next decision, Mailchimp vs Klaviyo for Singapore businesses works through the two most common shortlists here — the data models, what each one actually bills you for, and the Spam Control Act duties that neither tool handles for you.

If you would rather have the authentication, the flows and the content handled as one programme, that is what our content marketing services in Singapore do — and our case studies show the shape of the work, published with client permission.

Sources: Spam Control Act 2007 (Singapore), the bulk-sending definition and the Second Schedule; Personal Data Protection Commission, Do Not Call Registry and Your Business; Google Workspace Admin Help, Email sender guidelines; Mailchimp, Email marketing benchmarks by industry (data dated December 2023); published list pricing from Mailchimp, Klaviyo, Brevo and ActiveCampaign as at August 2026. General information, not legal advice — verify your position with counsel. On grants: ongoing retainers and ad spend are generally not claimable; only pre-approved Productivity Solutions Grant solutions are, SDM is a pre-approved PSG vendor, and clients apply for and manage the grant themselves. Enterprise Singapore has said the EDGE framework will consolidate EDG, PSG and MRA from the second half of 2026.