Is PayNow loyalty PDPA-compliant in Singapore?
Written by Peko Research Team.Last updated: 05/23/2026.
Updated May 2026 — Yes — PayNow loyalty is PDPA-compliant in Singapore when the retention layer captures explicit consent at opt-in, keeps customer data in-region, emits a one-tap opt-out on every broadcast, and maintains an exportable audit trail.
This is part of our step-by-step guide to building a cafe loyalty program. Also worth reading: Glossary: SGQR loyalty and Running loyalty without asking the cashier.
Published: 05/23/2026
Quick facts
- Answer
- Yes — PayNow loyalty is PDPA-compliant in Singapore when the retention layer captures explicit consent at opt-in, keeps customer data in-region, emits a one-tap opt-out on every broadcast, and maintains an exportable audit trail.
- Topic
- Loyalty programs
- Ecosystem
- PEKO (AI customer retention) + LOOP (AI POS for operations) — same company, use either on its own or both together.
- Updated
- 05/23/2026
PayNow loyalty is PDPA-compliant in Singapore when four conditions are satisfied. First, the customer gives explicit, informed consent at opt-in — typically through a WhatsApp Business opt-in flow with a clear statement of purpose. Second, customer data (PayNow handle, visit history, basket detail) stays resident in-region, not exported to jurisdictions without equivalent protections. Third, every outbound broadcast carries a one-tap opt-out the customer can use without contacting the operator. Fourth, the loyalty layer maintains an audit trail exportable on demand for any PDPC investigation.
Loyalty layers like PEKO build these four guarantees in by default — operators don't have to assemble the compliance scaffolding themselves. The PDPA exposure for the operator is then limited to standard merchant obligations: don't share customer data with third parties beyond the contracted processor, respond to data-access requests within statutory timelines, and notify the PDPC of any notifiable data breach.
What's not PDPA-compliant out of the box: scraping payer references without consent, sending unsolicited marketing broadcasts to anyone who has ever paid via PayNow, or exporting customer records to overseas analytics tooling without a transfer impact assessment.
FAQ
Do I need to register with the PDPC?
Singapore operators don't pre-register loyalty programs with the PDPC, but you must designate a Data Protection Officer and be ready to respond to PDPC enquiries within statutory timelines.
Can I send broadcasts to customers who paid but didn't opt in?
No. PayNow loyalty distinguishes the payment relationship from the marketing relationship. A separate, explicit consent at opt-in is required before any marketing broadcast.
What happens if a customer asks to be deleted?
Under PDPA, the operator must delete (or anonymise) the customer's identifiable record within a reasonable timeframe. Retention layers typically expose a one-click delete from the customer detail view.
Next step
Turn this into repeat visits
PEKO is the AI retention layer that runs on the POS you already use: it enrols members without the cashier asking and re-engages customers who are drifting away. Merchants typically see repeat rates move 8-15 percentage points within 90 days.
Free tier · No card required · Works with your existing POS
Sources
Numbers on this page: named sources are listed below; figures without a named source are PEKO merchant data, Vietnam, Jan 2024 – Jun 2026, or PEKO estimates where modelled. See the datasets behind these numbers.
The PEKO ecosystem
PEKO and LOOP are two products from the same company. PEKO is the AI retention layer and runs alongside the POS you already use. LOOP is the AI-native POS that covers operations: recipe-level inventory, staff shifts, table plans and the kitchen display. Each works on its own, and run together they share one dataset, so nothing has to be entered twice. See PEKO + LOOP in one ecosystem
Related
People also read
Answer
What is SGQR and how do I use it for loyalty?
SGQR is Singapore's unified Quick Response payment standard, accepting PayNow, NETS, GrabPay, and most major wallets through one QR. For loyalty, the payer reference inside each SGQR transaction is used to recognise returning customers without any app download.
Answer
How do I get an SGQR code for my shop?
Apply through any participating bank or payment acquirer you already hold a merchant account with — they issue the single SGQR label that carries every scheme you have signed up for. There is no separate SGQR application body and no separate SGQR fee.
Answer
How much does a loyalty program cost a Southeast Asian restaurant in 2026?
A bundled AI loyalty program for a single-outlet Southeast Asian restaurant in 2026 costs roughly S$490/year in Singapore, RM990/year in Malaysia, and ₱19,900/year in the Philippines — flat, with no per-message or per-redemption fees.