Is PayNow loyalty PDPA-compliant in Singapore?

PayNow loyalty is PDPA-compliant in Singapore when four conditions are satisfied. First, the customer gives explicit, informed consent at opt-in — typically through a WhatsApp Business opt-in flow with a clear statement of purpose. Second, customer data (PayNow handle, visit history, basket detail) stays resident in-region, not exported to jurisdictions without equivalent protections. Third, every outbound broadcast carries a one-tap opt-out the customer can use without contacting the operator. Fourth, the loyalty layer maintains an audit trail exportable on demand for any PDPC investigation.

Loyalty layers like PEKO build these four guarantees in by default — operators don't have to assemble the compliance scaffolding themselves. The PDPA exposure for the operator is then limited to standard merchant obligations: don't share customer data with third parties beyond the contracted processor, respond to data-access requests within statutory timelines, and notify the PDPC of any notifiable data breach.

What's not PDPA-compliant out of the box: scraping payer references without consent, sending unsolicited marketing broadcasts to anyone who has ever paid via PayNow, or exporting customer records to overseas analytics tooling without a transfer impact assessment.