Under the PDPA, every organisation must designate a data protection officer and make that person's business contact information available to the public, and that includes a four-person salon answering customers on WhatsApp.
Customer chat is where a small business collects the most personal data with the least thought: names, numbers, birthdays, a child's school level, sometimes a photo of an injury before a physio session. The Personal Data Protection Commission lists eleven obligations, and a chat touches most of them.
The order we'd follow:
- Name your data protection officer and publish a way to reach them.
- Tell people, in the chat itself, what you use their details for.
- Ask only for what the booking needs, and never a full NRIC.
- Decide how long you keep chats, and who can read them.
1. Someone is named as your data protection officer
It can be the owner. What matters is that a person is responsible and customers can reach them. Put a business email such as privacy@ on your website and in your WhatsApp business profile, and make sure someone reads it.
2. The chat says why you're collecting details
The Notification Obligation means people should know the purpose before or when you collect their data. A greeting message or the first website chat reply can do it in one line: "We use your name and number to manage your booking and send reminders." Link to your privacy policy for the rest.
3. You ask only for what the booking needs
A haircut needs a name, a number and a time. A trial class might need the child's level. It doesn't need a home address or a date of birth "for our records". Under the PDPA's Consent Obligation, you can't make a service conditional on consent to collect more data than is reasonable to provide it.
NRIC numbers need special care. PDPC's advisory guidelines, applied since 1 September 2019, say organisations generally may not collect full NRIC numbers or copies of the NRIC unless the law requires it or identity must be verified to a high degree of accuracy. A booking doesn't qualify. If you need to tell two customers apart, ask for the last three digits and letter, which PDPC doesn't treat as a full NRIC.
4. Nobody pastes card numbers or IDs into the chat
WhatsApp's Business Messaging Policy tells businesses not to share or ask people to share full payment card numbers, financial account numbers or personal ID numbers. Send a payment link or a PayNow QR instead, and tell staff to delete and warn when a customer volunteers a card number anyway.
5. Marketing messages wait for consent
A booking chat isn't permission to send promotions. Ask separately ("Would you like to hear about our CNY packages? Reply YES") and keep the reply. Our guide to winning back lapsed customers covers the Do Not Call rules for Singapore numbers.
6. Chats have an owner, a password and a lock
The Protection Obligation asks for reasonable security. For a small business that means a passcode on the shop phone, two-step verification on the WhatsApp account, staff logged out of linked devices when they leave, and no customer chats exported into personal email. If an automation or a front desk tool reads your chats, ask the vendor where the data is stored and who can see it.
7. Old chats don't live forever
The Retention Limitation Obligation says you should stop keeping personal data once there's no business or legal reason for it. Pick a rule you can keep, for example clearing chats with customers who haven't booked in two years, and put a recurring reminder in the calendar to do it.
8. You know what to do if a phone goes missing
A lost shop phone with three years of customer chats is a possible data breach. PDPC says organisations must assess whether a breach is notifiable, and if it is, notify PDPC no later than three calendar days after deciding so. A breach is notifiable when it's likely to cause significant harm or affects 500 or more people.
Write a three-line plan now: lock and wipe the device remotely, log what was on it, and decide who checks whether it must be reported. Keep the plan with the DPO's name from step 1.
A checklist only works if the people answering chats follow it. Brief every new staff member on three rules: never ask for a full NRIC or card number in chat, never add someone to a promotions list without a yes, and tell the owner about any data mistake the same day. Pin the three rules beside the counter phone.
Frequently asked questions
Does a small business need a data protection officer?
Yes. PDPC says every organisation must designate a data protection officer and make their business contact information available to the public. The owner can take the role.
Can I ask customers for their NRIC number when they book?
Generally no. PDPC's advisory guidelines say organisations may not collect full NRIC numbers unless the law requires it or identity must be verified to a high degree of accuracy. The last three digits and letter are not treated as a full NRIC.
Is a booking chat enough consent to send promotions?
No. Consent to manage a booking is not consent to marketing. Ask separately and keep the reply, and check the Do Not Call rules before you message Singapore numbers.
What happens if the shop phone with customer chats is lost?
Treat it as a possible data breach. Assess whether it is notifiable, and if it is likely to cause significant harm or affects 500 or more people, notify PDPC within three calendar days of that assessment.
How Furoki can help
Furoki Concierge is built with these checks in mind. It shows a PDPA notice before a customer shares details, keeps conversations in one console your team controls, and lets you delete a customer's data when they ask. It answers from your approved prices and policies, books real slots and hands anything sensitive to a person. Website chat is live today, and WhatsApp on your own number is rolling out with our first pilot businesses.
Try the demo salon and see the PDPA notice before the first question.
