Background

The Personal Data Protection Commission (the “Commission”) received complaints from two individuals regarding the receipt of unsolicited marketing messages (“specified messages”) sent by NYA Tuition Pte. Ltd. (the “Organisation”). The Organisation had continued to send specified messages to the two complainants even after acknowledging their respective withdrawal requests for the Organisation to cease sending such messages (the “Incident”). The specified messages did not include proper sender identification and contact information as required under section 44 of the Personal Data Protection Act 2012 (the “PDPA”).

The First Complainant received a specified message from the Organisation on 24 May 2024 despite having previously withdrawn consent to receiving such messages in March 2022, and despite the Organisation’s previous confirmations of the withdrawal of consent and removal of the First Complainant’s number from its database. The First Complainant’s number has been registered with the Do Not Call registry since April 2022.

The Second Complainant received six specified messages from the Organisation between August 2022 and December 2024, despite having explicitly withdrawn consent to receiving such messages multiple times between August 2022 and June 2024. The Organisation had confirmed the withdrawal of consent and removal of the Second Complainant’s number from its database in January 2023, and again in June 2024. The Second Complainant’s number has been registered with the Do Not Call registry since December 2013. However, the Second Complainant continued to receive specified messages from the Organisation at the same number. In respect of both Complainants, the Organisation did not act as required under section 47(3) of the PDPA. The Organisation also did not check the Do Not Call register as required under section 43(1) of the PDPA, before sending the specified messages to both complainants.

The Organisation has since implemented remedial actions including establishing a new Do Not Call compliance policy requiring staff to make mandatory checks with the Do Not Call register before sending specified messages, instituted staff training programs on personal data protection, and removed both complainant’s numbers from its database. The Organisation has also implemented procedures for consent management to obtain clear and unambiguous consent from intended recipients before sending specified messages.

Voluntary Undertaking

Having considered the circumstances of the case, the Commission accepted a voluntary undertaking (the “Undertaking”) from the Organisation to improve its compliance with the PDPA, specifically the Do Not Call Provisions. The Undertaking was executed on 5 September 2025.

Having considered the circumstances of the case and the lack of knowledge by the Organisation in cybersecurity and data protection practices, the Commission accepted a voluntary undertaking (the “Undertaking”), which was executed on 24 June 2026, from the Organisation to engage an external service provider to improve its cybersecurity set-up and its data protection practices and policies.

As part of the Undertaking, the Organisation will:

(a) Refrain from sending specified messages, as defined in Section 37(1) of the PDPA, to a Singapore telephone number unless the individual has provided clear and unambiguous consent to receiving such messages or there is a valid confirmation that the Singapore telephone number is not listed in the relevant register;

(b) Refrain from sending specified messages to a Singapore telephone number without proper sender identification and contact information;

(c) Refrain from sending specified messages to a Singapore telephone number if the individual has withdrawn consent for the sending of such messages to that number; and

(d) Take appropriate measures to ensure that the Organisation complies with its obligations under the PDPA for a period of not less than six (6) months from the date of entering into this Undertaking.

If the Organisation fails to comply with any terms of the Undertaking, the Commission may issue a direction to ensure the Organisation’s compliance with the Undertaking.