Guide · Stay compliant

PDPA-friendly enquiry forms for property agent websites

By Joe Tay, Sites by Joe · Published 30 October 2026

Your enquiry form collects personal data. That means the PDPA applies. The good news: a safe form is a short form. Here is how I set one up for agents, step by step.

The short answer

Ask only for what you need to reply: name, mobile number and what they want. Never ask for NRIC.
Say why you are collecting it, right next to the Send button.
If you want to send property updates later, add a separate tick box. Leave it unticked.
Before you send marketing calls or messages, check the Do Not Call Registry, unless you have clear consent on record.
Delete enquiries you no longer need. Know where your form provider keeps them.

This is a practical guide, not legal advice. Your agency may have its own PDPA policy. Follow it.

Why the PDPA applies to your website form

The Personal Data Protection Act (PDPA) sets the rules for how organisations in Singapore collect, use and keep personal data. A name and a mobile number on an enquiry form are personal data.

PDPC, the regulator, sums up the main duties on its data protection obligations page. For a website form, five of them matter most: get consent, tell people the purpose, use the data only for that purpose, protect it and don't keep it longer than you need.

CEA also tells estate agents and salespersons to follow the PDPA. Its personal data protection page points agents to PDPC's Advisory Guidelines for the Real Estate Agency Sector, which PDPC wrote with CEA. If you work under an agency, check its PDPA policy too. Your agency may have rules on where client details must be kept.

1. Collect only what you need

Ask yourself one question for every field: "Do I need this to reply?" If not, take it out. Short forms also get filled in more often. People on a phone don't like typing.

What to put on an agent's enquiry form Scroll sideways to see all columns.
Field	Ask?	Why
Name	Yes	So you know who you are talking to.
Mobile number	Yes	Most agents reply on WhatsApp or by phone. One contact method is enough.
What they need	Yes	Buy, sell, rent or a valuation. A simple drop-down or a short message box works.
Block or address	Optional	Handy for a seller who wants a valuation. Make it optional.
Email	Optional	Only if you will really use it. Don't ask for both email and mobile "just in case".
NRIC or passport number	Never	You don't need it to answer an enquiry. See below.
Date of birth, income, family details	Not here	Talk about budget and needs in person, when it is relevant.

Why never NRIC? Since 1 September 2019, PDPC's NRIC advisory guidelines say organisations generally should not collect NRIC numbers or copies, except in specific cases, such as when the law requires it. Source: PDPC reminder on the NRIC advisory guidelines. An enquiry form is not one of those cases. You may need ID details later, for the actual paperwork. CEA has a tip sheet on that: what property agents should know when collecting clients' NRIC numbers.

2. Tell people why, before they send

The PDPA asks you to tell people the purpose on or before you collect their data. PDPC's Guide to Notification shows good ways to do this. It also notes that the law does not fix the exact wording or format. So keep it short and put it where people will see it: right under the Send button.

Sample notice line

"I'll use your name and number only to reply to this enquiry. This form is processed by [form provider]. See my privacy notice."

My own wording. Swap in your form provider and link to your privacy notice.

Then link to a short privacy notice page. It should say, in plain words:

What you collect and why.
Which outside services handle it, like your form provider, website host and analytics.
How long you keep it.
How people can ask to see, fix or delete their details, or stop marketing.

Want a real example? My own privacy notice follows this pattern. It is written for my web studio, not for an agent, so don't copy it word for word. Use it to see the shape.

Do

One plain sentence near the button, and a link to the full notice.

Avoid

A long legal block nobody reads, or a promise like "never shared" when a form service processes every message.

4. The Do Not Call Registry, in plain English

The Do Not Call (DNC) Registry lets people in Singapore opt out of marketing calls and messages to their numbers. It matters to agents because the rules cover messages that offer or promote property. PDPC's DNC guidelines list "land or an interest in land" among the things these messages can promote. Source: PDPC Advisory Guidelines on the Do Not Call Provisions.

The basics

It covers calls, texts and faxes to Singapore numbers. PDPC says this includes messages sent through apps like WhatsApp that use a Singapore number. Source: PDPC, Do Not Call Registry and you.
Check before you send. Before a marketing call or message, check the number against the registry. CEA has reminded agents of this. Source: CEA, check the Do Not Call Registry before sending marketing messages.
A check lasts 21 days. PDPC cut the validity of registry results from 30 to 21 calendar days from 1 February 2021. Some older pages still say 30 days. Source: PDPC FAQs on the enhanced PDPA.
Clear consent changes things. You don't need to check the registry if the person has given clear and unambiguous consent, in writing or in another form you can show. That is what your unticked marketing box is for. Source: PDPC DNC guidelines.

What this means for your website

Someone fills in your form and asks about a unit. You reply about that unit. That is you answering their question. The DNC rules are aimed at marketing: messages that offer or promote property or services.

The line gets blurry later. Three months on, you want to send that same person a new launch. Now it is marketing. Either they ticked your marketing box, or you check the registry first. If you are not sure which side of the line a message falls on, read PDPC's DNC guidelines or ask your agency's compliance team.

5. Keep it while you need it, then delete it

The PDPA says to stop keeping personal data once you no longer need it for a business or legal purpose. Source: PDPC data protection obligations. It does not give one fixed number of months. You decide what is reasonable, then stick to it.

Enquiries tend to pile up in more places than you think. A simple routine helps:

List where enquiries land. The form provider's dashboard, your email inbox, maybe a spreadsheet or CRM.
Pick a review habit. For example, once a month, look at enquiries that went nowhere.
Delete from every place. Not just your inbox. The form dashboard too.
Say it in your privacy notice. Something like: "I keep enquiries only as long as I need them to reply and follow up. Then I delete them."
Act on requests. If someone asks you to delete their details or stop messaging, do it and reply to confirm.

Clients who go on to buy or sell with you are different. Your agency will have its own record-keeping rules for transactions. Follow those.

6. Stop spam without asking for more data

Every public form gets spam. Don't fix it by adding fields, or asking people to log in or verify their phone. There are quieter ways that collect nothing extra:

A honeypot field. A hidden box that people never see. Bots fill in every box, so if this one has text, the form drops the message.
A time check. A real person takes a few seconds to type. If the form is sent too fast, it is likely a bot. My forms use a 10-second minimum and show a polite "please check your details" note.
Your form provider's spam filter. Most have one built in. Read what it does with messages, as part of step 7.

Both tricks are invisible to real visitors. They add no data, cookies or puzzles.

7. Know where your form provider stores data

When someone presses Send, the message usually goes to an outside form service first, then to your email. That service handles personal data for you. You are still responsible for it.

The PDPA also has rules for sending personal data out of Singapore. PDPC says the protection must stay comparable to the PDPA. Source: PDPC data protection obligations. Many form services store data overseas, so read their privacy policy before you pick one.

Questions to answer from the provider's own privacy policy and settings:

Which country stores the submissions?
How long do they keep them, and can you delete them yourself?
Who can log in to your account? Turn on two-step login if it is offered.
Does the form send over a secure (https) connection?
Are the email alerts going to an inbox only you control?

For example, my own site's form runs on Formspree. Its privacy policy is the page to read for these answers. Whichever service you use, name it in your privacy notice.

8. A sample enquiry form you can copy

Here is the layout I use on agent sites. Five short fields, two of them optional, one tick box and a notice line.

Ask me about your property

Your nameMei Ling
Mobile number9123 4567
I want to…Sell my HDB flat ▾
Block or address (optional)Blk 123 Example Street
Anything else? (optional)When is a good time to call?
Yes, you can send me property updates by WhatsApp, SMS or phone call. I can stop them any time by replying STOP. (optional)
Send
I'll use your name and number only to reply to this enquiry. My form service processes this form for me. See my privacy notice.

Example layout. The names and numbers are made up. The tick box starts empty.

Name, mobile, what they want. That is enough to reply. The address helps with valuations, and the message box is for extra details, so both are optional.
The marketing box starts empty. The form still sends if it stays empty.
The notice sits next to the button. People read it at the moment they decide.
A hidden honeypot and a time check stop most bots. Visitors never see them.
WhatsApp stays the main button elsewhere on the page. The form is the backup for people who prefer it. My WhatsApp button guide covers that side.

Same idea for WhatsApp: if someone starts a chat with you, the same rules on purpose, marketing and keeping data apply to that chat.

Pre-launch checklist

Run through this before your form goes live.

Every field is needed to reply. No NRIC, no date of birth.
Optional fields are marked "optional".
A one-line notice sits next to the Send button.
The notice links to a privacy notice page that names your form provider.
The marketing tick box is separate, optional and starts unticked.
You know how you will handle "STOP" and delete requests.
You know where submissions are stored and how to delete them.
Two-step login is on for your form and email accounts.
Spam protection works without extra fields.
You sent a test enquiry from your phone and it arrived.

How my sites handle this

On sites I build, WhatsApp is the main way to reach the agent. When a package includes a form, it is short: name, mobile, what they want, an optional address and a message. It has a hidden honeypot and a 10-second minimum. A notice line sits next to the button.

The form connects to the agent's own form-service account, so enquiries go to the agent, not to me. If you plan to send updates, I add the separate, unticked marketing box. I can draft a short privacy notice page in plain English for you to check with your agency.

See the fictional demo site →
The demo uses a made-up agent and sample content.

Common questions

Do I need a privacy notice on my agent website?: If your site collects personal data, you need to tell people the purpose. A short notice by the form plus a privacy notice page is the simplest way to do it, and to show people how to reach you about their data.
Can I just use WhatsApp and skip the form?: Yes. Many agents do. A chat still holds personal data, so the same ideas apply: use it for what they asked, get consent before marketing, and clear out old chats you don't need.
Is replying to a website enquiry a DNC problem?: Replying to what someone asked about is answering them. The DNC rules aim at marketing. Later marketing to that person needs either clear consent on record or a registry check. When in doubt, check PDPC's DNC guidelines.
Can my marketing tick box be ticked by default?: I don't do it, and I don't recommend it. PDPC says failing to opt out is unlikely to count as clear and unambiguous consent for DNC purposes. A box the person ticks themselves is clearer for everyone.
What about the real estate sector guidelines?: PDPC has Advisory Guidelines for the Real Estate Agency Sector, issued in 2014 and written with CEA. They walk through common agent situations. Read them along with your agency's policy.