Six years off, 1,200 former students, one message. What a yoga teacher with no website needs to know about privacy

A yoga teacher taught in Manchester first, then Dubai, then came home to Singapore. Over the years, about 1,200 students passed through her classes. Their email addresses stayed in her inbox and an old spreadsheet. Their mobile numbers stayed in her WhatsApp contacts.

Then she took six years off.

When she came back, she did what anyone would. She pulled every email address she could find into Mailchimp. She set up a new WhatsApp group and added the hundreds of student numbers still on her phone. Then she sent the same note both ways. It read like a catch-up between old friends: where the six years had taken her, that she had a young family in Singapore, and that she was teaching again. Classes would run in a studio in Singapore and online, so anyone could join from anywhere. She added that the online classes would fall in the morning for anyone in the UK or Europe. From now on, she wrote, the group would carry schedules and updates.

Because anyone could join online, she wrote to everyone. She did not stop to think about where they all were now. The regulars from her Manchester evening class could be in Bristol or Lisbon. Her Dubai students had scattered across three continents. Some of the numbers now belonged to someone else entirely. Nor did she think about the group itself, where members can usually see each other's phone numbers.

Some people unsubscribed. A few asked to be taken off the list. A few more quietly left the group. One replied to say they no longer lived in Singapore. Several wrote back to say how lovely it was to hear from her. Nobody complained.

She got lucky. Here is why it was luck, and the setup that means she will not need it next time.

In a hurry? Your nationality, and your students', does not decide which law applies. Where they were, and where you run the business, does. For an old list, work out who you are still allowed to contact, ask those people once whether they still want to hear from you, keep everyone who says yes, and delete the rest. The full list is at the end.

First, a myth: "they're all different nationalities, so it's complicated"

It is complicated, but not for that reason. Privacy and email laws care about where someone lives or was when you collected their details, and where your business runs. They do not care about passports. A French student she taught in Manchester is a UK question. A British student she now teaches in Singapore is a Singapore question.

So one message to 1,200 people, sent two ways, crossed three sets of rules at once.

The comeback message, three rulebooks

Singapore

Singapore's Personal Data Protection Act (PDPA) covers her. It applies to anyone running a business, including a one-person business. The main people it leaves out are individuals acting in a personal or domestic capacity, and a yoga teacher selling classes is not one of them.

Four rules apply to the comeback message:

• Purpose. She collected those addresses and numbers to run classes: bookings, schedule changes, receipts. Using them to market a relaunch is a new purpose. Under the PDPA, a new purpose needs its own notice and consent, unless she told students at the time that she would send them news and offers. The PDPA's shortcuts do not help here. Singapore's regulator says deemed consent by notification and the legitimate interests exception are not available for sending marketing messages, and it expects opt-in consent.
• Disclosure. Adding everyone to an ordinary WhatsApp group put each person's phone number in front of hundreds of people they had never met, including strangers who now held a former student's old number. Under the PDPA, disclosing someone's personal data to others needs their consent too, unless one of the Act's exceptions applies, and it would be hard to fit a marketing group into any of them. She must also protect the data she holds by making reasonable security arrangements against unauthorized disclosure, and showing every number to everyone in a group works against that.
• Bulk message rules. Singapore's Spam Control Act applies to unsolicited commercial messages sent in bulk. That means more than 100 messages with the same or similar subject matter in 24 hours, and her email send alone was twelve times that. A message counts as unsolicited if the person did not ask for it or agree to it. Unsolicited bulk emails need "<ADV>" at the start of the subject line and a working unsubscribe route, and unsubscribes must be honored within 10 business days. The same Act has covered messages sent to instant messaging accounts since 2021, and WhatsApp fits its definition, so a WhatsApp group message reaching hundreds of members may count too. The "<ADV>" label is not required on instant messages, but the unsubscribe route is.
• Do Not Call rules. Marketing messages to Singapore phone numbers come under the PDPA's Do Not Call provisions, at any volume. Singapore's regulator says those provisions cover messages sent through data applications such as WhatsApp that use a Singapore telephone number. Before messaging a number, she needed either to check it against the Do Not Call Registry or to hold that person's clear and unambiguous consent in a form she can produce later.

United Kingdom

She collected her Manchester students' details while running a business in the UK, so UK rules governed that list from the start. Whether the UK regulator (the Information Commissioner's Office, which became the Information Commission on 30 September 2026 and still uses the name ICO) can reach a teacher who now works from Singapore is less clear. The UK's marketing regulations say nothing specific about senders based abroad, and UK data protection law follows her only in limited cases, chiefly if she is offering services to people in the UK. Being open to anyone online is usually not enough on its own. What matters is whether she aims her classes at people in the UK, and her plan points that way. Her comeback message went to her old Manchester students, invited them to the online classes, and told them the classes would fall in the UK morning.

She cannot know where each student now lives. Many are likely still in the UK, and some who came to Manchester from abroad may now be in France, Germany or elsewhere in Europe. The UK regulator's internal guidance for its staff, released in answer to a freedom of information request, looks for evidence that a business "intends to specifically target customers who are inside the UK," which must be more than "a neutral offer to the world at large." It adds that one such sign can be enough, though not automatically. So UK data protection law may well reach her for students who are in the UK when she uses their details.

EU data protection law uses the same test in the same words, and the EU regulators' guidance reads it the same way, so it may reach her too for students now living in the EU, where each country also has marketing rules of its own that this post does not cover. Because she cannot tell who is where, the safe course is to treat the UK rules as the benchmark for her whole Manchester list.

Those rules include one that helps her: the soft opt-in. A business can email former customers without fresh consent if all three of these are true:

• it got their details while selling, or negotiating to sell, them something;
• it is marketing its own similar products or services (yoga classes, not a skincare range);
• it gave them a simple way to opt out when it took their details, and gives one in every message since.

Former paying students who were offered an opt-out at sign-up may be fine. Students who were never offered one are not.

These rules are not only about email. The UK regulator's guidance says electronic mail covers "email and text (SMS) messages", "in-app messages" and "direct messaging on social media (ie private messages)". It does not name WhatsApp, but a WhatsApp message fits the description, so the cautious reading is that her message to UK numbers faces the same test.

The UK regulator is blunt about the six-year gap: "Consent for direct marketing does not last forever." How long it lasts "depends on the circumstances". A class list from six years ago is exactly where that question matters.

Keeping the list raises its own issue. UK data protection law says personal data should be kept "for no longer than is necessary". Six years of dormant addresses is hard to justify.

The UK raised the maximum fine for electronic marketing breaches in February 2026, to £17.5 million or 4% of global turnover, whichever is higher. That ceiling is built for mass spammers, not a yoga teacher. But the rules underneath it apply to everyone.

Dubai

The UAE's federal data protection law applies across the country, including mainland Dubai, and it can reach a business outside the UAE that handles the data of people inside it. It has been in force since 2 January 2022, but the Executive Regulations that put it into practice were still not listed on the UAE's official legislation portal on 1 October 2026. Businesses get six months from the day those regulations are issued to bring themselves into line. Studios registered in the DIFC financial free zone follow the DIFC's own data protection law instead.

In short: the UAE rules are still settling. The safe move is the same one that works everywhere else.

And then there are the platforms

Her email platform has its own rules, and they are the first she runs into. Mailchimp says "permission can go stale if you don't actively engage with" your contacts. If it has been a while, it recommends sending a reconfirmation email before any new campaign. It even suggests, where that is permitted, sending that reconfirmation from your own business email rather than through Mailchimp, because sent through Mailchimp, "the reconfirmation message itself may affect your sending reputation".

WhatsApp has rules too. Its terms of service list "bulk messaging" among the uses it does not allow, and adding hundreds of people to a group they never asked to join, to promote classes, puts the account at risk as well as the goodwill.

What she should have done

First, sort the list into the people she is still allowed to contact and the people she is not. Then one short message, before any relaunch message, to the first group only:

It's been a while. I'm teaching again. Would you like to hear about classes? [Yes, keep me on the list]

Then:

1. Keep everyone who says yes. Record when they said it.
2. Honor every unsubscribe, including every "take me off" reply on WhatsApp, and do not contact those people again. Keep only what she needs to recognize them, an email address or a phone number, on a short do-not-contact list, so they never get re-imported by accident. Delete everything else she holds about them.
3. Delete everyone who does not answer after a reasonable wait. That covers the "no longer than necessary" rule and protects the Mailchimp account at the same time.

The warm replies are lovely, but a reply is not the same as agreeing to future marketing. Send those people the yes link too.

A caution: asking is not a free pass. The UK regulator has fined companies for emailing people to ask whether they wanted marketing, and said that such a message "is still marketing". So for UK contacts, the ask should go only to people who meet the soft opt-in test. For Singapore numbers, it should go only after the Do Not Call check. For everyone else, do not message. Post the news where they can find it, on Instagram or in a group they already chose to join, and let them come back to her.

The rest of her setup

The comeback message was the risky moment. The everyday setup has a few things worth fixing while she is at it.

• Check who has the link, and turn off "anyone with the link".
• Delete old students' rows when she no longer needs them.
• If that sheet ever leaks, a breach affecting 500 or more people must be reported to Singapore's regulator within 3 calendar days of her working out that it is notifiable. A smaller breach is also notifiable if it is likely to cause significant harm, and then the people affected must be told too. The regulations list the kinds of data that count, so she should check that list, or ask the regulator, before deciding.

"But I do not have a website. Where does a privacy notice even go?"

This is where most solo teachers stop. Every guide assumes a website footer.

She does not need one. That is the relief: no website required. Everything in this story, from the privacy notice to the record of who said yes, can live in Dxtra and be reached from her phone.

• A privacy notice at its own link. Dxtra writes her privacy notice (often called a privacy policy) from a few questions about her classes, and publishes it on her own Transparency Center, a hosted privacy page with its own link and QR code. The link goes in her Instagram bio, the WhatsApp community description and her email footer. The QR code goes on a printed card at the studio and on the opening slide of every online class.
• A record of every yes. Consent is logged with a timestamp, so "when did this person agree to hear from me?" has an answer, for the Singapore regulator or anyone else who asks.
• Her tools, accounted for. Dxtra connects to Mailchimp, Xero and Meta, and keeps a record of each provider that handles her students' details. That is the list her privacy notice needs, and the first thing to check when sending data overseas.
• Requests handled, not lost in a chat. When a student asks what she holds, or asks her to delete it, the request is tracked from start to finish, with the deadline in view.
• A plan if the Sheet leaks. Dxtra's incident workflow walks her through deciding whether a breach is notifiable and tracks the 3-calendar-day deadline for notifying the regulator, with ready-made notices for the regulator and for students.
• Her role, written down. As a solo teacher she is the person responsible for data protection. Dxtra gives her guided steps for that job.
• No new copy of her students' details. Each student can get a link to their own personal view of the Transparency Center by entering their email address. Dxtra does not store that address, or the student's name. Each student is recognized by a pseudonymous identifier, matched against a salted hash of the address, so her privacy compliance tool is not one more place their names and addresses are kept.

Her notice can be in English plus a second language, chosen from 75. Plans start at about S$13 (US$10) a month, with a 14-day money-back guarantee on the START plan.

Find out where you stand in a minute

• No website? The 30-second quiz is built for businesses that run on social media, messaging apps and spreadsheets. Six questions, a risk band, no account.
• Have a website, or teach through a studio that does? The free privacy scan opens the site in a real browser and checks what a regulator would look at: the privacy notice, the cookies and trackers that load, and whether "Reject all" actually works. It returns a risk band with cited findings. No account needed.

The short list

1. Old list or old contacts? Work out who you may still contact, then send those people one "do you still want to hear from me?" message. Keep the yeses, and record the date.
2. Keep a short do-not-contact list of everyone who unsubscribes: just an email address or number, so they are never re-imported. Delete the rest of their details.
3. Delete anyone who does not answer, and old students you no longer need.
4. Move the WhatsApp group to a community announcement group, so students' numbers are not shared with everyone.
5. Lock down the Sheet, and be especially careful with the health notes column.
6. Ask before filming, and take a video down if not everyone in it has consented.
7. Name yourself as the person responsible for data protection.
8. Publish a privacy notice at a link, and put it in your Instagram bio, WhatsApp description and email footer, with a QR code at the class venue.

Sources

Current as of 15 October 2026. Thresholds, fines, platform features and regulations move; check the linked source before you rely on any of them.

• Personal Data Protection Act 2012 (Singapore Statutes Online): definition of organization (s 2, s 4), naming a responsible person and publishing contact details (s 11), consent for collection, use and disclosure (s 13) and the exceptions (s 17), notification (s 20), protection of personal data (s 24), retention (s 25), overseas transfers (s 26), breach notification within 3 calendar days (s 26D)
• Data protection officers (PDPC): the role can be added to an existing role in the organization
• Data protection obligations (PDPC): notification, consent, transfer limitation
• Personal Data Protection (Notification of Data Breaches) Regulations 2021 (Singapore Statutes Online): the 500-person scale threshold; the prescribed classes of personal data
• Advisory Guidelines on Key Concepts in the PDPA (PDPC): consent for direct marketing messages
• Advisory Guidelines on the Do Not Call Provisions (PDPC): the provisions cover data applications such as WhatsApp that use a Singapore telephone number
• Spam Control Act 2007 (Singapore Statutes Online): the definition of unsolicited, bulk thresholds, instant messaging accounts, the "<ADV>" label and its instant-messaging exception, the 10-business-day unsubscribe rule
• Singapore's personal data protection regime enhanced (Jones Day): Spam Control Act extended to instant messaging accounts from 1 February 2021
• Privacy and Electronic Communications Regulations 2003, regulation 22 (legislation.gov.uk) and Direct marketing using electronic mail (ICO): the three soft opt-in conditions
• Key concepts for direct marketing using electronic mail (ICO): what counts as electronic mail
• What are the PECR rules? (ICO): no specific rules for organizations based outside the UK
• ICO issues fines for emails seeking consent to marketing (RPC): a message asking for marketing consent "is still marketing"
• Direct marketing checklist (ICO): keep a "do not contact" or suppression list of people who opt out, holding only "a small amount of their information"
• Respect people's preferences (ICO): suppression means keeping "just enough information" to respect someone's preferences
• Plan your direct marketing (ICO): "Consent for direct marketing does not last forever"
• UK GDPR Article 3 (legislation.gov.uk): territorial scope, including organizations outside the UK that offer goods or services to people in the UK; ICO internal guidance on territorial scope, released under FOI request IC-327905-Y2Y5 (ICO response, 5 September 2024): staff guidance from the ICO's internal knowledge library, not formal published guidance; an organization must intend "to specifically target customers who are inside the UK," more than "a neutral offer to the world at large"; a website being accessible in the UK is not enough; the individuals must be physically in the UK when their data is used
• EU GDPR Article 3 (EUR-Lex): the same territorial test for organizations outside the EU that offer goods or services to people in the EU; EDPB Guidelines 3/2018 on territorial scope: the EU regulators' guidance on that test; a website's mere accessibility is not enough, and the test is aimed at activities that target people "intentionally, rather than inadvertently or incidentally"
• Storage limitation (ICO): "no longer than is necessary"
• What the ICO's transformation into the Information Commission means for your organisation (Lewis Silkin) and UK: ICO governance reforms take effect (CMS): the Information Commissioner's Office became the Information Commission on 30 September 2026 and continues to be known as the ICO
• Data (Use and Access) Act 2025 (Commencement No. 6) Regulations 2026: higher fines for email marketing breaches in force from 5 February 2026
• Key aspects of the Data (Use and Access) Act take effect (Clifford Chance): £17.5 million or 4% of global turnover
• UAE data protection trends 2026 (Chambers): federal law applies across the UAE; DIFC and ADGM excluded
• Federal Decree-Law No. 45 of 2021 (UAE Legislation): scope (Article 2), six months to comply once the Executive Regulations are issued (Article 29), in force from 2 January 2022 (Article 31); no Executive Regulations listed on 1 October 2026
• Requirements and best practices for audiences (Mailchimp): "permission can go stale"
• Examples of compliant and non-compliant lists (Mailchimp): send a reconfirmation email if it has been a while
• Reconfirm contacts (Mailchimp): send the reconfirmation from your own email; "the reconfirmation message itself may affect your sending reputation"
• Announcement groups (WhatsApp Help Center): "admins can see who the members are"
• Terms of Service (WhatsApp): bulk messaging is not allowed
• It's time to reserve your WhatsApp username (WhatsApp Blog): sharing a phone number with people you have never met, including in groups; usernames announced
• Dxtra pricing: $10/month START plan, 14-day money-back guarantee, English plus additional languages by plan
• Dxtra product: privacy notice generation, consent records, processor management, rights requests, breach and incident reporting, support for the owner as the responsible person, and integrations including Mailchimp, Xero and Meta
• Free privacy scan and 30-second quiz: risk band with cited findings; the quiz is for businesses without a website

The teacher in this story is a composite drawn from several real teachers. This article is general information, not legal advice. Rules change; confirm anything that matters with Singapore's Personal Data Protection Commission, the UK's Information Commission (ICO) or a qualified adviser before you rely on it.

Teach. We will keep the records.

You already run your business from your phone. Your privacy can live there too, at a link, with no website required. Take the 30-second quiz or get started with Dxtra from $10/month.