From 1 January 2027, the Personal Data Protection Commission (PDPC) will step up enforcement against private organisations that continue using NRIC numbers for authentication. Businesses have until 31 December 2026 to phase out these practices.
But does this mean companies must also stop asking customers for NRIC details, collecting photocopies of identity cards or maintaining NRIC records?
No. Businesses can still collect, use and retain NRIC information where it is required by law or necessary for legitimate, high-accuracy identity verification. What they must stop doing is using NRIC numbers as passwords or as proof that someone is entitled to access confidential information.
This distinction matters for employers, banks, accounting firms, corporate service providers and many other businesses that legitimately handle identification documents.
Identification vs authentication: What's the difference?
The government's guidance distinguishes between two activities:
Identification means establishing who a person is or distinguishing one individual from another. For example, a company uses an employee's NRIC number to maintain accurate employment records.
Authentication means establishing that someone claiming to be a particular person is genuinely that person before granting access to information or services.
Six months later, someone calls the provider requesting confidential company records. Knowing the owner's NRIC number and date of birth is not, by itself, proof that the caller is authorised to receive those records. The provider should authenticate the requester separately.
The NRIC number is an identifier, not a secret.
What can businesses still do with NRIC information?
The 2027 deadline does not introduce a blanket ban on collecting NRIC numbers or photocopying identity cards.
However, existing Personal Data Protection Act (PDPA) requirements continue to apply. Under the PDPC's NRIC guidelines, collection of NRIC numbers or copies is permitted when required by law or when accurate identification or verification to a high degree of fidelity is genuinely necessary. The purpose must be justified. Simply obtaining someone's consent does not automatically make unnecessary NRIC collection appropriate.
| Business activity | Permitted? | Explanation |
|---|---|---|
| Collecting a director's NRIC number for company incorporation | Yes | Corporate service providers must obtain identification particulars for required due diligence and filings. |
| Requesting and retaining a scanned NRIC for statutory KYC | Yes | Permitted where needed to fulfil legal identity-verification and recordkeeping obligations. |
| Collecting an employee's NRIC number after hiring | Yes | Employers have statutory employment-record requirements. |
| Collecting NRIC details during a job application | Generally not necessary | Employers should distinguish job applications from records required once someone is hired. |
| Collecting NRIC information for financial or regulated transactions | Where justified | Permitted where legislation requires it or high-accuracy identity verification is necessary. |
| Using an NRIC number to locate an existing customer record | Conditionally | Collection and use must be lawful; separate authentication is still needed before access to protected information. |
| Photocopying every customer's NRIC for an ordinary loyalty programme | Generally not justified | A routine membership programme rarely establishes a need for such extensive identity information. |
| Keeping a customer's original physical NRIC as a deposit | Generally not permitted | Retaining the physical card is different from recording details or keeping a justified copy. |
Businesses should collect only the information needed for the specific purpose and protect the information they retain.
Can company incorporation firms still request NRIC photocopies?
Yes, and this is an important example of why the new deadline should not be confused with a ban on identity verification.
Registered Corporate Service Providers (CSPs) in Singapore have customer due diligence obligations under the Corporate Service Providers Regulations 2025.
Regulation 20 requires CSPs to obtain relevant identifying particulars, including NRIC, FIN or passport numbers, and to verify identities using reliable and independent sources. Under Regulation 20(8)(c), CSPs must also retain copies of documents used to establish and verify the relevant identities and authority to act.
For company incorporation, this means corporate service providers can continue requesting identification details and supporting documents needed to verify proposed directors, relevant beneficial owners and other persons covered by their due diligence obligations.
These checks help prevent identity misuse and support compliance with anti-money laundering requirements.
Regulation 30 also requires CSPs to keep customer due diligence records for five years after they stop providing corporate services to the customer.
This does not necessarily mean photocopies must be submitted to ACRA as part of every incorporation application. The documents may instead form part of the CSP's own regulatory due diligence records.
It also does not authorise businesses to keep customers' original physical NRIC cards. A photocopy or digital record is not the same as retaining the original card.
What must businesses stop doing by 31 December 2026?
The PDPC and Cyber Security Agency of Singapore (CSA) have specifically warned against using full or partial NRIC numbers as authentication credentials.
| Practice to phase out | Why it is unsafe | Better alternative |
|---|---|---|
| Using a customer's full NRIC number as a password for an emailed PDF | Someone who knows the number could open the document. | Use a separately generated password shared securely, or a secure document portal. |
| Using the last four NRIC characters as a login PIN | Partial NRIC numbers are not reliable secrets. | Use an independently created PIN or stronger authentication. |
| Combining an NRIC number with a birthdate as a default password | Both details may be obtainable by others. | Use unique passwords and multi-factor authentication. |
| Giving out confidential records after a caller states their NRIC number | Knowing the number does not prove the caller's identity. | Verify through an established, independent authentication process. |
| Using an NRIC number to reset an account password | Someone with the number could impersonate the account holder. | Use secure recovery through an existing trusted channel. |
For example, businesses using payroll software should check whether payslips or tax documents are automatically password-protected using NRIC numbers. Accounting and administrative firms should also review default passwords used for files sent to clients.
Simply switching from a full NRIC number to its last four characters does not resolve the underlying problem.
How should businesses handle NRIC information going forward?
Businesses do not need to remove every NRIC field from their systems. Instead, they should review why each field exists and how it is used.
- Review collection practices. Identify where NRIC numbers or copies are collected, and confirm each use has a valid legal or operational justification.
- Check passwords and access controls. Look for NRIC-based passwords in customer portals, HR systems, emailed documents and internal applications.
- Separate identification from authentication. When an NRIC identifies a customer record, require appropriate separate authentication before providing confidential information or authorising sensitive requests.
- Protect retained records. Restrict access to identity documents, use secure storage and avoid unnecessary disclosure.
- Review retention periods. Keep records as long as required for legal or legitimate business purposes, rather than indefinitely.
Other national identification information, including FIN and passport details, must also be handled responsibly. The announced 31 December 2026 phase-out specifically concerns NRIC-based authentication, but using other easily obtained identifiers as passwords creates similar risks.
What happens from 1 January 2027?
The PDPC will step up enforcement against private organisations that continue using NRIC numbers to authenticate individuals.
An organisation that uses NRIC-based authentication to protect access to personal data may be found to have failed to implement reasonable security arrangements under the PDPA. Where appropriate, enforcement action can include directions or financial penalties.
This is not a new requirement to erase legitimately collected NRIC information. It is a move to stop organisations from relying on information that is not secret as proof of identity.
For companies that already collect NRIC information for valid reasons, the practical task is to review how that information is used, particularly when granting access to accounts, documents or confidential records.
If you're incorporating a company in Singapore, we'll continue requesting the identification information and supporting documents required for proper KYC and regulatory compliance. We can also explain why each document is needed during onboarding.
