Key takeaways
  • Private organisations must stop using full or partial NRIC numbers for authentication by 31 December 2026.
  • From 1 January 2027, PDPC will step up enforcement, including directions or financial penalties where appropriate.
  • The most common fix for SMEs: stop locking payslips and other documents with the person's NRIC.

What the rule says

The Personal Data Protection Commission (PDPC) has announced that private organisations have until 31 December 2026 to phase out the use of NRIC numbers for authentication. From 1 January 2027, PDPC will step up enforcement against organisations that use full or partial NRIC numbers for authentication.

Authentication means proving that a person is who they claim to be, before giving them access to services or information meant only for them. This is different from identification, where identifiers such as names are used to tell people apart.

PDPC’s reasoning is simple. NRIC numbers are issued to identify people, and must be assumed to be known to others. So knowing someone’s NRIC number does not prove you are that person.

The key point: being able to state someone’s NRIC number does not prove you are that person.

Practices that must stop

These are the everyday examples we see most often in Singapore SMEs:

  • Payslips or documents emailed with the person’s NRIC as the password. PDPC specifically names password-protected files sent by email.
  • NRIC numbers as default passwords for system, portal or account logins.
  • Passwords combining a partial NRIC with a date of birth, such as 567A01Jan80. PDPC uses this exact example.
  • Giving out information or account access because someone quoted their NRIC number and date of birth, for example over the phone or at the counter.

A simple test: if knowing a person’s NRIC number is what unlocks an account, a document or information, it must stop.

What to use instead

PDPC and the Cyber Security Agency of Singapore (CSA) suggest these alternatives when sending or giving access to documents:

Situation Suggested method
Documents the person may need to access again A website or app with a user account, plus multi-factor authentication
One-off documents An expiring or single-use link, with a unique password sent through a separate channel (e.g. SMS to their registered mobile)
Web or app access is not feasible Email the document with a unique password set by you, sent through a separate channel

For logins, use strong passwords that are not easily guessed, and turn on two-factor authentication. PDPC and CSA note that methods based on something the person owns (such as a security token) or something they have (such as a fingerprint) offer stronger protection against phishing.

What happens from 1 January 2027

Organisations that use NRIC numbers for authentication to access personal data may be found to have breached the PDPA for failing to make reasonable security arrangements to protect personal data. From 1 January 2027, PDPC will step up enforcement against such misuse, including directions or financial penalties where appropriate.

PDPC has also said that the Infocomm Media Development Authority, the Monetary Authority of Singapore and the Ministry of Health have issued guidance for the telecommunications, finance and insurance, and healthcare sectors on the same change.

Quick checklist

  • Payslips and HR documents are not locked with NRIC numbers
  • Customer documents, statements and reports are not locked with NRIC numbers
  • No system or portal logins use NRIC numbers as default passwords
  • Staff do not give out information just because someone quoted an NRIC number and date of birth
  • Staff know the new process before 31 December 2026

Start with payslips. If your payroll system or provider locks payslips with the employee’s NRIC, change it before your December payroll run.

Sources

General guidance only, not legal advice.

Written by
Eugene Ng

Eugene is the founder of Core Vault and acts as the appointed Data Protection Officer for Singapore businesses.