Private organisations in S'pore to stop using NRIC numbers for authentication by Dec. 31, 2026

Private organisations in Singapore will have until Dec. 31, 2026 to phase out the use of NRIC numbers for authentication, said the Personal Data Protection Commission (PDPC) in a media release.

This comes after PDPC and the Cyber Security Agency of Singapore (CSA) said in a June 2025 joint advisory that NRIC numbers should not be misused for authentication.

NRIC not for authentication

According to the release, such passwords should not be used to access digital documents or to allow access to an individual’s account.

Government agencies have already moved away from using NRIC numbers for authentication, the release noted, adding that this is to reduce the risk of unauthorised access to services and information.

In addition, the Infocomm Media Development Authority (IMDA), Monetary Authority of Singapore (MAS) and the Ministry of Health (MOH) have also issued guidance to the telecommunications, finance and insurance, and healthcare sectors, on ceasing the use of NRIC numbers for authentication within their sectors.

Enforcement against misuse from 2027

The release added that all private organisations are urged to review their current practices and phase out the use of NRIC numbers for authentication by Dec. 31, 2026.

Following this, organisations that use NRIC numbers for authentication to access personal data may be found to have breached the Personal Data Protection Act (PDPA) for failing to make reasonable security arrangements to protect personal data.

From Jan. 1, 2027, PDPC will then step up enforcement action against private organisations that use full or partial NRIC numbers for authentication, which includes imposing directions or financial penalties for such breaches where appropriate.

As such, organisations may also refer to PDPC's latest advisory on good practices for protecting personal data, including NRIC numbers.

Members of public may report any misuse of NRIC numbers for authentication to PDPC online.

Top photo via ICA website