In this guide · 8 sections
The rule in one paragraph
The PDPC's Advisory Guidelines on the PDPA for NRIC and other national identification numbers say organisations are generally not allowed to collect, use or disclose NRIC numbers or copies of NRIC. The PDPC began applying this interpretation from 1 September 2019. The same treatment covers birth certificate numbers, foreign identification numbers (FIN) and work permit numbers, and the PDPC says passport numbers should be treated in a similar way. The rules on keeping a physical NRIC also apply to other ID documents containing these numbers, such as a driving licence, passport or work pass.
The reason is simple: an NRIC number is permanent and can't be changed. If it leaks, it can be used for identity theft and fraud for the rest of the person's life.
When you may collect an NRIC number
There are two main situations in the guidelines:
- It is required under the law (or a PDPA exception applies). You may collect it without consent, but as good practice should still tell the person why.
- It is necessary to accurately establish or verify the person's identity to a high degree of fidelity. You may collect it with notification and consent, and you must be able to justify why it's necessary if the person or the PDPC asks.
The PDPC says high-fidelity identification is generally justified where getting someone's identity wrong could pose a significant safety or security risk (its example is visitor entry to preschools), or a risk of significant impact or harm to the individual or the organisation, such as fraudulent claims. It says these cases typically involve healthcare, financial or real estate matters, such as property transactions and insurance applications and claims.
Collecting a copy of the NRIC means you have collected all the personal data on it, including photo, address and date of birth, so ask whether you really need the copy rather than just the number.
The PDPC's examples, in a table
The guidelines work through everyday cases. A selection:
| Situation | NRIC allowed? | Why |
|---|---|---|
| Checking into a hotel | Yes | The Hotels Licensing Regulations require the guest's name and NRIC number |
| Registering as a patient at a GP clinic | Yes | The PDPC treats it as required under the law, to keep accurate medical records |
| A massage establishment's client register | Yes | Required by the Massage Establishments Rules |
| Hiring a new employee | Yes | The Employment Act requires employee records |
| Collecting online movie tickets | No | Use a booking reference or SMS confirmation instead |
| Mall free-parking redemption | No | Record name, partial NRIC, vehicle number or phone instead |
| Retail membership account | No | Use mobile number, email, a member ID or partial NRIC |
| Holding an NRIC as collateral for a bicycle rental | No (don't retain it) | Use another form of collateral, such as a reasonable deposit |
If your situation isn't on the list, the PDPC's test still applies: is it required by law, or do you genuinely need high-fidelity identification? For most bookings, enquiries, memberships, lucky draws and newsletter sign-ups, the answer is no.
Partial NRIC numbers
The guidelines say that collecting a partial NRIC number, up to the last 3 digits and the checksum letter (for example "567A" from "S1234567A"), is not treated as collecting the full NRIC number.
Two cautions. A partial NRIC is still personal data where someone can be identified from it, alone or with other information you hold, so it must be protected like any other personal data. And the PDPC's technical guide to these guidelines gives more detail on how partial numbers should be handled.
If you need a short identifier for a visitor log or a membership list, ask for a mobile number or issue your own member number. Use partial NRIC only when the alternatives genuinely don't work.
Never use NRIC numbers as passwords
On 26 June 2025, the PDPC and CSA issued an advisory telling private-sector organisations to stop using NRIC numbers to authenticate people. The Ministry of Digital Development and Information's announcement explains the difference:
- Organisations may use NRIC numbers to identify who a person is, for example over the phone.
- They should not use NRIC numbers to prove that a person is who they claim to be, for access to services or information meant only for that person.
- That includes not setting NRIC numbers as default passwords, for example on password-protected PDFs sent by email.
- It also includes not combining partial NRIC with other easily obtained data, such as a password made of partial NRIC plus date of birth ("567A01Jan80").
The announcement suggests alternatives where authentication is needed, such as strong passwords, security tokens or fingerprint identification. If you send payslips, statements or reports as protected files, switch to a secure portal or a password shared separately.
Checking your own forms and systems
- List every place you ask for NRIC numbers: website forms, booking tools, sign-up sheets, visitor logs, contracts, spreadsheets.
- For each, write down whether the law requires it or why you need high-fidelity identification. If you can't, stop collecting it.
- Replace NRIC fields with alternatives: mobile number, email, booking reference, your own member ID or partial NRIC.
- Delete NRIC numbers and copies you no longer need, including scans in email inboxes and shared drives.
- Where you must keep them, limit who can see them, and protect the system with MFA and encryption.
- Remove NRIC-based default passwords on files and portals, and tell customers the new method.
- Update your privacy policy and staff guidance to match.
Front-desk practice matters too: don't photocopy or keep a visitor's IC, and don't leave sign-in sheets with full NRIC numbers on a counter. Our PDPA checklist for small businesses covers the wider obligations, and our website privacy policy guide covers your online forms.
Do it yourself or get help?
Most small businesses can fix NRIC collection themselves with the checklist above: it's mainly a matter of removing fields and changing habits.
The PDPA Compliance Pack (S$690) maps where you collect personal data, including NRIC numbers, and gives you a privacy policy, staff data protection policy and breach plan. A Security Health Check (S$290) reviews your email, website and workspace settings and flags risky practices such as NRIC-based passwords. We are not a law firm; for complex or regulated cases, ask a data protection lawyer.
Frequently asked questions
Generally no. Under the PDPC's advisory guidelines, a business may collect NRIC numbers only if the law requires it, or if it must verify your identity to a high degree of fidelity, with notice and consent. For most memberships, bookings and lucky draws it isn't allowed.
The guidelines say collecting up to the last 3 digits and the checksum letter (for example "567A") is not treated as collecting the full NRIC number. It is still personal data and must be protected.
No, unless the law requires you to retain it. The PDPC's example of a bicycle rental says the shop should not keep customers' physical NRICs and could use another form of collateral, such as a reasonable monetary deposit.
No. The June 2025 PDPC and CSA advisory tells organisations to stop using full or partial NRIC numbers to authenticate people, including as default passwords on files sent by email.
Yes. The guidelines apply the same treatment to birth certificate numbers, FIN and work permit numbers, and say organisations should treat passport numbers in a similar way and refrain from collecting them where they can.