Private organisations still using NRIC numbers for authentication may face sanctions from 2027

Private organisations that have not phased out the use of NRIC numbers for authentication will risk breaching the Personal Data Protection Act (PDPA) from Jan 1, 2027.

In a statement on Feb 2, the Personal Data Protection Commission (PDPC) said that organisations that continue to use NRIC numbers for authentication to access personal data may be failing to make reasonable security arrangements to protect personal data. This would constitute a breach of the PDPA.

“From Jan 1, 2027, the PDPC will step up enforcement action against such misuse, including imposing directions or financial penalties for such breaches where appropriate,” said the commission.

Read more at: https://www.straitstimes.com/singapore/private-organisations-still-using-nric-numbers-for-authentication-may-face-sanctions-from-2027