๐๐ ๐ฎ๐ค๐ช๐ง ๐๐ช๐จ๐๐ฃ๐๐จ๐จ ๐จ๐ฉ๐๐ก๐ก ๐ช๐จ๐๐จ ๐๐๐๐พ ๐ฃ๐ช๐ข๐๐๐ง๐จ ๐ฉ๐ค ๐๐ช๐ฉ๐๐๐ฃ๐ฉ๐๐๐๐ฉ๐ ๐๐ช๐จ๐ฉ๐ค๐ข๐๐ง๐จ, ๐๐ฟ๐๐พ ๐ฌ๐๐ฃ๐ฉ๐จ ๐ฎ๐ค๐ช ๐ฉ๐ค ๐จ๐ฉ๐ค๐ฅ. ๐ผ๐ฃ๐ ๐ฉ๐๐๐ฎ'๐ง๐ ๐ฃ๐ค๐ฉ ๐๐จ๐ ๐๐ฃ๐ ๐ฃ๐๐๐๐ก๐ฎ.
You send your customer a PDF statement. Before they can open it, you ask them to key in the last four digits of their NRIC. Feels responsible, right? You're verifying their identity. You're protecting their data.
Except you're not. You're doing the opposite.
Every time you ask a customer to key in their NRIC โ full or partial โ to access a file, open an account, or verify their identity, you're asking them to risk one piece of confidential data in order to protect another. That's not security. That's a paradox.
PDPC has recognised this, and they've made it clear: businesses should not use full or partial NRIC numbers as an authentication factor. This isn't a suggestion. Enforcement begins by January 2027, and if your systems still rely on NRIC-based authentication by then, you are not compliant with the PDPA.
๐ช๐ต๐ฎ๐ ๐ง๐ต๐ถ๐ ๐ ๐ฒ๐ฎ๐ป๐ ๐ณ๐ผ๐ฟ ๐ฌ๐ผ๐๐ฟ ๐๐๐๐ถ๐ป๐ฒ๐๐
If you currently use NRIC โ even just the last four digits โ for any of the following, you need to make changes:
- Password-protecting PDF statements or documents
- Customer login or account verification
- Identity authentication for accessing sensitive information
The intent behind the guideline is straightforward: NRIC numbers are permanent, unique identifiers. They cannot be changed if compromised. Using them as passwords or PINs treats them as disposable credentials when they are anything but.
๐ ๐ ๐๐ฑ๐๐ถ๐ฐ๐ฒ ๐ฎ๐ ๐ฎ ๐๐ฃ๐ข
๐๐ถ๐ฟ๐๐, ๐ฎ๐๐ฑ๐ถ๐ ๐๐ผ๐๐ฟ ๐๐๐๐๐ฒ๐บ๐ ๐ป๐ผ๐. Identify everywhere your business uses NRIC โ full or partial โ for authentication. Don't wait until late 2026 to scramble.
๐ฆ๐ฒ๐ฐ๐ผ๐ป๐ฑ, ๐๐๐ถ๐๐ฐ๐ต ๐๐ผ ๐ฝ๐ฟ๐ผ๐ฝ๐ฒ๐ฟ ๐ฎ๐๐๐ต๐ฒ๐ป๐๐ถ๐ฐ๐ฎ๐๐ถ๐ผ๐ป ๐บ๐ฒ๐๐ต๐ผ๐ฑ๐. There are proven alternatives that protect your customers without putting their personal data at risk:
- SMS or email one-time passwords (OTP)
- Two-factor authentication (2FA) apps
- Unique PINs or passwords set by the customer themselves
๐ง๐ต๐ถ๐ฟ๐ฑ, ๐๐๐ผ๐ฝ ๐๐๐ถ๐ป๐ด ๐ฏ๐ถ๐ฟ๐๐ต ๐ฑ๐ฎ๐๐ฒ๐ ๐๐ผ๐ผ. PDPC hasn't explicitly banned birth dates as authentication yet, but as a DPO, I'd tell you it's only a matter of time. Birth dates are easily guessable and widely exposed. Don't replace one soon-to-be-banned method with another that's heading in the same direction.
๐๐ผ๐ป'๐ ๐ช๐ฎ๐ถ๐ ๐ณ๐ผ๐ฟ ๐๐ป๐ณ๐ผ๐ฟ๐ฐ๐ฒ๐บ๐ฒ๐ป๐ ๐๐ผ ๐๐ผ๐ฟ๐ฐ๐ฒ ๐ฌ๐ผ๐๐ฟ ๐๐ฎ๐ป๐ฑ
You have until January 2027. That sounds like plenty of time โ until you factor in system changes, vendor coordination, and customer communication. Start now.
If you need help auditing your authentication practices or transitioning to compliant alternatives, schedule a consultation with us at Veritos - https://calendly.com/veritos/introductory. We'll help you get this sorted before the deadline, not after.
PDPCโs official announcement can be found in their press release: Organisations to Cease the Use of NRIC Numbers for Authentication by 31 December 2026 https://www.pdpc.gov.sg/news-and-events/press-room/2026/01/organisations-to-cease-the-use-of-nric-numbers-for-authentication-by-31โdecember-2026