In more detail
The PDPC and the CSA have issued a joint advisory cautioning organizations against using NRIC numbers to authenticate individuals. Authentication refers to the process of verifying a person's identity before granting access to services or information intended solely for them. It differs from identification, which simply involves distinguishing one individual from another.
The advisory stresses that NRIC numbers should not be used as a means of authentication — whether as standalone credentials, default passwords or in combination with other easily obtained personal data such as date of birth. This is because they are issued to uniquely identify a person and must be assumed to have been disclosed to at least a few other persons, making them unsuitable for secure authentication.
Organisations are urged to stop as soon as possible any ongoing use of full or partial NRIC numbers for authentication and to adopt alternative, more secure methods. These alternatives should be selected using a risk-based approach that considers the value and sensitivity of the information being protected, potential threats and vulnerabilities, and user accessibility.
Examples of authentication methods include the following:
- Something the user knows, such as strong, complex passwords
- Something the user owns, such as a security token or smart card
- Something the user has, such as fingerprint, face, iris, or palm vein
The advisory also provides links to relevant guidance published by the CSA and the PDPC.
Key takeaways
Private organisations should refrain from using NRIC numbers for authentication with immediate effect and consider alternative methods, such as strong passwords or individual-specific authentication options.
* * * * *
For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.
* * * * *
© 2025 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
