In more detail
The PDPC emphasised that NRIC numbers should not be used as passwords. The PDPC also highlighted that organisations must avoid using NRICs for authentication purposes, and that it has consistently taken organisations to task for using NRIC numbers for authentication. Organisations should not use NRIC numbers as user names or unique identifiers in their applications, websites or public-facing systems.
The PDPC also clarified that NRIC numbers should not be used as default passwords for services provided to individuals and warned organisations with such practices to phase them out as soon as possible. Instead, authentication practices for administrative accounts should be designed with strong requirements, such as complex passwords or multi-factor authentication.
Further, the PDPC stressed that NRIC numbers are still subject to data protection obligations under the Personal Data Protection Act (PDPA). As such, organisations must still obtain valid consent from individuals where required and comply with reasonable use of NRIC numbers in accordance with such obligations.
Key takeaways
While the PDPC continues to update its Advisory Guidelines on the PDPA for NRIC and Other National Identification Numbers, the PDPC’s recent statement on the use of NRIC numbers provides timely clarification on how such personal data should be treated and protected by organisations.
* * * * *
For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.
© 2025 Baker & McKenzie. Wong & Leow. All rights reserved. Baker & McKenzie. Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.
