On 9th December 2024, the Accounting and Corporate Regulatory Authority (‘ACRA’) updated Singapore’s Bizfile portal, a digital service portal for business registration, filing and information, which included a new search function that revealed individuals’ National Registration Identity Card (‘NRIC’) numbers that were designated as Personally Identifiable Information (‘PII’) till then. This sparked public concern, especially in light of the increasing prevalence of identity theft scams. More than 500,000 searches for individuals were made on the Bizfile portal during the five-day period from December 9 to 13, when full NRIC numbers were made available. This increased from the usual daily traffic of 2,000 to 3,000 queries through the portal’s free People Search function. Most of these queries came from an estimated 28,000 IP addresses, most from Singapore.
On 14th December, the Ministry of Digital Development and Information (‘MDDI’), in response to concerns, issued a statement that NRIC numbers should be treated like names and not classified as PII. The Personal Data Protection Commission (‘PDPC’) announced on December 16, 2024, that it would update guidelines on NRIC numbers following a public consultation. However, it did not specify when this consultation would conclude. The PDPC emphasised that NRIC numbers remain subject to data protection obligations under the Personal Data Protection Act, 2012 (‘PDPA’), meaning organisations must obtain valid consent for collecting NRIC data, ensure reasonable use, and provide adequate protection. Until now, NRIC numbers were considered PII under PDPC. PII refers to any information that can be used to distinguish one individual from another. Examples include name, email address, and phone number. In the past, NRIC numbers were considered sensitive PII in Singapore because they could be used to identify individuals and access a range of services uniquely. This classification was reflected in the regulations that restricted the collection and use of NRIC numbers by private sector organizations.
A review was launched to investigate how full NRIC numbers came to be revealed by ACRA on its new business portal. The review is expected to be completed in February 2025. The findings of the review will be made public. The PDPC’s FAQ clearly stated that private sector organisations were only allowed to collect, use, or disclose NRIC numbers if required by law or necessary to establish an individual's identity to a high degree of accuracy. However, the MDDI’s initial statement that NRIC numbers are assumed to be known, just like names, contradicts the previous understanding and regulations. Digital Development and Information Minister Josephine Teo has since clarified in Parliament that NRIC numbers remain a form of personal data and should only be collected and used when necessary. While the government has indicated that it will update guidelines on NRIC numbers, the sudden policy shift and lack of a clear alternative system have created uncertainty and raised concerns about data breaches and identity theft.
The abovementioned incident raises three main concerns:
First, there were inconsistencies in government policies, and ACRA was left to take the responsibility for “misinterpreting” an internal circular. At the same time, there were altered positions without adequate public communication on the PDPA website. Truthfully, if ACRA misinterpreted the circular, the initial response from MDDI would have been different, which is why we would like to call out on this issue.
Second, despite the NRIC's integral role in Singapore's identification framework across telecommunications, banking, insurance, and legal sectors, the abrupt policy shift lacks a viable alternative system. On a policy level, this left a bad taste as the organisations have no recommended pathway to rectify the issue, leaving NRIC still the default, while it became “public”, increasing the vulnerability of their verification system.
Thirdly, the significant regulatory change was initially announced casually through a press release rather than formal channels, leading to business implementation ambiguity. The transition from NRIC as a sensitive identifier, while important for privacy protection, faces implementation challenges that could benefit from clearer communication and more systematic execution. Since NRIC usage was historically integrated into many institutional processes, citizens and organisations may require additional guidance to adapt to and embrace alternative identification methods effectively.
Therefore, in hindsight, the general approach was not helpful in addressing the concerns of the policies around NRIC.
NRIC is a mandatory identity document for all Singapore citizens and permanent residents aged 15 and above, containing a unique identifier that starts with 'S' (for citizens) or 'F' (for permanent residents) followed by seven digits and a checksum letter. Prior to the Bizlife portal incident, organisations and businesses routinely collected NRIC numbers for purposes ranging from visitor registration and membership applications to event sign-ups and facility bookings, with minimal restrictions on its collection or display.
On 11th January 2025, The Immigration and Checkpoints Authority (ICA) temporarily suspended an electronic service that allowed Singapore residents to change their residential addresses online after it was discovered that perpetrators were using stolen or compromised Singpass accounts to change the addresses of victims. The perpetrators would then use the changed address to set a new password for the victim’s Singpass account. While it is stated in the press release that the incident has nothing to do with the ACRA NRIC incident, it was suspiciously close to the incident, and therefore, we included it here.
As a part of confirmation of the sensitivity of NRIC number, in an incident reported on 26th January 2025, personal data of over 3,300 individuals, including their NRIC, was leaked due to a ‘technical issue’ at the regulator for property agents. It was considered a data privacy issue.
The debate surrounding the classification of NRIC in Singapore is complicated by the definitions of PII and Personal Data.
Part of the core of this issue is the definition of Personal Data (PD) and Personally Identifiable Information (PII). In Singapore, we use PD as our reference, following the European systems of classifying the information, but often our reports talk about PII, which is not a regulated term. This leads to a few confusions. The GDPR's definition of PD is very broad. It includes any information that can be connected to a living person who can be identified. The GDPR considers seemingly harmless pieces of information as personal data if they can be combined to identify a person, even if each piece alone can't identify anyone. For instance, knowing someone's birth date or zip code might not be enough to identify them on its own, but when combined, they could. Therefore, even if NRIC numbers are treated like names, they would still be considered personal data under the GDPR framework because they relate to an identifiable individual. Meanwhile, in Singapore we use PII and PD quite interchangeably. And in the debates that followed after the ACRA incident, it was about whether NRIC was a PII or not.
When we were debating as to whether NRIC would be a PD, by any definitions above, it would be automatically assumed as PD. However, the conversation that brewed afterwards was whether NRIC was to be classified as a PD was circular, being more similar to a discussion as to whether NRIC should be included in a static checklist, which is closer to the impression that people have of PII. While names are considered PII, they are non-sensitive, therefore generally not subject to the same level of protection as sensitive PII like NRIC numbers were previously. Again, these are not official legal terms being utilised, which furthered the confusion, until Minister Josephine Teo confirmed that NRIC numbers were PD and should be regulated as such.
The National identity systems are essential in establishing individual identities and facilitating access to services. Notably, several jurisdictions treat their national identification numbers with the same level of sensitivity as Singapore does Personally Identifiable Information (PII), implementing strict protections and usage restrictions.
Comparative Table:
Modern authentication tools offer significant advantages: they are generally more difficult to compromise, can be updated if breached, and provide better audit trails. For example, South Korea's Digital Identity system uses a combination of blockchain and decentralised identifiers (DIDs) with biometric verification, while India's Aadhaar authentication utilises multi-modal biometrics (fingerprints, iris scans) combined with one-time passwords (OTP). These systems support advanced security features like digital signatures and encryption. Denmark has successfully implemented NemID, a two-factor authentication system combining a password with a physical code card or mobile app, demonstrating the feasibility of transitions. While shifting away from NRIC numbers as an authentication method will enhance the security of the digital economy over time, the challenge arises from the fact that alternative systems were not fully established before ACRA revealed NRIC numbers.
The change of stance regarding NRIC's status away from being sensitive data represents a significant departure from Singapore's historically careful approach to personal data protection. While the transition away from NRIC as a primary identifier may be necessary in today's digital landscape, the abrupt nature of this change raised serious concerns. The comparative analysis shows that other jurisdictions treat their national identification numbers with heightened security and implement strict usage controls, suggesting Singapore's sudden policy reversal diverges from international best practices. The implementation challenges are particularly acute for organisations that have built their verification systems around NRIC usage. Even if NRIC numbers are treated like names, the ease of accessing them online and the lack of a robust alternative system raise concerns about data breaches and identity theft. Without adequate notice, clear guidelines, or established alternatives, businesses face uncertainty in adapting their operations to this new paradigm.
Therefore, looking at an effective alternative solution should be the best move beyond the review to be published by February 2025.
