Organisations are generally not allowed to collect, use or disclose your NRIC number (or copy of your NRIC). They may do so only if it is required under the law (or an exception under the PDPA applies) or necessary to accurately establish or verify your identity to a high degree of fidelity.
Do the following situations constitute collection of personal data - for example:
(a) checking my NRIC to verify my identity at point of entry into a particular place; and
(b) checking my NRIC to verify my age?
The PDPC recognises that organisations may wish to collect partial NRIC numbers when other alternatives are not satisfactory. Organisations that collect the last three numerical digits and checksum of the NRIC number (e.g. "567A" from the full NRIC number of "S1234567A") would not be considered to be collecting the full NRIC number, and therefore not subject to the treatment for NRIC numbers set out in the PDPC's advisory guidelines.
Partial numbers are, however, considered personal data under the PDPA to the extent that an individual can be identified from the partial NRIC number, or from the number and other information to which the organisation has or is likely to have access. Organisations that collect partial NRIC numbers must still comply with the Data Protection Provisions of the PDPA, such as making reasonable security arrangements to protect the personal data in their possession or under their control from unauthorised disclosures.
An organisation that randomly generates a NRIC number (e.g. by applying an algorithm or using a validator to ascertain that the randomly generated number is a valid NRIC number) will be considered as having collected the NRIC number. The collection, use and disclosure of such numbers is subject to the treatment set out in the Advisory Guidelines on the PDPA for NRIC and other National Identification Numbers, i.e. organisations may not collect, use or disclose such numbers unless it is required by the law or necessary to accurately establish or verify the identity of the individual to a high degree of fidelity.
When must organisations stop collecting, using and disclosing my NRIC number, if they are no longer supposed to do so?
© 2019 Government of Singapore.
Best supported by IE 9 and above, Firefox and Chrome.