Organisations are generally not allowed to collect, use or disclose your NRIC number (or copy of your NRIC). They may do so only if it is required under the law (or an exception under the PDPA applies) or necessary to accurately establish or verify your identity to a high degree of fidelity.

Do not reply to such an SMS or call. Do not interact in any way.

Unsolicited SMSes or calls from unknown sources that are related to loans, financial assistance or online gambling are likely to be associated with unlicensed moneylending and illegal gambling activities. The PDPC investigates all complaints regarding unsolicited telemarketing SMSes or calls seriously. However, unlicensed moneylending and illegal gambling are serious criminal offences in Singapore where the Police are the relevant authority to investigate such offences. If you receive such SMSes or calls, please notify the Police directly by: 

• lodging a Police Report;
• calling the National Crime Prevention Council's 'X Ah Long' Hotline at 1800-924-5664 (1800-X-AH-LONG); or
• providing information via I-Witness.

Complaints received by the PDPC relating to such activities will be referred to the Police.

Where there is no intention to obtain control or possession of your physical NRIC for the purpose of establishing or verifying your identity, and no personal data is retained once the NRIC is immediately returned to you, the PDPC does not consider it to be a collection of personal data.

The PDPC recognises that organisations may wish to collect partial NRIC numbers when other alternatives are not satisfactory. Organisations that collect the last three numerical digits and checksum of the NRIC number (e.g. "567A" from the full NRIC number of "S1234567A") would not be considered to be collecting the full NRIC number, and therefore not subject to the treatment for NRIC numbers set out in the PDPC's advisory guidelines.

Partial numbers are, however, considered personal data under the PDPA to the extent that an individual can be identified from the partial NRIC number, or from the number and other information to which the organisation has or is likely to have access. Organisations that collect partial NRIC numbers must still comply with the Data Protection Provisions of the PDPA, such as making reasonable security arrangements to protect the personal data in their possession or under their control from unauthorised disclosures.

Organisations should not retain your physical NRIC unless required under the law. This is given the importance of the NRIC as a national identification document that is issued to all citizens and permanent residents of Singapore, and the impact to the individual should the NRIC be misplaced or stolen and used for illegal activities.

The DNC Registry lets you opt out of marketing messages addressed to your Singapore telephone number, such as those which promote or advertise goods or services, allowing you to have more control over the kind of messages you receive on your telephone, mobile telephone, or fax machine.

Organisations are required to check the DNC Registry within 30 days before sending any telemarketing message. Therefore, you should not receive telemarketing messages from organisations, which are covered by the scope of the DNC Registry, 30 days after registration.

Property management and building owners should avoid collecting NRIC numbers and are encouraged to use alternative ways to address their requirements. For instance, organisations may consider checking a visitor's photo identification document and recording the visitor's full name and contact details (e.g. mobile number), or partial NRIC number where relevant.

In the event that an organisation collects, uses or discloses your NRIC number contrary to the positions set out in the PDPC's advisory guidelines after 1 September 2019, you may lodge a complaint with the PDPC. We will investigate the matter to establish whether there is a breach of the PDPA. If the failure to adhere to the guidance provided results in a breach of the Data Protection Provisions, the penalties under the PDPA will apply.

The treatment for NRIC numbers also applies to other national identification numbers such as Birth Certificate numbers, Foreign Identification Numbers (FIN) and Work Permit numbers that are issued by the Singapore Government, in view that they are also permanent and irreplaceable identifiers that bear similar risks as NRIC numbers if indiscriminately collected, used or disclosed.

Organisations will need to ensure that the necessary operational changes to business practices are made before 1 September 2019.