Can you ask a customer for their NRIC? Usually not, and here's the test

PDPC issued its guidelines on NRIC numbers on 31 August 2018. They say organisations "are generally not allowed to collect, use or disclose NRIC numbers (or copies of NRIC)". The same applies to birth certificate numbers, FINs and work permit numbers (para 1.4).

NRIC numbers are still personal data under the PDPA. What the guidelines add is a narrower test for this one kind of data.

You may collect, use or disclose an NRIC number, or a copy of the card, only when (para 3.1):

1. A law requires it, or an exception in the PDPA applies.
2. It's necessary to accurately establish or verify the person's identity "to a high degree of fidelity".

PDPC's examples of the second case are where getting someone's identity wrong carries a real risk. They include significant safety or security risks, and transactions that "typically relate to healthcare, financial or real estate matters, such as property transactions" (para 3.13). Be ready to explain why you needed it, if PDPC asks (para 3.14).

For most sellers, neither applies to the everyday list. A tuition centre booking a trial class needs a parent's name and number. A renovation firm quoting a kitchen needs the address and a way to reach the owner. Neither needs an NRIC number to call back.

Photographing or photocopying an NRIC isn't a lighter version of asking for the number. PDPC says that when you collect a copy, you've collected "all the personal data on the NRIC" (para 3.15). That's the photo, the address and the date of birth too.

And don't hold on to the card itself. Businesses "should generally not retain an individual's physical NRIC unless the retention of the physical NRIC is required under the law" (para 4.1). That rules out keeping a visitor's IC at the front desk until they leave.

Many forms ask for "the last 4 digits". PDPC's version is precise. Collecting the last three digits and the checksum letter, like "567A" from "S1234567A", isn't treated as collecting the full number (para 5.2).

It's still personal data, though. PDPC says partial numbers count "to the extent that an individual can be identified from the partial NRIC number", alone or with other details you hold (para 5.3). Protect it like the rest of the record.

PDPC's guidelines are due to be updated, and in the meantime "these guidelines remain valid". Its page adds a line every business should read. PDPC "advises against" organisations using NRIC numbers "to authenticate an individual's identity or set default passwords" (guidelines page, updated 14 Dec 2024). In a statement the same day, it put it plainly: "As the NRIC number is not a secret, it should not be used by an organisation for authentication purposes."

So if your customers confirm who they are on the phone by reading out their NRIC, change that.

1. Look for any NRIC column in your spreadsheets and any NRIC box on your forms.
2. For each, ask PDPC's two questions: does a law require it, or do you need to verify identity to a high degree of fidelity for this transaction?
3. If neither, stop collecting it, and delete the numbers you hold. A name, a number and the date they enquired are usually enough.
4. If you only need to tell two customers with the same name apart, a partial number of four characters does that.
5. If a law requires the full number for a transaction, keep it with that transaction's papers, and keep it out of the list your whole team scrolls.

Palby CRM keeps only the fields you add, so a board has no NRIC field unless someone makes one. Three ways to keep it that way:

• When you import a spreadsheet, set its NRIC column to Skip, and the numbers stay behind in the file.
• If you need to tell two customers with the same name apart, add a Text field called "NRIC (last 4)" for the partial number instead.
• Then delete the NRIC column from the spreadsheet itself, and from any copies on phones or shared drives.

Set up your board with what your trade actually asks about, such as a child's level, a property type or a budget, and leave out what you'd have to justify.

• PDPC Advisory Guidelines on the PDPA for NRIC and other National Identification Numbers, issued 31 Aug 2018, paras 1.4, 3.1, 3.13, 3.14, 3.15, 4.1, 5.2 and 5.3, read 2 Nov 2026
• PDPC's page for those guidelines (updated 14 Dec 2024) and PDPC's reply to media queries on NRIC numbers (14 Dec 2024), pdpc.gov.sg, read 2 Nov 2026