NRIC Authentication: What SMEs Must Stop by 31 December 2026

NRIC authentication has a deadline: private organisations in Singapore have until 31 December 2026 to stop using full or partial NRIC numbers to authenticate people, and from 1 January 2027 the Personal Data Protection Commission (PDPC) will step up enforcement, including directions or financial penalties where appropriate. That is the plain message of PDPC's media release on the deadline, published on 2 February 2026.

For many small businesses the likely problem is not a login page but the payslip PDF locked with part of a staff member's NRIC, or the phone call where reading out "567A" counts as proof of identity. Here is where to look, what PDPC suggests instead and how to switch before the December payroll.

What counts as using an NRIC number for authentication?

PDPC separates two jobs. Identification is telling people apart, for example by name. Authentication is proving that a person is who they claim to be before giving them access to services or information meant only for them. An NRIC number is issued to identify someone, so the joint advisory says it "must be assumed to have been disclosed to at least a few other persons" and should not be used as a password.

The advisory names the practices to stop:

• NRIC numbers as default passwords, including passwords on files sent by email.
• Partial NRIC numbers combined with other easily obtained details, such as "567A01Jan80" (three digits and a letter, plus a birth date).
• Treating a stated NRIC number as proof. The advisory warns that someone may not be who they claim to be just because they can recite an NRIC number.

Two things stay allowed. PDPC's page on NRIC-related concerns says organisations may ask for an NRIC number when the law requires it or to identify someone to a high degree of accuracy (its examples are a clinic registration, a new mobile line and a property transaction), and may ask for a partial NRIC number to identify a person. PDPC's NRIC advisory guidelines, which cover collecting, using and disclosing NRIC numbers, remain valid while PDPC updates them.

Where do NRIC passwords hide in a small business?

Our inventory, built from the practices PDPC names; go through it with whoever runs payroll, IT and customer service:

1. Payslips. Some payroll set-ups email each payslip as a PDF whose password is part of the NRIC number, sometimes with a birth date.
2. Year-end tax forms. The same routine may be reused for Form IR8A.
3. Customer documents: statements, invoices, reports or policy documents sent as locked files.
4. Portals and apps where the first password, or a reset, is an NRIC number or NRIC plus date of birth.
5. Staff systems: HR, rostering or claims tools whose first login uses the NRIC.
6. Phone, counter and WhatsApp checks where quoting the last four characters is enough to hear account details. Using them to find a record is identification; releasing information on that alone is authentication.
7. Vendors. Ask payroll, accounting and CRM providers in writing whether any default uses NRIC numbers. Our payroll provider comparison lists other questions worth adding.

What can replace an NRIC password?

The joint advisory asks for a risk-based choice: how sensitive the information is, the threats to each method and how easy it is to use. It lists three kinds of proof: something only the person knows (a strong password), owns (a security token or smart card) or has (a fingerprint or face). It prefers the last two because they resist phishing better.

For documents, the May 2026 update gives three alternatives:

1. A website or app account, ideally with multi-factor authentication. Suited to documents people need again later.
2. An expiring or single-use link plus a unique password sent by another channel, such as SMS to a registered mobile number. Suited to one-off documents.
3. An emailed document with a unique password set by the organisation, sent separately, for documents kept for reference where an app or website is not feasible.

The advisory says to avoid sending the link or file and its password through the same channel. Replacing "567A" with a date of birth fails too, since PDPC counts birthdates among easily obtained personal data. None of these methods protects against social engineering, the advisory adds, so people must still learn to recognise such attempts; in a small business that includes whoever answers the phone.

A worked example: switching payslips before the December payroll (illustrative)

Take a fictional 14-person aircon servicing firm in Ubi. Mr Lim owns it; Siti, the office manager, runs payroll and pays on each month's last working day. Each payslip goes out as a PDF locked with the last four characters of the employee's NRIC.

MOM's itemised payslip rules cover employees under the Employment Act and allow soft copies, but require the payslip with the payment, or within three working days of it. The fix must not break that timing. Siti's plan:

• By Friday 6 November: finish the inventory and ask the payroll vendor whether it offers an employee app or portal with multi-factor authentication.
• Choose per person. Office staff use the portal (option 1), since they keep payslips for loans and rentals. Two technicians without the app get a PDF with a unique password from Siti, sent by SMS to their registered mobile (option 3).
• Test before go-live. PDPC's lapses advisory warns that migrations can go wrong at data mapping (its example: billing statements sent to the wrong customers). Siti checks every mobile number and email against the HR record and sends a dummy payslip first.
• Monday 30 November: November payslips go out the new way, with a note to staff in advance.
• Thursday 31 December: December payslips fall on the deadline itself, so the switch is already done.
• Early 2027: IR8A forms use the same method.

Siti records what changed and why in a one-page note for the firm's Data Protection Officer. That record is our suggestion, not a PDPC requirement.

What happens after 1 January 2027?

PDPC says organisations that use NRIC numbers to authenticate access to personal data may be found to have breached the Personal Data Protection Act (PDPA) by failing to make reasonable security arrangements. Section 24 is the duty in question, and the lapses advisory notes that personal data covers NRIC numbers "in full and partial form". The release names directions or financial penalties, where appropriate, as the enforcement it will step up; it does not set out penalty amounts.

Our reading is that a complaint is most likely to start with your own staff or customers. PDPC's NRIC page tells people to raise it first with the organisation's Data Protection Officer, then file a complaint with PDPC, which says it responds within five working days.

If a document does reach the wrong person, our PDPA data breach notification playbook sets out the assessment clock. More on running the back office is under operations, and other dates are in the SME compliance calendar.

Common questions