PDPC Updates Advisory Guidelines on the PDPA for NRIC and other National Identification Numbers
Key information that organisations should note
1) Organisations should not:
a) collect NRIC numbers (or copy of NRIC) unless:
• Required under the law (or an exception under PDPA applies); or
• Necessary to accurately establish or verify the identity of the individual to a high level of fidelity
b) retain the physical NRIC (or any identification document containing NRIC numbers) unless required under the law
2) The treatment for NRIC numbers also applies to Birth Certificate numbers, Foreign Identification Numbers (FIN) and work permit numbers, collectively referred to as ‘other national identification numbers.
3) Organisations should review the existing systems, policies, and processes and implement the necessary changes to align with the advisory guidelines before 1 September 2019.
Help and Resources for Organisations
Refer to the companion Technical Guide to the Advisory Guidelines for tips on alternatives to NRIC numbers to uniquely identify individuals in your websites and other public-facing computer systems.
Leverage on the Productivity Solutions Grant (PSG) and adopting pre-approved solutions that allow use of alternative identifiers apart from NRIC numbers (e.g. Customer Relationship Management, Point of Sales and Visitor Management System) to automate and align your organisation’s operations with the Advisory Guidelines.
Adopt the template notice to notify customers of your existing efforts to comply with the Advisory Guidelines and the expected date of completion to manage customers’ expectations during the implementation period.
Free Data Protection Advisory Services
Sign up for the FREE data protection advisory services for tailored support and assistance on how your organisation (SMEs and non-profit organisations) can use data responsibly.