Singapore’s 2027 NRIC enforcement deadline: is your background screening process creating an identity data risk?

Singapore employers can still collect and use NRIC information where there is a legitimate reason to do so. The immediate risk is different: from 1 January 2027, Singapore’s Personal Data Protection Commission (PDPC) will step up enforcement against private organisations using full or partial NRIC numbers for authentication. If your recruitment or onboarding process uses an NRIC number as a password, access credential or security check, you should change that process before 31 December 2026.

For HR leaders, this deserves attention because identity information appears throughout the hiring process. Your candidate portal, background screening reports and onboarding systems may all handle identification data.

A practice that was built for convenience can therefore create an avoidable compliance risk.

What is changing with NRIC use in Singapore?

In February 2026, the PDPC confirmed that private organisations have until 31 December 2026 to stop using full or partial NRIC numbers for authentication. From 1 January 2027, it intends to step up enforcement.

Authentication has a specific meaning here. It is the process of proving that somebody is who they claim to be before giving them access to information or a service.

The PDPC gives the example of an organisation using an NRIC number, either alone or combined with readily available information such as a name or date of birth, as a default password. This could include a password used to open a digital document.

That distinction matters for HR teams.

An NRIC number can have a legitimate role in identifying somebody. Using that same number as the secret information that proves their identity creates the problem.

This means the deadline should prompt a review of your Singapore background screening process, rather than a blanket removal of NRIC information from every HR system.

Why NRIC authentication creates unnecessary risk

An NRIC number is an identifier. It should not be treated as a secret.

Once an NRIC number has been disclosed or obtained by somebody else, an authentication process based on that number provides weak protection against unauthorised access.

The PDPC has previously warned that NRIC numbers can be connected with significant amounts of information about an individual. Its technical guidance therefore advises organisations against using NRIC numbers as usernames or unique identifiers in public-facing systems.

The consequences extend beyond an inconvenient system change.

The PDPC says organisations that continue using NRIC numbers for authentication to access personal data may breach the Personal Data Protection Act (PDPA) by failing to make reasonable security arrangements. Enforcement can include directions and financial penalties.

Singapore's wider PDPA enforcement regime also gives the regulator substantial powers. For organisations with annual turnover in Singapore above S$10 million, the maximum financial penalty for relevant data protection breaches can reach 10% of annual turnover in Singapore, subject to the statutory enforcement framework.

That does not mean an outdated password convention automatically produces a penalty of that size. It shows why authentication practices involving candidate data deserve proper scrutiny.

Where should HR teams look for NRIC authentication?

From our experience with employment screening, the useful question is not simply whether your organisation collects NRIC numbers. You need to understand what happens to that information after collection.

Start with the systems a Singapore candidate encounters between accepting a screening invitation and completing onboarding.

For example, your screening provider might generate a report containing personal information and protect the document with a password derived from the candidate's NRIC number. An internal HR system might ask for the last few characters of an NRIC number before displaying confidential information. A legacy onboarding portal might use NRIC information as an account credential.

These are the types of processes worth finding before the deadline.

Your audit should also extend beyond software controlled directly by HR. Recruitment agencies, screening providers and other suppliers may handle candidate information during onboarding. Knowing that your own HRIS has been updated does little good if another part of the candidate journey still relies on NRIC authentication.

The PDPC's 2026 guidance recommends that organisations routinely review their data protection policies and practices. Its recent enforcement guidance has also highlighted controls including multi-factor authentication, access management, monitoring and data minimisation.

For more detail on the information commonly involved in screening, see Veremark's guide to identity checks.

Background checks themselves are still permitted

There is another distinction HR teams should understand.

Singapore's PDPA guidance expressly recognises that personal data may be collected, used and disclosed where reasonable for entering into, managing or terminating an employment relationship. The PDPC identifies background and reference checks as examples of pre-employment activities that can fall within this purpose.

Employers still have responsibilities around how that information is handled. The PDPC states that, where this employment exception applies, consent is not required, although employees must be notified about the purposes for which their personal data is collected, used or disclosed.

The 2027 NRIC change therefore should not be read as a reason to weaken necessary identity verification.

You still need confidence that a candidate is the person they claim to be. That becomes particularly important where later checks, such as employment history or criminal record screening, need to be associated with the correct individual.

You can read more about selecting appropriate checks in Veremark's global background screening checklist for new hires.

What should you change before 31 December 2026?

You have enough time to fix the problem systematically.

Map every point in your recruitment and onboarding process where an NRIC number or partial NRIC number is requested. For each one, establish its purpose.

Where the number is being used for authentication, replace that method. The PDPC and Cyber Security Agency have recommended stronger authentication alternatives, and recent PDPC enforcement guidance repeatedly points organisations towards controls such as multi-factor authentication.

Then check your suppliers.

Ask background screening and onboarding providers whether full or partial NRIC numbers are ever used as passwords, default credentials or security questions. The answer should cover candidate-facing systems and any reports or documents sent to your team.

Finally, document what you find and the changes you make. A compliance review is more useful when you can show which systems were examined, who owns each change and when remediation was completed.

The deadline is an opportunity to remove a preventable weakness

The risk with Singapore's NRIC changes is easy to misunderstand. The question is not whether your Singapore background screening process uses NRIC information at all. You need to know whether an identifier has quietly become an authentication credential somewhere in your workflow.

That is a much more specific problem, and it is one you can test.

Before 31 December 2026, trace how NRIC information moves through recruitment, screening and onboarding. Find every point where it controls access to candidate information. Replace authentication methods that depend on it and ask your screening providers to confirm they have done the same.

From 1 January 2027, the PDPC has said enforcement will increase. There is little reason to carry an authentication practice into that deadline when you can identify and remove it now.