Singapore places a strong focus on personal data protection. The Personal Data Protection Act 2012 (PDPA), overseen by the Personal Data Protection Commission (PDPC), sets out how organisations collect, use, disclose, and protect personal data. For employers, National Registration Identity Card (NRIC) numbers require particular care because the PDPC’s Advisory Guidelines for NRIC numbers describe them as permanent and irreplaceable identifiers.
Hiring teams have good reasons to confirm that candidates are who they say they are. Identity verification helps support workforce trust and fraud mitigation. However, candidates expect restraint with their personal information, and employers need efficient hiring workflows. This article focuses on how to balance these aims and how to handle NRIC information. For the wider picture, see our pillar guide, Singapore Identity Verification & PDPA Compliance for Employers.
In this article, we explore:
- Why NRIC information requires careful handling in Singapore
- What PDPC guidance means for employers
- When NRIC collection may be appropriate during hiring
- The difference between candidate and employee requirements
- Alternatives to routine NRIC-based verification
- Practical steps for managing NRIC information
- Frequently asked questions about NRIC collection in Singapore
Why does NRIC information require careful handling in Singapore?
An NRIC number is a unique national identification number issued to Singapore citizens and permanent residents. The PDPC’s Advisory Guidelines for NRIC numbers explain that an NRIC number is a permanent and irreplaceable identifier that can potentially be used to unlock large amounts of information about an individual, so the collection, use, and disclosure of NRIC numbers is of special concern. The PDPC notes that indiscriminate or negligent handling increases the risk of unintended disclosure, and that NRIC numbers may then be obtained and used for illegal activities such as identity theft and fraud.
The PDPA does not set out a formal category of “sensitive” personal data. However, PDPC guidance expects organisations to apply a greater level of security to NRIC numbers than to many other types of personal data. Employers should therefore ask two questions before collecting an NRIC number: for what purpose are they collecting this information, and is the NRIC number necessary to achieve this purpose?
What does PDPC guidance say about NRIC collection?
The PDPC’s Advisory Guidelines for NRIC numbers, applied since 1 September 2019, set out a general position: organisations are generally not allowed to collect, use, or disclose NRIC numbers or copies of NRICs. Two circumstances are recognised. Collection may be required under the law, or it may be necessary to accurately establish or verify identity to a high degree of fidelity. Organisations should also generally not retain a physical NRIC unless the law requires it.
When may employers collect NRIC information?
Employers may wish to consider these situations:
- Legal or regulatory requirements. Collecting the NRIC may be required under the law. The PDPC’s guidelines cite section 95 of the Employment Act, which relates to employers’ record-keeping, as an example.
- Legitimate employment administration. Some onboarding and payroll processes may involve NRIC numbers once a person is employed.
- High identity assurance. Some roles may carry significant safety, security, or financial risk if identity is not established to a high degree of fidelity.
This is not an exhaustive legal test. Employers should assess each situation individually and consult their legal advisers where needed.
Why is NRIC authentication different from identity verification?
Identity verification asks, “Is this person who they say they are?” Verification is usually conducted once, or at defined points, using appropriate evidence. Authentication, on the other hand, is defined by the PDPC as proving that a person is who they claim to be before granting access to services or information intended only for them, such as when logging in.
In December 2024, the PDPC said that an NRIC number identifies a person but is not a secret, so organisations should not use it for authentication. Identity verification is a separate step, and it does not automatically require an NRIC number.
What is the difference between a candidate and an employee?
The purpose and necessity of collecting personal information may differ at each stage of the hiring journey:
- Job application. The PDPC’s guidelines note there is no legal requirement to ask for NRIC numbers on job applications.
- Candidate screening. Checks may need identifying details, but employers should consider whether another identifier would serve the purpose. Our guide to background screening requirements in Singapore outlines common checks.
- Selection. Information requested should be relevant to the decision being made.
- Onboarding. Legal and administrative requirements may apply once an offer is accepted.
- Employment. Employers should keep information only while it serves a business or legal purpose.
When might NRIC collection be appropriate during hiring?
At the application stage, collecting an NRIC number is less likely to be appropriate than at later stages, such as onboarding, so it should not be a default step. Before proceeding, employers should consider:
- For what purpose is this information being collected?
- Is collecting the NRIC number necessary to achieve that purpose?
- Is there another appropriate way to achieve the same objective?
- How will the information be protected?
- How long does the organisation need to retain it?
Recording the answers can help support consistent decisions. Our guide to PDPA hiring compliance best practices covers these considerations across recruitment.
Explore identity verification and workforce screening resources for Singapore employers.
What NRIC collection practices should employers avoid?
Collecting NRIC information too early
Asking every candidate for an NRIC number may result in collecting more information than the purpose requires. Employers can ask later, if at all, once the need is clear.
Using NRIC numbers for routine authentication
The PDPC has said NRIC numbers should not be used for authentication, including as default passwords. Employers should review any portals or systems that still rely on them.
Keeping information longer than necessary
Under the PDPA’s retention limitation obligation, organisations should stop retaining personal data once the purpose is no longer served.
Giving unnecessary employees access
Restricting access to those who need it can help reduce the risk of misuse or accidental disclosure.
Failing to explain why information is being collected
The PDPA expects organisations to tell individuals why their data is collected and how it will be used. Clear notices can also help candidates understand what they are being asked to provide.
What alternatives can employers use for identity verification?
Digital identity verification
Digital identity verification checks identity using documents, data sources, or biometric methods, without necessarily storing a full NRIC number in hiring systems. Employers can match their approach to the assurance a role requires.
Singpass and digital identity workflows
Singpass is Singapore’s trusted digital identity, allowing residents to access government and business services online. Unlike the NRIC number, Singpass is designed to support secure digital authentication. Whether it suits a hiring workflow depends on the employer’s use case. Our pillar guide covers digital identity workflows in more depth.
Third-party identity verification solutions
Specialist providers can help employers design verification and screening steps that collect only what each check needs. Employers should consider how a provider stores, shares, safeguards, and deletes personal data. First Advantage provides employment background screening that organisations can consider as part of this approach.
How can employers manage NRIC information responsibly?
Practical steps include:
- Purpose, necessity and transparency. Document why each NRIC number is being collected and explain its purpose before collection.
- Access and security. Apply a greater level of security to NRIC numbers and restrict who can access this information based on their role.
- Retention and duplication. Set retention periods, delete information when no longer needed, and avoid copying NRIC numbers into emails, spreadsheets, or multiple systems.
- Third-party handling. Review contracts and safeguards with providers.
- Consistency and review. Use the same process for every candidate in the same role and revisit it as PDPC guidance evolves.
How can privacy-conscious identity verification support trusted hiring?
Privacy, identity, trust, and workforce screening are connected. Verification that collects only necessary data may help employers support structured onboarding and manage hiring risks across broader screening workflows.
Key takeaways
- NRIC numbers are important personal identifiers and should be handled carefully.
- Employers should consider the purpose and necessity of collecting NRIC information during hiring.
- PDPC guidance provides an important framework for organisations considering NRIC collection and use.
- Identity verification does not necessarily require routine collection of an NRIC number.
- Digital identity and structured verification workflows may help employers support privacy-conscious and efficient hiring processes.
First Advantage is committed to building Trust in a Changing World™, helping employers make informed hiring decisions while respecting the people behind each application.
Learn how First Advantage can help support identity verification and workforce screening workflows for employers in Singapore.
Frequently asked questions
Can employers collect NRIC numbers during hiring in Singapore?
Only in limited circumstances. The PDPC’s guidelines generally do not allow organisations to collect NRIC numbers, and the PDPC notes there is no legal requirement to ask for one on a job application.
When can employers collect NRIC information?
Where the law requires it, such as employment record-keeping obligations, or where a role requires identity to be established to a high degree of fidelity. Purpose and necessity still need to be considered.
Why are NRIC numbers treated carefully in Singapore?
The PDPC describes the NRIC number as a permanent and irreplaceable identifier, so careless handling may increase identity theft and fraud risks.
Do employers need an NRIC number to verify identity?
Not necessarily. Employers may use other appropriate methods, including digital identity workflows, depending on the purpose and assurance required.
How can employers help protect candidate personal data?
Collect only what is needed, restrict access, apply strong security, set retention periods, and explain why data is collected.
Sources
Personal Data Protection Commission: Advisory Guidelines for NRIC Numbers | Personal Data Protection Act 2012: Singapore Statutes Online | Employment Act 1968: Singapore Statutes Online | PDPC: Reply to media queries on the use of NRIC numbers (December 2024) | Singpass: GovTech Singapore | First Advantage Singapore Resource Centre
