Still Using NRIC Numbers as Passwords? What Singapore SMEs Must Change Before 1 January 2027

Singapore businesses have until the end of 2026 to stop using NRIC numbers as a way to authenticate customers, employees or other users.

From 1 January 2027, the Personal Data Protection Commission, or PDPC, will step up enforcement against private organisations that continue to use full or partial NRIC numbers for authentication.

For SMEs, this may require more than changing a login page. NRIC-based authentication can be hidden inside old customer portals, employee systems, password-protected documents, membership databases and other processes that have been used for years without being reviewed.

Businesses should therefore use the remaining months of 2026 to identify where NRIC numbers are being used, distinguish authentication from legitimate identification purposes and replace insecure authentication methods before the deadline.

1. What changes from 1 January 2027?

Private organisations have until 31 December 2026 to phase out the use of full or partial NRIC numbers for authentication.

From 1 January 2027, PDPC will step up enforcement action against organisations that continue using NRIC numbers in this way.

Where the use of NRIC numbers for authentication results in inadequate protection of personal data, an organisation may be found to have breached its obligations under the Personal Data Protection Act.

Enforcement may include directions or financial penalties where appropriate.

This makes the final quarter of 2026 an important period for SMEs to review older systems and practices before the transition deadline arrives.

2. What does authentication mean?

Authentication is the process of proving that a person is who they claim to be before giving that person access to an account, document, service or information.

For example, a customer may enter a password before accessing an online account. An employee may enter a one-time password before opening a sensitive system. A user may authenticate through a passkey, security token or biometric method.

In each case, the authentication method is supposed to provide evidence that the person requesting access is genuinely the authorised user.

An NRIC number is unsuitable for this purpose because it is an identifier rather than a secret credential.

3. Identification and authentication are not the same thing

This distinction is important because the new enforcement approach does not mean that an NRIC number can never be used by a private organisation.

Identification is used to distinguish one person from another.

Authentication is used to prove that the person requesting access is actually that individual.

For example, a business may have a legitimate reason to record an NRIC number where collection is required by law or where the organisation needs to establish or verify someone’s identity to a high degree of accuracy.

However, knowing the NRIC number should not itself be treated as proof that the person entering it is the rightful owner.

An SME should therefore avoid interpreting the 2026 deadline as a simple instruction to delete every NRIC number from every system.

The first task is to understand why each NRIC number is being collected or used.

4. What NRIC practices should SMEs stop using?

PDPC has highlighted the use of full or partial NRIC numbers as passwords or default passwords as a problematic authentication practice.

Businesses should review practices such as:

• using a full NRIC number as an account password;
• using the last few characters of an NRIC number as a password;
• using an NRIC number together with a date of birth as the default login credential;
• using an NRIC number together with a person’s name as an authentication method;
• password-protecting digital documents using part of the recipient’s NRIC number;
• allowing access to customer records after asking only for an NRIC number;
• using partial NRIC numbers to unlock employee or member portals; and
• using NRIC information as a predictable password-reset credential.

The common problem is that the information being used to authenticate the person may already be known, obtainable or exposed elsewhere.

A credential should not rely on information that was never intended to function as a secret.

5. Partial NRIC numbers are included too

An SME should not assume that using only part of an NRIC number solves the problem.

PDPC’s 2026 announcement applies to both full and partial NRIC numbers used for authentication.

For example, replacing a full NRIC password with the last three digits and final letter does not automatically create a secure authentication method.

The same concern applies when the partial NRIC number is combined with other easily obtainable personal information such as a person’s name or birth date.

Businesses reviewing their systems should therefore search for both full and shortened NRIC-based credentials.

6. Do not overlook password-protected documents

One area that SMEs may overlook is the way sensitive documents are distributed.

A business may automatically email a customer, employee or member a password-protected PDF and use part of the recipient’s NRIC number as the default password.

PDPC has specifically stated that NRIC-based passwords should not be used to provide access to digital documents.

This means businesses should review automated document-generation systems as well as websites and customer portals.

Examples could include:

• statements;
• payslips;
• membership documents;
• customer reports;
• insurance or financial documents;
• HR records;
• invoices containing personal information; and
• other sensitive PDF attachments.

An SME may therefore need to speak with its payroll provider, software vendor or IT service provider rather than simply changing an internal policy.

7. Why is using an NRIC number as a password risky?

A good authentication credential should be difficult for an unauthorised person to obtain or predict.

An NRIC number does not meet that purpose well.

NRIC numbers are permanent identifiers. They may also have been provided to multiple organisations over a person’s lifetime for legitimate administrative or identification purposes.

If the same identifier is then treated as a secret password, anyone who obtains the information may be able to impersonate the individual in another system that uses the NRIC number for authentication.

This risk becomes greater when businesses use predictable combinations such as an NRIC number together with a name, birthday or other personal information.

The issue is therefore not simply whether an NRIC number is personal data. It is whether the business is relying on that personal data as though it were a secure credential.

8. What can SMEs use instead?

There is no single authentication method that is suitable for every business or system.

The Cyber Security Agency of Singapore recommends choosing authentication methods according to the security needs, user experience and risk level of the service.

Possible alternatives include:

• Strong passwords or passphrases. Users create credentials that are not based on easily obtainable personal information.
• Multi-factor authentication. Access requires more than one authentication factor, such as a password together with an app-generated verification code.
• One-time passwords. A temporary code can be sent through an appropriate verified channel for one-time access.
• Magic links. Users receive a temporary login link through a registered email address.
• Federated single sign-on. A trusted identity provider can be used to authenticate users instead of creating another set of credentials.
• Passkeys or FIDO2 authentication. Supported systems can use device-based cryptographic authentication, including options linked to biometrics or security keys.

The appropriate method depends on the sensitivity of the information being protected and the type of users accessing the system.

A customer portal containing sensitive personal data may require stronger controls than a low-risk service containing little personal information.

9. MFA can provide stronger protection

Multi-factor authentication, or MFA, can reduce the risk that a stolen password alone is enough to compromise an account.

Instead of relying on one piece of information, MFA requires the user to provide an additional factor.

For example, a customer could enter a password and then confirm a code through an authenticator application.

For SMEs managing sensitive systems, MFA may be particularly useful for:

• administrator accounts;
• cloud applications;
• remote access;
• finance systems;
• HR systems;
• customer databases; and
• accounts with access to large amounts of personal data.

However, SMEs should still select an authentication method based on the risks and needs of the specific service rather than implementing technology without considering how users will access and recover their accounts.

10. Start by creating an authentication inventory

A practical first step is to identify every place where customers, employees, suppliers or other users are required to prove their identity before gaining access.

The SME can create a simple inventory containing:

• the system or process name;
• who uses it;
• what information can be accessed;
• the current login or authentication method;
• whether full or partial NRIC information is involved;
• the software or service provider responsible;
• the proposed replacement method;
• the person responsible for making the change; and
• the target completion date.

This can reveal authentication practices that management may not realise still exist.

For example, a modern customer portal may already use secure authentication while an older automated reporting system continues to generate NRIC-protected PDF files every month.

11. Check third-party software and service providers

Many SMEs rely on external providers for payroll, accounting, CRM systems, membership platforms, document distribution and other business functions.

This means the organisation may not control every authentication mechanism directly.

Businesses should ask relevant vendors questions such as:

• Does the system use a full or partial NRIC number as a password or default password?
• Are NRIC numbers used during account recovery?
• Are documents automatically protected using NRIC information?
• What replacement authentication methods are available?
• Will a software update or configuration change be required?
• When can the change be implemented and tested?
• Will users need to reset their credentials?
• How will existing accounts be migrated?

Starting this conversation before December gives the business more time to resolve technical issues without rushing a system change near the deadline.

12. Do not wait until December to migrate

Changing an authentication process can affect more than the login screen.

A migration may involve:

• software configuration;
• customer communication;
• employee training;
• password resets;
• changes to automated emails;
• updates to operating procedures;
• account recovery processes;
• testing across different devices; and
• support for users who have difficulty accessing the new system.

A rushed migration can create its own security and operational problems.

For example, a company may successfully remove an NRIC-based password but accidentally introduce an account recovery process that is even easier to exploit.

Businesses should therefore test replacement methods before deploying them widely.

13. Review how much NRIC data the business still needs

The authentication deadline is also a useful opportunity for SMEs to review their wider handling of NRIC data.

Private organisations should already have a valid reason for collecting, using or disclosing NRIC numbers.

Collection may be permitted where required by law or where it is necessary to accurately establish or verify an individual’s identity to a high degree of fidelity.

If an SME discovers old NRIC information in a database, spreadsheet or archived process, it should ask:

• Why was this information collected?
• Is the original purpose still relevant?
• Is the information still required?
• Who can access it?
• How is it protected?
• How long should it be retained?

Reducing unnecessary personal data can also reduce the amount of sensitive information exposed if a system is compromised.

14. Authentication changes can have a business cost

For some SMEs, replacing NRIC-based authentication may be a simple configuration change.

For others, the business may need to pay a software vendor, modify a custom application or introduce a new authentication service.

Potential costs may include:

• software development;
• vendor implementation fees;
• new authentication licences;
• SMS or authentication service charges;
• cybersecurity consulting;
• testing;
• staff training;
• customer communication; and
• additional support during migration.

These costs should be included in the SME’s 2026 technology and compliance budget rather than treated as an unexpected December expense.

At the same time, the cheapest replacement is not necessarily the best choice. A weak authentication method may create greater costs later through account compromise, operational disruption or a personal data breach.

15. Example: an SME customer portal using partial NRIC numbers

Consider an SME that operates a customer portal containing invoices, transaction records and personal information.

Customers currently log in using their email address, while the default password is the last few characters of their NRIC number.

Even though the company does not use the full NRIC number as the password, this would still fall within the type of authentication practice that SMEs should phase out before the end of 2026.

The company could replace the process with a stronger alternative, such as a user-created password combined with MFA.

The migration plan might involve:

• selecting the replacement authentication method;
• updating the portal;
• testing account recovery;
• requiring customers to create new credentials;
• communicating the change in advance;
• monitoring failed logins during the transition; and
• removing the old NRIC-based authentication method once migration is complete.

By beginning the process early, the SME has time to identify usability or technical problems before the 2027 enforcement period begins.

16. Example: password-protected employee documents

Consider another SME that emails employees password-protected documents each month.

The password is automatically generated using part of each employee’s NRIC number.

The company may not think of this as a login system because there is no online account.

However, the NRIC information is still being used as an authentication credential to control access to a digital document.

The SME should therefore review the process with its payroll or document provider and introduce an appropriate replacement method.

This could involve delivering documents through an authenticated employee portal or using another secure access method that does not rely on NRIC information as the secret credential.

17. Build account recovery into the replacement plan

Authentication is only one part of account security.

SMEs also need to consider what happens when a user forgets a password, loses a phone or cannot access an authentication application.

A secure login system can still be undermined by a weak recovery process.

For example, replacing an NRIC password with MFA provides limited benefit if a caller can contact customer support and reset the account simply by providing the same NRIC information.

When redesigning authentication, businesses should therefore review:

• password reset procedures;
• MFA recovery;
• changes to registered phone numbers or email addresses;
• support desk verification procedures;
• administrator overrides; and
• emergency account recovery.

The entire access process should be considered rather than changing only the first login screen.

18. What should SMEs do before 31 December 2026?

A practical transition plan can be broken into several steps.

• Identify NRIC-based authentication. Review customer, employee and internal systems for full or partial NRIC passwords and verification methods.
• Check digital documents. Look for PDFs and other files that use NRIC-based default passwords.
• Separate identification from authentication. Determine whether an NRIC number is genuinely required for another legitimate purpose.
• Contact software vendors. Ask third-party providers how they will replace existing NRIC-based authentication.
• Select an appropriate alternative. Consider strong passwords, MFA, passkeys, one-time passwords or another method suitable for the risk level.
• Review account recovery. Make sure the replacement process does not continue relying on NRIC information through another route.
• Test before deployment. Verify that the new process works securely and reliably.
• Inform users. Give customers and employees enough notice to prepare for changes.
• Update policies and procedures. Document the new authentication process and responsibilities.
• Complete the transition before year-end. Do not leave a significant system migration until the final days of December.

19. Treat the deadline as an opportunity to improve security

The 31 December deadline should not be viewed only as another compliance task.

For an SME still using NRIC-based passwords, the required change creates an opportunity to review authentication practices that may not have been updated for many years.

A stronger authentication system can reduce the likelihood of unauthorised account access, improve protection of customer and employee information and support better cybersecurity practices across the business.

It may also encourage the company to identify unnecessary personal data, outdated user accounts and older systems that require wider security improvements.

Final thoughts

Private organisations in Singapore have until 31 December 2026 to phase out the use of full or partial NRIC numbers for authentication.

From 1 January 2027, PDPC will step up enforcement against organisations that continue using NRIC information in this way.

For SMEs, the first step is to identify where NRIC-based authentication still exists. This may include customer portals, employee systems, password-protected documents, account recovery processes and older third-party applications.

The business can then replace these practices with authentication methods that are appropriate for the sensitivity of the information and the needs of its users.

Importantly, SMEs should distinguish authentication from legitimate identification requirements. The deadline does not mean every lawful use of an NRIC number must disappear.

Businesses that begin reviewing their systems now have time to budget for necessary changes, coordinate with vendors, test replacements and complete the migration before enforcement increases in 2027.