Singapore PDPC and CSA: Stopping the use of NRIC-based authentication
- Ericz Ezekiel Tay
- Jul 25
- 1 min read
Discover how to move beyond NRIC-based authentication following the advisory from the Singapore PDPC and CSA.
Written by Ericz Ezekiel Tay
On 2 July 2025, Singapore’s Personal Data Protection Commission (PDPC) and Cyber Security Agency (CSA) issued a joint advisory advising businesses to stop the use of the full or partial national registration identity card (NRIC) number as a password or factor for authentication, for instance, passwords combining an individual’s partial NRIC number and date of birth, such as “567A01Jan80” (link).
Download our publication below to find out more.
Our team is experienced in advising on data privacy matters. With a unique blend of expertise from both law firms and regional and global in-house roles, we are adept at adopting a commercial lens to address legal challenges.
We recognise that every business is unique and we tailor our approach to the specific needs of the business, the regulatory landscape and the local cultural context. Our team works closely with the business teams to ensure a cohesive and practical outcome as we believe that success requires collaboration across different functions. Understanding the commercial implications of legal decisions is crucial and our in-house experience allows us to balance legal rigour with business practicality, ensuring that any advice is not only legally sound but also commercially viable.
We can support you with:
• Privacy compliance reviews (PDPA)
• Policy drafting, employee training and incident-response planning
• Outsourced data protection officer (DPO) services
Get in touch with us to learn more.
Get in touch with Ericz to learn more. We are here to partner with you, offering an unbiased perspective and exploring practical alternatives.
