NRIC collection in Singapore retail: what shops may ask

Shops in Singapore are generally not allowed to collect, use or disclose your NRIC number or a copy of your NRIC, according to PDPC’s advisory guidelines on NRIC numbers, unless the law requires it or it is necessary to establish identity to a high degree of fidelity. For NRIC collection in Singapore retail, PDPC’s own examples (a free-parking redemption, online ticket pick-up, a membership sign-up and a lucky draw) use alternatives such as a mobile number, an email address, a booking reference or, at most, a partial NRIC number.

There is also a dated change. On 3 February 2026 the Ministry of Digital Development and Information (MDDI) said private organisations have until 31 December 2026 to phase out the use of NRIC numbers to authenticate people, for example as passwords, and that PDPC will step up enforcement action from 1 January 2027.

This is general information, not legal advice. PDPC says its 2018 guidelines remain valid but will be updated, and MDDI says the Government will keep consulting before it adjusts the private-sector guidelines on partial NRIC numbers, so in our inference parts of this may change.

Can a shop ask for my NRIC number?

Usually not, with two exceptions. PDPC’s guidelines say an organisation may collect, use or disclose NRIC numbers, or copies of NRIC, only when:

• the law requires it, or a PDPA exception applies; or
• it is necessary to accurately establish or verify identity to a high degree of fidelity.

PDPC’s examples of legal requirements include hotel check-in, registering with a clinic and subscribing to a mobile phone line. The last is the closest to a retail counter (our inference). In its 2018 example, PDPC says licences issued under the Telecommunications Act require companies that provide mobile phone services to collect customers’ NRIC information and keep a copy of the NRIC as evidence of identity, among other documents. The second exception covers matters such as property transactions and insurance applications, and security risks such as visitor entry to preschools. A membership card or a prize draw is not among PDPC’s illustrative examples of this exception, and an organisation relying on it should be able to justify it if you or PDPC ask.

Partial numbers are treated differently. PDPC says collecting a partial NRIC number up to the last three numerical digits and the checksum, such as “567A” from “S1234567A”, is not collecting the full NRIC number, although it is still personal data. PDPC’s NRIC-Related page, last updated 31 August 2026, likewise says private-sector organisations may ask for your partial NRIC number, such as the last three digits and the letter, for identification, but should not use your NRIC number for authentication. Our inference: this is the part most likely to change. MDDI said on 3 February 2026 that, for the private sector, the Government will continue to hold consultations and review public feedback before adjusting guidelines on the use of partial NRIC numbers.

What can I say at a till or sign-up counter?

Each situation is adapted from an example in PDPC’s 2018 guidelines, which PDPC says remain valid until they are updated. The “You may be asked for” lines frame the scenario for a shopper and the “You could say” lines are our wording, not PDPC’s. PDPC’s examples show what a shop could consider doing instead, not what a particular shop must do when you decline.

1. Joining a store membership (PDPC example 5.7)

• You may be asked for: your NRIC number, to create a member account and track reward points.
• PDPC’s example says: the shop could consider letting members use a mobile number, email address, user-generated identifier or a partial NRIC number (up to the last three numerical digits and checksum). It does not say the shop asks for the full NRIC number.
• You could say: “Can I join with my mobile number instead of my NRIC?”

2. Entering a lucky draw (PDPC example 5.7, with a top prize valued at $10,000)

• You may be asked for: your full NRIC number on the entry form.
• PDPC’s example says: the shop collects a full name, a partial NRIC number and contact details such as a mobile number, email or mailing address, then checks winners’ full names and partial NRIC numbers against their physical NRIC when they claim prizes. It does not say the shop asks for the full NRIC number.
• You could say: “I’m happy to give my name and mobile number, and to show my NRIC if I win.”

3. Claiming free parking at a mall (PDPC example 5.5)

• You may be asked for: your NRIC number, to limit redemptions per shopper.
• PDPC’s example says: the mall should not collect NRIC numbers for this purpose, and could consider checking the physical NRIC and recording a name, partial NRIC number, vehicle number or mobile phone number.
• You could say: “You can look at my NRIC, but could you note my car plate number instead?”

4. Registering interest in a new product (PDPC example 5.8)

• You may be asked for: your NRIC number, to give priority to customers who register before launch.
• PDPC’s example says: the shop should not collect NRIC numbers for this, and can consider collecting names and contact details such as mobile numbers or email addresses.
• You could say: “Can I register interest with just my name and email?”

5. Collecting tickets bought online (PDPC example 5.6)

• You may be asked for: your NRIC number at the counter, to confirm you are the buyer.
• PDPC’s example says: a cinema should not collect NRIC numbers for this and could consider other means, such as a booking reference number or an SMS confirmation. The example is about cinema tickets; applying it to other pick-up counters is our inference.
• You could say: “Here are my booking reference and the SMS confirmation. Is that enough?”

If the shop insists, ask which law or policy requires it. The guidelines say an organisation relying on the high-fidelity exception should be able to justify the collection on request. Our inference: that gives you a basis for asking a shop for its reason. The pages read do not say what a shop must do if you decline, and it may have a legal reason such as the mobile line example, so treat insistence as a reason to ask, not proof that the shop is wrong. If you hand a number over, note what was asked for and why; the before-you-check-out guide covers keeping a record of the order itself. For a dispute about the purchase rather than your data, see the consumer rights guide.

Can a shop keep my NRIC card, or only look at it?

PDPC’s guidelines say organisations should generally not retain a physical NRIC unless the law requires it, and the same goes for other documents that carry the number, such as a driver’s licence, passport or work pass. Its example is a bicycle rental company that wants an NRIC as collateral: it should not keep the card, and could take a monetary deposit of a reasonable amount or use tracking devices or an app instead.

Looking is different from collecting. PDPC says that if a shop only sees your NRIC, does not intend to take possession of it and keeps no personal data once it is returned immediately, that is not a collection of personal data. Its example is a convenience-store cashier asking for proof of identity to check a customer’s date of birth before a tobacco sale; PDPC says the store may ask because there are no other viable alternatives for verifying age. A copy of the card is different: PDPC says an organisation that collects a copy of the NRIC has collected all the personal data on it, which the guidelines list as including the full name, photograph, thumbprint and residential address.

Our reading, not PDPC’s wording: offer to show the card, and ask what deposit the shop accepts if it wants something to hold. A photo of your NRIC left on a phone goes with the phone, so wipe it first; the trade-in and recycling guide covers how.

Can my NRIC be a password, and what happens after 31 December 2026?

It should not be, according to MDDI. Its 26 June 2025 release says organisations may use NRIC numbers to identify who a person is over the phone or in digital services, but not to prove that a person is who they claim to be in order to gain access to services or information meant only for that person. Organisations should not set NRIC numbers as default passwords, for example on password-protected files sent by email, nor combine full or partial NRIC numbers with easily obtainable data, such as a partial NRIC number and birth date in “567A01Jan80”. If an organisation does need to authenticate a person, MDDI says it should consider alternatives such as strong passwords, a security token or fingerprint identification.

The 3 February 2026 release adds the dates. MDDI’s published answer to a parliamentary question says organisations will have adequate time to adjust, but those that “flagrantly misuse NRIC numbers can be penalised under the Personal Data Protection Act”. The deadline covers authentication, not every request for an NRIC number, and the pages read do not say how the updated guidelines will treat NRIC numbers used to identify someone at a counter.

Use this password test on any document or account protected by an NRIC-based password:

1. What is the password made of? If it is your full NRIC number, part of it, or either joined to your birth date or name, it matches the practice MDDI’s 3 February 2026 release describes.
2. Who chose it? A default set by the company or sender is what MDDI’s June 2025 release targets, for instance in insurance documents or password-protected files sent by email. A banner on PDPC’s 2018 guidelines adds that PDPC advises individuals against using NRIC numbers as their own passwords.
3. What does it open? An insurance document, an account or a record meant only for you.
4. Could anyone who knows or has noted your NRIC number open it? MDDI’s reason for the change is that other people might know it.

If the password is your NRIC number or built from it, protects something meant only for you and was set by the organisation, that is the practice MDDI says private organisations have until 31 December 2026 to phase out. If you chose it yourself, PDPC still advises against it. Our suggestion: either way, change it to a strong password where the system allows, and tell the organisation if it set the password.

How do I report NRIC misuse to PDPC?

MDDI’s 3 February 2026 release says members of the public may report any misuse of NRIC numbers for authentication to PDPC at go.gov.sg/reportnric, and its published answer to a parliamentary question encourages the public to keep reporting cases where NRIC numbers are mishandled during the transition. When we opened the link on 17 October 2026 it led to PDPC’s “NRIC-Related” page (last updated 31 August 2026), which says it helps you identify improper collection of NRIC numbers and gives steps to file a complaint, so in our reading it is not only about passwords. It sets out three steps:

1. Contact the organisation. Raise it first with the organisation’s Data Protection Officer (the page words this step around authentication), whose details are in PDPC’s DPO Registry or the organisation’s privacy policy, and give the organisation 10 working days to respond.
2. Escalate to PDPC. If the issue remains unresolved, submit a complaint to PDPC; the page says this takes 5 to 10 minutes and needs Singpass.
3. Review by PDPC. PDPC says it will review the submission and respond within 5 working days.

We did not open the complaint form itself, so what it asks for is not described here.

A practical suggestion of ours, not a PDPC requirement:

• Screenshot the page, email or message that shows the NRIC-based instruction, with the date and the organisation’s name visible.
• Hide your own NRIC digits and any password before saving or sending the image.
• Write down who asked, when, and what you were told the NRIC was for.

Next step: find the last password-protected file someone emailed you, such as an insurance document, and run the four questions; the 31 December 2026 deadline was 75 days away when this guide was rechecked on 17 October 2026. More on looking after what you buy is on the ownership topic page.

Common questions