PDPC NRIC Rule: What Singapore Employers Need to Know Before 2027

In This Guide

1. What Changed and When: the PDPC/CSA Timeline
2. NRIC as Identifier vs NRIC as Password
3. What Must Stop Before 31 December 2026
4. The Impact on HR and Payroll Teams
5. Recommended Alternatives: What to Use Instead
6. What Happens After 1 January 2027
7. FAQs

For years, Singapore employers have password-protected employee documents with the last four characters of the employee's NRIC number, their date of birth, or both. Payslips, tax documents, contracts and offer letters were all locked with the same number that appears on every employee's identity card.

That practice has to end by 31 December 2026. The PDPC and the Cyber Security Agency of Singapore (CSA) issued a Joint Advisory against using NRIC numbers for authentication in June 2025, the PDPC set the deadline in February 2026, and stepped-up enforcement begins on 1 January 2027.

This guide explains what the rule covers, what HR and payroll teams need to change, and which alternatives to consider for the documents employers send every month. It reflects official guidance as of November 2026, including the Joint Advisory as updated in May 2026.

1. What Changed and When: the PDPC/CSA Timeline

The rule is part of the Government's broader effort to ensure NRIC numbers are used responsibly. In December 2024, the Government clarified that masking NRIC numbers offers limited protection, and that an NRIC number identifies a person but should not be relied on to prove who they are. This did not mean organisations may collect or disclose NRIC numbers more freely: they still need a legitimate purpose under the Personal Data Protection Act (PDPA).

Why can't masking fix this? NRIC numbers are widely known and follow a predictable format, so using only the last four characters (for example, "567A") does not make them safe for authentication. Combining an NRIC with other easily obtainable data, such as a name or date of birth, does not help either.

2. NRIC as Identifier vs NRIC as Password

The rule does not stop employers from holding NRIC numbers. Employers still need them, or the relevant work pass details, for employment records, CPF contributions and tax reporting. What changes is whether the NRIC can be used to verify someone's identity.

Singpass is a useful reference. The user is authenticated through Singpass's own login flow, with a password, one-time password (OTP) or biometrics. Only then may Singpass return an identifier such as the NRIC/FIN or a UUID so the system knows who the user is. Receiving the NRIC as an identifier after authentication is different from using the NRIC itself to authenticate.

3. What Must Stop Before 31 December 2026

The Joint Advisory addresses the use of full or partial NRIC numbers, alone or combined with other easily obtainable personal data, to authenticate individuals. For employers, that covers practices that have been standard for years:

• Full NRIC as a password, for example "S1234567A"
• The last four characters as a document password, for example "567A"
• Partial NRIC combined with personal data, such as a name or date of birth, for example "TAN567A" or "567A01Jan80"
• NRIC as a PIN or default password for employee self-service portals or HR systems
• NRIC as a security question answer for account recovery

The HR examples in this guide apply that principle to everyday workflows. The test is always the same: is the NRIC being relied on to verify someone's identity or unlock access? If it is only shown or used to identify a record, the authentication rule is not what applies, although PDPA obligations on collecting and disclosing personal data still do.

4. The Impact on HR and Payroll Teams

NRIC-based passwords are built into many everyday document workflows. Here is where they most often appear and what needs to change.

Payslips sent by email

Monthly payslips are often sent as PDFs locked with the employee's NRIC or its last four characters. Replace this before 31 December 2026 with a unique, randomly generated password sent through a separate channel such as SMS, or with a secure payroll platform or intranet where each employee has their own login.

IR8A forms and tax documents

Employment income for 2026 is reported in the 2027 tax reporting cycle, with a deadline of 1 March 2027, after the NRIC deadline. Employers in the Auto-Inclusion Scheme (AIS) submit employment income information to IRAS electronically, while employers outside the AIS issue Form IR8A and related appendices to employees. Either way, tax documents you send employees in early 2027 must not be protected with NRIC-based passwords, so update delivery before the 2027 cycle begins.

Offer letters and employment contracts

Some HR teams send offer letters and contracts as NRIC-protected PDFs. This is less common than payslip protection but falls within the rule in the same way.

Employee self-service portals

Using an NRIC only as a username is not, by itself, the same as using it as a password. What must change is any portal where the NRIC, full or partial, is the default or initial password, the PIN, or the credential used to reset or verify an account. Replace these with individually assigned credentials and MFA, or with Singpass or corporate single sign-on.

Leave and attendance systems

Some time-and-attendance systems use NRIC numbers for clock-in verification. Where the NRIC works as an authentication credential rather than a lookup identifier, it falls within the rule.

5. Recommended Alternatives: What to Use Instead

The direction from the PDPC and CSA is to move to authentication that does not rely on predictable, widely known or derivable personal data. These are practical options for common HR scenarios; each organisation should assess which fits its circumstances and risks.

The general principle is to separate the document from its access credential: send the document through one channel, such as email, and the password through another, such as SMS to the employee's registered mobile number. The password should be unique and randomly generated, never derived from personal data.

6. What Happens After 1 January 2027

The deadline marks the end of the transition period. The PDPC's February 2026 announcement said it will step up enforcement from 1 January 2027 against private organisations that still use full or partial NRIC numbers for authentication, with directions or financial penalties imposed where appropriate.

Employers carry extra exposure because payslips and HR files hold salary, tax, medical leave and bank details alongside the NRIC itself. If a weakly protected payslip is opened by the wrong person, the employer may face PDPA data protection and breach obligations as well as the authentication rule. Employees and members of the public can also report NRIC misuse directly to the PDPC at go.gov.sg/reportnric.

December is already busy with bonus payroll, leave reconciliation and year-end payslips, so it is a risky month to change document delivery. Review and test your revised process during the November 2026 payroll cycle, leaving time to fix problems before 31 December 2026.

How Slasify Protects Employee Documents for You

When you hire or pay Singapore employees through Slasify, document delivery does not rely on NRIC-based passwords:

• Payslips and HR documents are downloaded from the Slasify employee portal with individually assigned login credentials, not NRIC numbers
• Platform access supports MFA, in line with the PDPC and CSA's recommended practices
• NRIC numbers are held for statutory purposes such as CPF and tax reporting, and are never used as authentication credentials
• Our information security management is ISO 27001 certified

We employ through our own entity in Singapore and support hiring and payroll in more than 150 countries. See our Employer of Record and Global Payroll services for the full scope.

PDPC NRIC Rule FAQs for Singapore Employers

Sources

PDPC and CSA: PDPC, organisations to cease the use of NRIC numbers for authentication by 31 December 2026; PDPC media release, February 2026; CSA Advisory AD-2025-014, Joint Advisory (June 2025); PDPC/CSA, Updated Joint Advisory (May 2026).

MDDI: Responsible use of NRIC numbers across public and private sectors; Stopping the use of NRIC numbers as passwords in the private sector; Reply on disclosure of NRIC numbers on Bizfile.

MOH: Circular 0001/2026, ceasing the use of NRIC numbers for authentication.

MOM: Employment records; Itemised payslips.

IRAS: Reporting employee earnings (IR8A, Appendix 8A, Appendix 8B).

Law firms: Baker McKenzie, February 2026; Rajah & Tann, February 2026.

Slasify: Slasify Employer of Record; Slasify Global Payroll.