All private organisations will have to stop using NRIC numbers for authentication by the end of the year, said the Infocomm Media Development Authority (IMDA). In a press release on Monday (Feb 2), the authority said that organisations have up to Dec 31 to review their current authentication practices. From Jan 1, 2027, the use of NRIC numbers for authentication to access personal data may be considered a breach of the Personal Data Protection Act (PDPA). The Personal Data Protection Commission (PDPC) will step up enforcement action against such misuse, said IMDA. Possible penalties include imposing directions or financial penalties for such breaches where appropriate. Government agencies have ceased NRIC authenticationIn June last year, the PDPC and Cyber Security Agency of Singapore (CSA) issued a joint advisory against the use of NRIC numbers for authentication purposes.  Read more