SingaporeCan my NRIC be collected by private businesses?
Yes, private businesses in Singapore can collect your NRIC number only if it is necessary for their purpose and they comply with the Personal Data Protection Act 2012.
What the Law Says
The Personal Data Protection Act 2012 (PDPA) sets strict rules on how private organisations in Singapore may collect personal data — including NRIC numbers.
Under the PDPA, a private business may collect your NRIC number only if the collection is necessary for a legitimate purpose and you have given consent. The law does not ban NRIC collection outright, but prohibits it where less intrusive alternatives exist — for example, using a unique membership ID instead of the full NRIC number.
Organisations must also inform you of the purpose of collection and cannot collect more data than needed. If your NRIC number is collected, it must be protected and not retained longer than necessary.
Statutory TextAn organisation shall not collect personal data about an individual unless the collection of the personal data is necessary for a purpose that is directly related to the functions or activities of the organisation.
— Personal Data Protection Act 2012, s. 13 — Collection Limitation
What to Do
Ask the business why they need your NRIC number and whether a less sensitive identifier (e.g., membership number) would suffice.
Withhold consent if the collection seems unnecessary — the business cannot deny service solely for refusing unnecessary NRIC collection.
Report suspected PDPA breaches to the Personal Data Protection Commission (PDPC) at https://www.pdpc.gov.sg.
Sources
Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.