Prohibition Against Collection of NRIC Numbers
The Personal Data Protection Commission (PDPC) issued an advisory on 31 Aug 2018 to prohibit the collection, use and disclosure of NRIC (or copies of NRIC) unless the verification of a person's identity to a high degree fidelity is required and necessary to prevent:
(i) a significant safety or security risk; and/or
(ii) a risk of significant impact or harm to an individual or to the organisation.
The collection of partial NRIC numbers is also disallowed, and should not be used for either identification or authentication purposes.
NTU-IRB advises all researchers to cease collection of NRIC numbers (whole or partial) unless the research interventions are medical / clinical in nature; or if the PI can justify points (i) and (ii) above in your research study.
- If your consent forms or protocol asks for NRIC numbers (whole or partial), please remove these requirements immediately.
- For researchers with existing NRIC records of participants, please erase your records or reduce your records to partial NRIC numbers (e.g. Sxxxx567A) if you wish to maintain fidelity of records. Note that partial NRIC numbers are still considered Personal Data.
Alternatives to NRIC numbers (whole or partial) for identity verification:
i. Full Name
ii. Matriculation number (for student participants)
iii. Email addresses and/or mobile numbers
iv. Visual checking of photo ID or NRIC, without recording the NRIC number
Note: All alternatives listed above still constitute personal data. Researchers remain responsible for ensuring appropriate protection, and secure handling of all personal data collected in accordance with NTU’s Data Governance Policy.