Government reveals ACRA moved ahead of plans on unmasking NRIC numbers in response to privacy concerns

The Singapore government announced early Saturday (14 December) that it intends to change the practice of masking National Registration Identity Card (NRIC) numbers, after privacy concerns were raised over the new Bizfile portal.

The portal, launched by the Accounting and Corporate Regulatory Authority (ACRA) on 9 December, allowed individuals’ full NRIC numbers to be accessed for free in search results, prompting significant public anxiety.

The Ministry of Digital Development and Information (MDDI) acknowledged lapses in coordination. “We acknowledge that coordination could have been better so that ACRA’s move would not have run ahead of the government’s intent,” the ministry said in a statement, adding that unmasking NRIC numbers was meant to follow a public education campaign.

ACRA, in its own statement, admitted its premature rollout of the feature. “We recognise that we moved ahead with unmasking before adequately preparing the ground,” it stated. Both agencies apologised for the anxiety caused, with ACRA pledging to refine the portal’s features to balance corporate transparency with privacy concerns.

Concerns over exposed NRIC numbers

Previously, under the BizFile+ system, only the last three digits and the alphabet of NRIC numbers were displayed, and users needed to pay for full details.

However, the new system displayed full NRIC numbers for free in search results, creating widespread concern.

The issue gained traction after a Facebook post by former journalist Bertha Henson on Thursday (12 December).

In her post, she described how easily sensitive information could be accessed on the portal, writing: “This raises serious questions about privacy and misuse of personal data.”

Subsequent investigations by The Online Citizen revealed that the search function worked for individuals across different sectors, including Cabinet ministers.

The Straits Times also reported an incident in which a housewife, Gina Tan, discovered that scammers could misuse this publicly available information.

Ms Tan recounted how her mother was nearly tricked into providing banking details by a fraudster posing as an Interpol officer. The scammer cited her mother’s full NRIC number and address, making the impersonation appear credible.

Temporary suspension of search function

The backlash led ACRA to temporarily disable the search feature on Friday morning (13 December), before briefly restoring it later in the day. The feature was then disabled again on Saturday morning, with a pop-up message on the portal stating: “This service is temporarily unavailable. We apologise for the inconvenience caused.”

ACRA clarified that the portal’s features were intended to support corporate transparency and trust in the business environment. However, it acknowledged public unease with the unmasked NRIC numbers and stated that adjustments would be made.

Broader government policy and context

MDDI justified the broader policy of unmasking NRIC numbers, explaining that NRIC numbers are designed to be unique identifiers rather than confidential information. The ministry argued that masking NRIC numbers can create a “false sense of security” because the masked portion can often be guessed using basic algorithms and supplementary data.

“There should therefore not be any sensitivity in having one’s full NRIC number made public, in the same way that we routinely share and reveal our full names to others,” MDDI stated.

The ministry added that problems arise when NRIC numbers are used for authentication, which it said is an improper practice. “Likewise, the NRIC number should not be used as passwords, just as we should not be using our names as passwords,” the ministry explained.

It further acknowledged that many Singaporeans have “long treated” NRIC numbers as private information and noted that a transition to this new way of thinking would take time.

Legal considerations and exemptions

The Personal Data Protection Act (PDPA), which governs the handling of personal data by private organisations, generally prohibits the collection or use of NRIC numbers unless required by law or for high-fidelity identity verification.

Organisations are also mandated under Section 24(a) of the PDPA to protect personal data from unauthorised access, misuse, or disclosure.

Since September 2019, organisations have been restricted from collecting NRIC numbers unless strictly necessary. Those found in breach of these regulations can face significant fines or imprisonment.

However, statutory boards like ACRA are exempt from the PDPA. This exemption means that while private entities are bound by these protections, ACRA’s actions are not subject to the same legal framework, which has led to some questions about accountability.

To address public concerns, MDDI and the Personal Data Protection Commission (PDPC) announced plans for a public education campaign in 2025.

These efforts will aim to clarify the intended role of NRIC numbers as identifiers and promote stronger authentication practices to prevent misuse.

MDDI stated that these campaigns will focus on helping Singaporeans understand how NRIC numbers should be freely used for identification but avoided as authentication tools.