ShareAndGoShareAndGo

Security

Protecting NRIC numbers before documents leave your business.

NRIC numbers turn up everywhere in Singapore business paperwork: employment contracts, shareholder registers, tenancy agreements, loan files, director resolutions. When those documents go into a due diligence room or an audit, the numbers often travel with them, to people who have no need to see them.

This article sets out what the PDPC has said about NRIC numbers, and a practical routine for keeping them out of shared documents. One point first, so nothing is assumed: ShareAndGo does not detect or remove NRIC numbers for you. That work happens before upload, and this article explains how to approach it.

Get started

Why the PDPC treats NRIC numbers differently

The PDPC's Advisory Guidelines on the PDPA for NRIC and other National Identification Numbers were issued on 31 August 2018 and took effect on 1 September 2019. They describe the NRIC number as a permanent and irreplaceable identifier which can potentially be used to unlock large amounts of information relating to the individual. A password can be changed after a leak. An NRIC number cannot.

The guidelines say organisations are generally not allowed to collect, use or disclose NRIC numbers or copies of NRIC, and may do so only where it is required under the law, or an exception under the PDPA applies, or where it is necessary to accurately establish or verify an individual's identity to a high degree of fidelity. The same treatment extends to Birth Certificate numbers, Foreign Identification Numbers (FIN) and Work Permit numbers. Organisations may retain an individual's physical NRIC only where the law requires it.

The PDPC said in December 2024 that the guidelines will be updated after consultation, and that in the meantime they remain valid. Check the PDPC website for the current version before you rely on any detail.

Disclosure is the moment that matters

Sharing a document is a disclosure. When a full shareholder register with NRIC numbers goes to a buyer's advisers, the question is not only whether you were entitled to hold those numbers, but whether disclosing them to this recipient, for this purpose, is justified. Often it is not: a buyer reviewing share ownership needs names and holdings, not identification numbers.

Mistakes here can also become breaches. The PDPC's Guide on Managing and Notifying Data Breaches lists sending personal data to a wrong email address or disclosing it to a wrong recipient among common human errors. A breach that is likely to cause significant harm, or that affects 500 or more individuals, is notifiable, and once you determine that, the PDPC must be told no later than three calendar days later. A spreadsheet of staff with NRIC numbers sent to the wrong party can reach that threshold quickly.

A routine before upload

  1. List what the recipient actually needs. Write down the purpose of the sharing, then look at each document against it. Identification numbers rarely serve a due diligence or audit purpose that names and roles do not.
  2. Remove what is not needed. Produce a working copy for sharing with the numbers taken out, using your document software's redaction tool or by preparing an extract without the column. Check the result: covering text with a black box in some editors leaves the number underneath, searchable and copyable. The safest extract is one where the number never appears.
  3. Consider partial numbers where some identifier is genuinely needed. The PDPC's guidelines say that collecting a partial NRIC number up to the last three numerical digits and checksum, for example 567A from S1234567A, would not be treated as collecting the full number. The guidelines also note that partial numbers can still be personal data where a person can be identified from them, so they still need care.
  4. Keep the original where it belongs. The unedited document stays in your own records under your usual retention rules. It does not need to be in the shared room.
  5. Record what you did. A short note of which documents were edited and why helps if anyone later asks how personal data was handled.

Where a data room helps after that

Once documents are cleaned, the data room's job is to limit who sees the rest and to record what happens. ShareAndGo gives you several controls for that:

  • Groups. Each party sees only the folders you allow, so payroll extracts can go to the one adviser who needs them and nobody else.
  • View-only sharing. For view-only recipients, PDFs, Word, Excel and PowerPoint files are rendered on our side and the original file is never sent to their browser.
  • Per-recipient watermarks. Every page a viewer sees carries their name, email address and the date, which discourages photographs and identifies the source if a page escapes.
  • Download, print and copy controls per room and per group.
  • An audit log of every view, upload, download, invitation and change, chained so alterations are detectable, and exportable as CSV.
  • AI search that finds words inside documents, including scans. That cuts both ways: before you invite anyone, search the room for an NRIC pattern you know, such as a prefix letter, to check nothing was missed.

Search is a check you run, not a guarantee. ShareAndGo does not scan for, flag or remove NRIC numbers, and a search will only find text it can read.

Ask the other side to do the same

Due diligence and audits run both ways. If you are the party requesting documents, say up front that you do not want identification numbers unless they are needed, and use a request list to be specific about what you are asking for. ShareAndGo's document request lists let you set out each item, assign it and track it, which makes it easy to write "names and roles only" against an item rather than relying on a covering email.

Questions people ask

Does ShareAndGo remove NRIC numbers from documents?
No. ShareAndGo does not detect or remove NRIC numbers. Remove them before upload, then use groups, view-only sharing and watermarks to limit and record access to what remains.
Can I share partial NRIC numbers instead?
The PDPC's NRIC guidelines say a partial number up to the last three digits and checksum would not be treated as the full number, but it can still be personal data. Ask your adviser whether it suits your purpose.
Are FIN and work permit numbers covered too?
The PDPC's guidelines extend the same treatment to Birth Certificate numbers, Foreign Identification Numbers and Work Permit numbers.

Keep reading

Data room permissions explained

How groups and view-only sharing limit what each party sees.

Screenshot protection

What watermarks and view-only can and cannot stop.

Data sharing agreements

What to agree before personal data changes hands.

Share less, and keep a record of who saw it.

Groups, watermarked view-only pages and a chained audit log in every room.

Get started