NRIC authentication phase-out: 31 Dec 2026
The PDPC has restricted collecting full NRIC numbers by default since 2019, and from 31 December 2026 organisations must also stop using the NRIC as an authentication factor, with enforcement stepping up from 1 January 2027. Photocopying an IC at gym sign-up falls squarely inside that.