This one trips up a lot of clinics. The old habit was to ask for the NRIC on every form, for everything. The rules changed in 2019, and it's worth ten minutes to get it right. Let's keep it plain.
What the NRIC rules actually say
Since 1 September 2019, the PDPC's rules say an organisation generally cannot collect, use or disclose an individual's NRIC number — and cannot keep a copy of the physical NRIC — unless one of two things is true:
- 1It's required under the law (for example, a rule that specifically asks for the NRIC), or
- 2It's necessary to accurately verify a person's identity to a high degree — meaning a case where getting the wrong person, or mixing up two people, would have significant consequences.
Outside those two situations, the default is: don't collect the NRIC. Use something else — a name and phone number, a member number, or an ID you generate yourself.
So can a clinic collect it? Usually, yes
Here's the good news for clinics: correctly identifying a patient — so the right notes, allergies, medications and results are attached to the right person — is exactly the kind of situation where a mix-up is high-consequence. Getting two patients confused isn't a minor admin slip; it can be dangerous. So for the core job of building and maintaining a patient's medical record and treating them safely, accurately verifying identity generally justifies collecting the NRIC. Most clinics can, for that purpose.
But not for everything
The catch is that "we're a clinic" doesn't give you a blanket pass to collect NRICs for any purpose. The moment it's not about verifying identity for care, the justification falls away. Don't collect NRIC for:
- ✕Lucky draws or contests — a name and contact number identifies a winner just fine.
- ✕Generic mailing lists or newsletters — you don't need someone's NRIC to email them.
- ✕Membership or loyalty perks — issue your own member ID instead.
- ✕General sign-ups and enquiry forms — collect only what the task actually needs.
For all of these, the rule is the same: use another identifier. The NRIC is a permanent, unique number tied to a lot of a person's life, so the PDPC wants it used sparingly.
Watch the photocopy habit
There's a second, separate point that catches clinics out: keeping a physical copy of the NRIC. The PDPC advises against photocopying, scanning or retaining an image of the NRIC card unless it's required by law or genuinely necessary. In most cases a clinic can simply record the NRIC number it's entitled to collect, rather than keep a photocopy or scan of the card. Fewer copies floating around means less to lose in a breach.
If you do collect it, store it properly
Where you're entitled to collect the NRIC, the job isn't over — you have to look after it:
- ✓Store it securely — in your clinic system, not on loose paper, sticky notes or a shared spreadsheet anyone can open.
- ✓Limit who can see it — only staff who genuinely need it for their work.
- ✓Don't show it more than needed — avoid printing full NRICs on queue tickets, labels or screens visible to the next patient.
- ✓Don't over-keep — the PDPA says don't hold data longer than you need it.
Who decides all this? Your DPO
Deciding when the NRIC is and isn't collected — and writing that into your forms and your front-desk habits — is exactly the kind of call your Data Protection Officer exists to make. Every clinic in Singapore must appoint one (there's no size exemption), and a good DPO turns these rules into a simple, clear practice your reception can actually follow. If you're not sure who your DPO is or whether your forms are asking for too much, start there: does my clinic need a DPO?
Common questions
Usually yes. Because a clinic must be sure it has the right patient attached to the right medical record — where a mix-up is high-consequence — accurately verifying your identity generally justifies collecting your NRIC. But it should not be collected for things unrelated to your care.
You can ask why it's needed. If it's for your medical record and safe treatment, the clinic usually has a valid basis to collect it. If it's for a lucky draw, mailing list or membership perk, the clinic should accept another identifier instead, because the PDPA says NRIC shouldn't be collected for those.
The PDPC advises against collecting or retaining a physical copy of the NRIC unless it's required by law or truly necessary. A clinic can usually record the NRIC number rather than keep a photocopy or scan of the card, and should avoid unnecessary copies.
When identity doesn't need to be verified to a high degree. Lucky draws, generic mailing lists, membership or loyalty perks and general sign-ups don't need an NRIC, so the clinic should use another identifier such as a name and phone number instead.
Sources
- Personal Data Protection Commission (PDPC) — pdpc.gov.sg (Advisory Guidelines on the PDPA for NRIC and other National Identification Numbers, effective 1 Sept 2019)
- Ministry of Health (MOH) — Healthcare Sector guidance & the Healthcare Services Act (HCSA)
I build websites and help Singapore businesses run them well. HeyAda is my Singapore web studio — design, SEO, and the practical side of running a business online, including the patient data your clinic collects. I write these guides in plain English, and I can be your clinic's outsourced DPO. Getting your clinic PDPA-ready? Say hi.
Want your clinic's forms done right?
We help Singapore clinics get PDPA-ready — right NRIC rules, right consent, right storage — and stand in as your outsourced DPO. Let's talk.