Key Takeaways
- What are the main hiring regulations employers need to consider in Singapore?
Employers need to familiarise themselves with the Personal Data Protection Act (PDPA), Singapore’s personal data protection framework for private sector organisations, as well as the restrictions that apply to National Registration Identity Card number (NRIC) collection for authentication purposes and the Employment Act, which specifies the circumstances under which the NRIC may be collected. - What are employers’ main obligations regarding candidate personal data under the PDPA?
Employers must issue a notice and obtain candidates’ consent before collecting, using, disclosing, and storing their personal data, while also putting in place safeguards to protect any data in their possession. - Are employers required to collect their candidates’ NRIC number to verify their identity?
Employers are required to collect their employees’ NRIC number, but there are restrictions against collecting this information to process job applications. Employers can verify their candidates’ identity through trusted third-party solutions as an alternative.
Over time, Singapore has evolved into a world leader in business and finance, attracting multinational corporations and top talent from around the world. Unemployment rates in the country remain low, showing strong resilience in a turbulent world economy. In addition to its strong local job market, Singapore attracts international talent, drawn by its political and economic stability, efficient infrastructure, and multicultural environment.
While Singapore’s dynamic job market provides employers with unparalleled workforce opportunities, it also comes with its share of compliance challenges. Organisations must learn to navigate complex regulatory frameworks while managing risks. In 2012, Singapore enacted the Personal Data Protection Act (PDPA), which provides the legal framework for collecting, using, disclosing, and storing individuals’ personal data. Organisations that are found to have violated the PDPA can be fined up to $1 million SG or 10% of their annual turnover, whichever is higher.
Fraud is also on the rise, with common schemes taking advantage of Singaporeans’ high degree of trust in the government and institutions to illegally obtain their personal data. First launched in 2003 by GovTech, the SingPass application is one of the main initiatives put in place by the Singapore authorities to address the rising identity fraud. Organisations based or hiring in Singapore must comply with identity verification requirements when screening workers. Traditionally, identity would be verified through validating National Identity Registration Card (NRIC) numbers, but this practice will be restricted as of December 31, 2026 if using authentication, compelling employers to look for more secure alternatives.
This blog, which is presented for informational purposes only, examines identity verification and PDPA hiring compliance in Singapore and how organisations can build workforce trust through hiring and screening programs that support their regulatory obligations. Since each case can differ, employers seeking guidance for specific scenarios should seek qualified legal counsel.
What is the PDPA and how does it impact hiring?
The Personal Data Protection Act (PDPA) provides Singapore’s framework for the collection, use, disclosure, and retention of personal data by private sector organisations. The Act applies to all data collected and processed in Singapore, even when the organisation is located overseas. Organisations that hire or provide services in Singapore should therefore be mindful of their obligations under the PDPA.
The PDPA sets forth eleven principles that organisations must follow when handling individuals’ personal data. These principles apply to all organisations that collect their candidates’ and employees’ personal data for hiring and employment management purposes, including background screening in Singapore. In general, PDPA principles require employers to treat personal information in a responsible and transparent manner and take appropriate steps to protect it against unauthorised use and access.
Managing candidate consent and personal data under the PDPA
Based on the PDPA Principle of Notification, employers must issue candidates and employees with a notice explaining why their data will be collected, processed, and disclosed before completing the required identity verification and background checks. If personal data will be disclosed to third parties, such as employers, educational institutions, or background screening companies as part of the screening process, individuals should be notified.
Candidate consent under the PDPA should be collected in writing, through an appropriate consent form, in order to keep an audit trail. Individuals have the right to withdraw their consent with reasonable notice, in which case employers should stop all processing activities.
Employers are also required to put in place security measures to protect their candidates’ and employees’ personal data from unauthorised access, collection, use, disclosure, copying, modification, disposal, and similar risks. This could involve setting up controls so that only the employees who need personal data for legitimate business or legal purposes can access it, protecting data through encryption when transferring it, and implementing safeguards against loss and theft.
Employers who are unsure about their specific obligations should consult their legal advisors.
Transparency and communication
As part of the PDPA compliance process, employers must designate a data protection officer (DPO) who will be responsible for overseeing the organisation’s policies, processes, and safeguards. DPO responsibilities may include providing staff with compliance awareness training, handling privacy inquiries and complaints, identifying potential risks to data privacy, and monitoring the organisation’s activities on an ongoing basis to spot red flags and help prevent violations.
Organisations should also make their data protection policies, practices, and complaints process available to candidates and employees, either by default or upon request. In addition to helping employers meet DPDA requirements, transparency promotes best practices and empowers candidates and employees to advocate for their own interests.
Click here to explore our compliance and thought leadership resources for the APAC region.
NRIC and personal data handling considerations
The National Registration Identity Card number (NRIC) is a compulsory identity document that all Singaporean citizens and permanent residents must acquire within one year of their 15th birthday or upon acquiring citizenship or permanent resident status. The NRIC comes with special privacy considerations. For a long time, organisations used NRIC numbers to identify and authenticate individuals, including customers, candidates, and employees. However, rising fraud concerns have led to increased criticism around this practice. Because NRIC details cannot be altered or cancelled, data breaches involving NRICs can have major repercussions for individuals, compromising their financial, healthcare, and government information and leading to widespread impersonation.
In January 2025, the Personal Data Protection Commission (PDPC) announced it would crack down on the use of NRIC numbers for authentication purposes, with financial penalties for non-compliance. By December 31, 2026, private sector organisations are required to switch to more secure methods in order to authenticate individuals for most purposes.
When NRIC collection is allowed
While collecting the NRIC number for identification purposes is banned in most contexts, the PDPC allows exceptions in two cases:
- When using the NRIC number is required by the law;
- When the NRIC number is necessary to establish the identity of an individual to a high degree of accuracy.
The Employment Act 1968 requires employers to maintain detailed employment records of their employees, including their NRIC number. However, this requirement does not extend to collecting candidates’ information as part of screening job applications. When collecting the NRIC number for employment purposes, employers should be prepared to provide justification to the authorities if required.
As with other sensitive personal data, organisations should put appropriate safeguards in place to protect NRIC numbers against unauthorized access and safely dispose of them once they are no longer legally required. NRIC employer requirements are complex. Organisations who are unsure about whether NRIC collection is allowed in a particular instance can review the PDPC Advisory Guidelines or consult their legal advisors.
Understanding digital identity in employment verification
While collecting the NRIC number is no longer part of standard preemployment processes in Singapore, identity verification by the employer remains crucial when screening candidates. Confirming candidates’ identity upfront helps employers assess whether the right person is being screened before proceeding with the background check, helping mitigate the risks of identity fraud. In recent years, digital identity solutions have emerged to provide an alternative to NRIC collection. These include both official methods available through the national Singpass program and private sector identity verification services through trusted third parties.
Organisations in Singapore are generally not permitted to collect, use, or disclose the Singapore NRIC. Where organisations are permitted to collect NRIC numbers, they must nonetheless comply with the Data Protection Provisions of the PDPA in relation to the collection, use, disclosure, and protection of such personal data.
Organisations are only permitted to do so in the following circumstances:
- If the collection, use or disclosure of the NRIC (or copies of the NRIC) is required under law (or an exception under PDPA applies); or
- The collection, use or disclosure of the NRIC (or copies of the NRIC) is necessary to accurately establish or verify the identities of the individuals to a high degree of accuracy.
In an employment context, collecting the NRIC will be permitted under section 95 of the Employment Act, as all employers are required to maintain detailed records of the employee, which includes the NRIC. Therefore, if the collection of NRIC falls under these circumstances, the collection will be permitted. However, if the NRIC is being collected when completing a job application, this is not permitted, as there is no requirement under the law to collect this information for the purpose of a job application.
What is Singpass?
Originally launched by GovTech in 2003 as a simple username and password login system, Singpass has evolved over the years to become a digital wallet that helps individuals quickly and easily authenticate themselves and access a wide range of services. According to government data, approximately 97% of Singapore citizens and permanent residents use Singpass to facilitate about 300 million personal and corporate transactions every year.
While Singpass provides an alternative to NRIC number or physical identity document collection, it is not risk-free. In recent years, fraud cases involving Singpass have become more frequent, with a common scheme involving fraudsters posing as employers to obtain candidates’ Singpass credentials, allowing them to impersonate their victims. As a result, the Singapore Police Force has issued a warning to candidates advising them against providing their Singpass credentials or scanning their Singpass code as part of the job application process.
Benefits of identity verification for employers and candidates
To avoid the common pitfalls associated with identity verification, many organisations are relying on a trusted third-party provider to verify their candidates’ identity before proceeding with the background check and job offer. A wide range of solutions exist on the market, most of which analyse candidates’ ID documents and compare them with their selfies to confirm they are who they claim to be. In addition to providing a more secure method of identity verification, third-party solutions can support a better candidate experience by extracting identity information from ID documents to prefill consent forms and other employment-related processes.
Click here to learn more about First Advantage’s Instant Identity solutions.
Building a trusted hiring process that supports compliance
Singapore’s regulatory landscape continues to evolve, adapting to the challenges raised by new technologies and a shifting global market. Aligning with regulatory expectations is simpler when requirements are embedded directly into hiring and screening processes, reducing the risks of accidental oversights. To facilitate compliance, organisations should work closely with both their internal compliance experts and their background screening provider to design an identity verification and background check programme that takes into account their obligations while anticipating and addressing potential roadblocks.
Integrating identity verification
While the restrictions on collecting candidates’ NRIC numbers may cause some employers to wait until after the job offer has been accepted to verify candidates’ identity, there are benefits to an identity-first approach. Verifying candidates’ identity before proceeding with background screening helps employers confirm that the checks are being conducted on the right person, helping to mitigate risk of candidate fraud and saving organisations time and money. Through integration with an HRIS or ATS system, third-party providers may be able to provide solutions that verify candidates’ identity at the start of the screening process, allowing organisations to track the results within the same platform they already use to manage other employment-related workflows.
Supporting the candidate experience
Identity verifications and background checks have significant value for employers, beyond helping them meet their compliance obligations. According to findings from our 2026 Global Workforce Trends Report, with insights from more than 5,000 CHROs, HR professionals, and job candidates, 7 in 10 candidates claim that screening increases their trust in an organisation. An efficiently run background screening programme tells candidates that their potential employer prioritises workplace safety, compliance with regulations, and hiring genuinely qualified employees.
However, the same screening policies that candidates value can easily drive them away if background check processes are cumbersome, time-consuming, or disorganised. Identity verifications and background checks should be fast and frictionless, not only for hiring managers, but also for candidates. When selecting an identity and background screening provider, employers should ask for a demo of the candidate experience to evaluate its convenience and ease of use.
The PDPA governs how candidate data is handled in Singapore. Employers must manage consent and personal data responsibly, according to the eleven privacy principles prescribed by the Act. While the regulations around personal data collection methods have tightened in recent years, identity verification remains central to hiring in Singapore, with trusted providers supporting secure and efficient identity solutions. Structured processes help support compliant hiring by integrating requirements directly into hiring and background screening workflows, simplifying both staff and candidate experiences.
Contact us to learn how First Advantage’s identity verification and background screening solutions can support trusted hiring in Singapore.
Frequently Asked Questions
What is the PDPA in Singapore hiring?
The Personal Data Protection Act (PDPA) provides a framework for the collection, use, disclosure, and retention of personal data by private sector organisations that are based or operate in Singapore.
How should employers handle candidate data?
Employers should handle candidate data according to the eleven privacy principles prescribed by the PDPA. Notably, employers need to issue a notice to candidates and obtain their consent before collecting, using, disclosing, and storing their personal data, while putting in place strong safeguards to protect the data in their possession from unauthorised access.
Why is identity verification important in Singapore?
Identity fraud, including applicant identity fraud, is a growing concern. By verifying their candidates’ identity before proceeding to the background checks and job offer, employers can assess whether their candidates are the people they claim to be.
Is Singpass required for employment verification?
While preemployment identity verification may be required for some regulated positions, employers are not obligated to use Singpass to authenticate their candidates. Due to fraud concerns, some employers may choose to use trusted third-party identity verification solutions instead.
What are NRIC rules for employers?
The Personal Data Protection Commission (PDPC) restricts the collection of NRIC numbers, which is only allowed when it is required by law or when establishing an individual’s identity with a high degree of fidelity is necessary. Collecting employees’ NRIC number is required under the Employment Act 1968, but this requirement does not extend to job applications.
