From 1 January 2027, all private organisations in Singapore must stop using NRIC numbers for identity verification. The Personal Data Protection Commission (PDPC) will step up enforcement, with non-compliant entities facing regulatory action or penalties. This article provides a clear overview of the policy change, key timelines, regulatory expectations, and what businesses should do to prepare.