The Personal Data Protection Commission will step up enforcement from Jan 1, 2027, including issuing directions or imposing financial penalties for misuse. SINGAPORE: Private organisations have until Dec 31, 2026 to phase out the use of NRIC numbers for authentication, said the Personal Data Protection Commission (PDPC) on Monday (Feb 2). Enforcement action against the misuse of NRIC numbers will be ramped up after that, PDPC added, as it moves to reduce the risk of unauthorised access to