SINGAPORE Trends and Developments Contributed by: Chong Kin Lim, David N. Alfred and Anastasia Chen, Drew & Napier LLC
fication under this enhanced framework, which serves as a recognised mark of accountable data protection practices and provides assurance to consumers and regulators on the organisation’s handling of personal data. The new standard introduces clearer require - ments in areas such as third-party management and overseas data transfers and is overseen by the Sin- gapore Accreditation Council to ensure certification assessments meet globally recognised standards. For organisations, certification under the Singapore Standard serves as an externally recognised indicator of robust and accountable data governance. For businesses deploying AI systems, the devel - opments signal increasing regulatory expectations around testing, assurance and accountable data prac - tices. Organisations should consider whether PETs can be incorporated into AI development pipelines, assess participation in regulatory sandboxes where appropriate, and evaluate certification frameworks such as the Data Protection Trustmark as part of their broader AI and data governance strategies. Phasing Out of NRIC Numbers for Authentication In February 2026, the PDPC announced that pri - vate organisations must cease using NRIC numbers for authentication purposes by 31 December 2026. Organisations that continue to rely on full or partial NRIC numbers as authentication credentials may be found to have breached Section 24 of the PDPA for failing to implement reasonable security arrange - ments, with enforcement expected to intensify from 1 January 2027. This development builds on the June 2025 joint advi - sory issued by the PDPC and the Cyber Security Agency of Singapore, which clarified that NRIC num - bers should not be used as authentication credentials. Practices such as using NRIC numbers as default passwords, or combining them with easily obtainable information like names or dates of birth, have been identified as insecure because NRIC numbers are widely used identifiers and may be readily exposed or guessed. For businesses, the announcement may require sig - nificant changes to existing systems and processes. Many organisations, particularly in sectors such as tel -
ecommunications, healthcare and financial services, have historically relied on NRIC-based verification for user portals and access to digital documents. These organisations will need to review their existing authen - tication workflows and implement more secure alter - natives, such as one-time passwords, authenticator applications or multi-factor authentication. More broadly, the phase-out reflects the PDPC’s continued emphasis on security-by-design and the expectation that authentication methods should be proportionate to the sensitivity of the personal data involved. Organisations with legacy systems or large customer bases should therefore prioritise transition planning well ahead of the 31 December 2026 dead - line. Amendments to the PSGA In January 2026, Parliament passed amendments to the PSGA, marking a notable development in Singa - pore’s public-sector data governance framework. The amendments are intended to streamline data-sharing processes to support the more efficient delivery of public services, including by extending the data-shar - ing regime to trusted external partners beyond the public sector engaged by the government. The amendments permit public agencies to share data with such trusted external partners, provided that the sharing serves the same seven public-interest pur - poses recognised under the Act. This represents a measured expansion of the original framework, which previously focused on data sharing among public agencies. The change reflects the practical reality that many public services are delivered in collabora - tion with external organisations, such as social service providers, research institutions, and private-sector vendors, which may require access to government- held data to perform their functions effectively. To address the risks associated with extending data access beyond the public sector, the amendments introduce three key safeguards for data sharing with external partners: • data may only be shared where it serves one of the legitimate public-interest purposes specified under the PSGA;
429 CHAMBERS.COM
Powered by FlippingBook