From 1 September 2019, organisations will have to conform with the Personal Data Protection Act and are expected to stop collecting, using or disclosing customers’ NRIC and other national identification numbers where it is not required under the law or necessary to establish or verify an individual’s identity to a high degree of fidelity.