Can your condo guard ask for your visitor’s NRIC? A security officer may look at a visitor’s photo ID, such as an NRIC, to check who they are. But under Singapore’s PDPA, a condo should generally not record the full NRIC number or keep the physical card. Name and contact number are usually enough for visitor registration. This guide explains what the rules say, what residents can do, and how MCSTs can get it right.
Many residents only think about this when a friend arrives and is asked to hand over their IC at the guardhouse. Some visitors refuse, the guard insists, and the resident ends up in the middle. Knowing the rules helps everyone: residents, visitors, security officers and the MCST council.
The short answer
What a condo guardhouse can and should not do
| Practice |
Generally OK? |
Why |
| Looking at a visitor’s photo ID to check identity |
Yes |
Visually checking ID is allowed; nothing needs to be recorded |
| Recording name and mobile number |
Yes |
Reasonable for contacting the visitor and for security records |
| Recording a partial NRIC (for example, last 3 digits and letter) |
Usually yes |
Commonly used as an alternative to the full number |
| Writing down the full NRIC number |
Generally no |
Only allowed if required by law or to verify identity to a high degree of fidelity |
| Keeping the physical NRIC card until the visitor leaves |
No |
PDPC asks organisations to stop retaining physical NRICs |
| Photographing or photocopying the NRIC |
Generally no |
A copy contains the full NRIC number and photo |
What the PDPA says about NRIC numbers
The Personal Data Protection Act (PDPA) governs how organisations in Singapore collect, use and disclose personal data. A condominium’s Management Corporation Strata Title (MCST) counts as an organisation under the PDPA, so it is responsible for the visitor data its guards and managing agent collect. The Personal Data Protection Commission (PDPC) has published advisory guidelines specifically for management corporations.
NRIC numbers get special treatment because they are permanent and used across many government and financial services. A leaked NRIC number can be misused for years. That is why the PDPC issued Advisory Guidelines on NRIC and other national identification numbers, which it began enforcing on 1 September 2019.
Under those guidelines, organisations should generally not collect, use or disclose NRIC numbers, or retain physical NRIC cards, unless:
- the collection is required under the law, or
- it is necessary to accurately establish or verify a person’s identity to a high degree of fidelity.
Visiting a friend at a condo usually does not meet either test. No law requires a condo to record your guest’s NRIC, and the risk at a residential gate is not normally high enough to justify it.
Can the guard still check my visitor’s IC?
Yes. In a 2022 reply to a parliamentary question, the government clarified that security officers can check a visitor’s photo ID, such as an NRIC, during registration to verify identity. They can also collect the visitor’s name and contact number.
The key difference is between looking and keeping. A guard who glances at an IC to confirm that the person matches the photo is doing their job. A guard who copies the full number into an open logbook, or holds the card until the visitor leaves, is creating a data protection risk for the MCST.
Why holding on to the physical IC is a problem
Many condos used to keep a visitor’s IC or driving licence at the guardhouse as a “deposit” to make sure the visitor returned their pass. The PDPC has asked organisations to drop this practice. A physical NRIC carries the full number, photo, address and date of birth. If it is lost, stolen or mixed up at a busy guardhouse, the visitor’s identity is exposed and the MCST may be held responsible.
There are better ways to make sure visitors check out, such as passes that expire automatically, a single exit point where passes are returned, or an app that records exit times.
What residents can do if the guard insists on the full NRIC
- Stay polite and offer alternatives. Your visitor can show their IC for a visual check and give their name and mobile number instead.
- Pre-register your visitor. If your condo uses a visitor management app, registering your guest in advance means the guard already has the details they need.
- Ask the managing agent for the condo’s visitor policy. Every MCST should have a written process, and the guards should follow it.
- Contact the MCST’s Data Protection Officer. Organisations covered by the PDPA must appoint a Data Protection Officer (DPO). The government’s guidance is that visitors should first raise concerns with the MCST’s DPO.
- Escalate to the PDPC if needed. If the issue is not resolved, a visitor can lodge a complaint with the PDPC.
Remember that the security officer at the gate is usually following instructions from the security agency or the managing agent. The fix is a better policy, not an argument at the barrier.
What MCSTs and managing agents should do
If your condo still collects full NRIC numbers, here is a practical clean-up plan.
- Update the visitor SOP: state clearly what guards may record (name, mobile number, unit visited, vehicle number, time in and out) and what they must not (full NRIC, copies of IDs, holding cards).
- Brief the security agency: make the new SOP part of the agency’s contract and site instructions, and include it in guard training.
- Secure old records: lock away old logbooks and set a retention period. Destroy records securely when that period ends.
- Appoint or confirm the DPO: make sure residents know who the Data Protection Officer is and how to reach them.
- Put up a notice: a short sign at the guardhouse explaining what visitor data is collected and why reduces arguments and shows good faith.
- Move to digital registration: a visitor management system lets residents pre-register guests, so guards verify rather than collect.
The stakes are real. Since October 2022, the maximum financial penalty under the PDPA is up to 10% of an organisation’s annual turnover in Singapore if that turnover exceeds S$10 million, or S$1 million otherwise. Beyond penalties, a data breach damages trust between residents and the council.
How digital visitor management removes the NRIC problem
Most NRIC problems start because the guard has no other way to know who the visitor is. Digital pre-registration solves this at the source.
Visitor registration: old way vs myCondo
| Step |
Logbook and IC deposit |
myCondo visitor management |
| Before arrival |
Nothing; guard does not know the visitor is coming |
Resident invites the guest in the app with name, time and car plate |
| At the gate |
Visitor writes details and hands over IC |
Visitor scans a QR pass, or the guard checks the name on the tablet |
| Identity check |
Full NRIC copied down |
Visual ID check if needed; resident has already vouched for the guest |
| Exit |
Visitor collects IC; exit often not recorded |
Exit logged automatically; pass expires |
| Records |
Open logbook kept indefinitely |
Access-controlled system with a set retention period |
With myCondo, residents invite visitors from the app, and each guest receives a pass that works only within the visit window. At the gate, guards see the visitor’s name and the inviting unit on their screen. If the visitor arrives by car, a licence plate recognition camera from our partners Dahua Technology or Hikvision can read the pre-registered plate and open the barrier. On foot, the visitor can scan the QR pass at a smart door station such as the Akuvox X915S, which supports QR, face, PIN, Bluetooth and card access.
Because the resident vouches for the guest in advance, the guard has no reason to collect a full NRIC. Records are stored securely, can be searched by the managing agent, and can be matched to CCTV footage in platforms such as Milestone XProtect when an incident needs investigation.
Special cases: contractors, delivery riders and walk-ins
Contractors and renovation workers
Contractors often visit for weeks. Instead of collecting an IC each day, the managing agent can issue a time-limited pass tied to the renovation permit and unit. The pass stops working when the permit ends.
Delivery riders
Food and parcel riders typically need only a few minutes. Many condos register the platform, the unit and the time, and some route deliveries to a drop-off point or parcel locker so riders do not need to enter residential blocks at all.
Walk-in visitors who were not pre-registered
The guard calls the unit or sends an app notification. The resident approves or declines entry. Once approved, the guard records the visitor’s name and contact number, and the visit is logged like any other.
A sample visitor data notice for your guardhouse
A short, clear notice at the guardhouse prevents most arguments before they start. It tells visitors what is collected and why, and it shows that the MCST takes data protection seriously. Here is a sample your managing agent can adapt:
Visitor registration notice
To keep our residents safe, we record your name, mobile number, the unit you are visiting, your vehicle number (if any) and your time of entry and exit. Our security officers may ask to see a photo ID to confirm your identity, but we do not record full NRIC numbers or keep identity cards. Records are kept securely for a limited period and then deleted. For questions, please contact the MCST’s Data Protection Officer at [email address].
Keep the notice short, place it where visitors queue, and make sure the security team can explain it in a sentence. If your condo uses digital registration, add a line telling residents they can pre-register guests in the app to skip the queue.
It also helps to review the notice once a year, together with the visitor SOP and the security agency contract. A quick annual check keeps the guardhouse process, the written policy and the notice consistent with each other.
Frequently asked questions
Is it illegal for a condo guard to ask for my NRIC?
Asking to see an ID is generally fine. Recording the full NRIC number or keeping the card is generally not allowed for routine condo visits under PDPC guidelines, unless a law requires it or a high level of identity verification is genuinely needed.
Can the guard record the last few characters of my NRIC?
Many organisations record a partial NRIC, such as the last three digits and the letter, as an alternative to the full number. It is still personal data, so the MCST must protect it like any other record.
Can my visitor refuse to hand over their IC?
Your visitor can offer to show their ID for a visual check and give their name and contact number instead. If the condo still insists on keeping the card, raise it with the managing agent or the MCST’s Data Protection Officer.
Who is responsible if visitor data leaks?
The MCST, as the organisation collecting the data, is accountable under the PDPA. Its managing agent and security agency act on its behalf, so contracts should spell out how visitor data is handled.
Does the same rule apply to FIN, passport and driving licence numbers?
Yes. The PDPC’s guidelines cover other national identification numbers too, including birth certificate numbers, FIN and passport numbers.
Make your condo’s visitor process PDPA-friendly
myCondo helps MCSTs and managing agents replace logbooks and IC deposits with resident pre-registration, QR passes, licence plate recognition and secure digital records. We integrate with hardware from Dahua Technology, Hikvision, Akuvox, Milestone and more, and our Singapore team provides setup, guard training and after-sales support.
WhatsApp or call: +65 8812 3888
Email: [email protected]
Address: 8 Ubi Road 2, #07-13 Zervex, Singapore 408538
This article is general information, not legal advice. For specific situations, refer to the PDPC’s guidelines or consult a qualified advisor.
Related reading: 7 Signs Your Condo’s Visitor Registration Process Is a Security Risk
