{
  "node_id": "sg-singpass-ndi-pdpa-digital-identity",
  "title": "Singapore Singpass and National Digital Identity Framework under the PDPA",
  "domain": "Data Protection & Privacy",
  "version": "1.0.0",
  "last_updated": "2024-01-01",
  "bluf": "Singpass is Singapore's National Digital Identity (NDI) platform, operated by the Government Technology Agency of Singapore (GovTech) on behalf of the Smart Nation and Digital Government Office. Singpass provides authentication, digital signing through Sign with Singpass, attribute sharing through Myinfo, and face verification through the Singpass Face Verification service. Authentication is grounded in the Singapore National Registration Identity Card (NRIC) number issued under the National Registration Act 1965 and the Personal Data Protection Act 2012 (PDPA). The PDPA imposes data protection obligations on private-sector organisations using Singpass-derived data including consent, purpose limitation, notification, access and correction, accuracy, protection, retention limitation, transfer limitation, openness, and accountability.\n\nSingpass requires two-factor authentication for transactional access, supporting passwords plus one-time-passwords or Singpass app push notification, and offers QR-code Singpass app authentication and SMS-based one-time-password for legacy users. The Singpass face verification service uses 1:1 biometric matching against the national identity database and is governed under the PDPA Advisory Guidelines on the use of personal data for biometric authentication. Myinfo provides API-based government-verified data sharing to over 2,700 services with consent of the citizen under PDPA Section 14. The Personal Data Protection Commission (PDPC) is the supervisory authority under the PDPA with powers under Part IX to investigate breaches, issue directions, and impose financial penalties up to ten percent of annual turnover for serious contraventions.",
  "paywall": {
    "status": "LOCKED",
    "unlock_cost_usd": "0.01",
    "skyfire_id": "41779894-ece2-4163-9761-b3b1b76e19b0"
  },
  "crosswalks": {
    "_available_keys": [
      "nist_framework",
      "industry_mapping"
    ],
    "_note": "Full crosswalk values included in vault response"
  },
  "dependencies": [
    "us-nist-sp-800-63-4-2025-digital-identity-guidelines",
    "sg-pdpa-2012",
    "w3c-verifiable-credentials-data-model-2-0"
  ],
  "primary_citations_count": 7
}