NRIC
Detects NRIC patterns. This pattern is based on a Microsoft Purview built-in sensitive information type. Users already running Purview may prefer to enable the built-in SIT directly, or use this version as a starting point for customisation.
- Type
- regex
- Engine
- universal
- Confidence
- medium
- Confidence justification
- Medium confidence: pattern has structural constraints but corroborative keywords are recommended to reduce false positive rates. Added context gating and exclusion rules improve precision and reduce incidental matches.
- Detection quality
- Verified
- Jurisdictions
- sg
- Regulations
- PDPA (SG)
- Frameworks
- ISO 27001, ISO 27701
- Data categories
- pii, government-id
- Scope
- narrow
- Risk rating
- 9
- Platform compatibility
- Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Compatible, Netskope: Compatible
Pattern
\b[STFGM]\d{7}[A-Z]\bCorroborative evidence keywords
identifier, number, ID, ID number, identification, ID card, license, permit, registration, certificate, field, column, row, entry, record, value, form, register, database, extract (+16 more)
Proximity: 300 characters
Should match
S1234567A— Singapore citizen NRIC (S prefix)T1234567B— NRIC with T prefix (2000s)G1234567C— Foreign NRIC (G prefix)
Should not match
A1234567B— Invalid prefix letter (A not in S/T/F/G/M set)S123456A— Only 6 digits instead of 7S12345678A— 8 digits instead of 7template example placeholder record identifier— Template/sample context should be excluded even when anchor words are present
Known false positives
- Common words and phrases related to nric appearing in policy documents, training materials, HR templates, or compliance guidelines without actual personal data. Mitigation: Require corroborative evidence keywords within the proximity window to confirm sensitive data context rather than general discussion.
- In English (Singapore), similar terminology used in formal or administrative contexts (education, professional documentation) that does not constitute sensitive data collection. Mitigation: Layer with additional contextual signals such as structured identifiers, form fields, or database column headers to distinguish sensitive records from general references.