How to collect ID from clients safely

Most small businesses don’t. There is no general rule that says you must check a customer’s identity before working for them. If you collect it anyway, you take on the job of looking after it, and UK GDPR expects you to collect only what you need for a clear purpose.

You are likely to need ID if one of these applies:

• You are covered by the money laundering regulations. See the next section.
• You are taking someone on as an employee, and need to do a right to work check.
• You are letting a home in England, and need to do a right to rent check.
• You have a specific, genuine reason, such as confirming who owns a property or vehicle before you work on it.

If none of these applies, think twice. A name, email and address are usually enough.

The Money Laundering Regulations 2017 require certain businesses to check who their clients are before taking them on. They include:

• External accountants, bookkeepers offering accountancy services, auditors, insolvency practitioners and tax advisers.
• Independent legal professionals, such as solicitors, for certain kinds of work.
• Trust or company service providers, such as businesses offering registered office addresses.
• Estate agents, and letting agents for lettings of a month or more at a rent of £10,000 a month or more.
• High value dealers, art market participants, cryptoasset businesses, casinos and financial institutions.

See regulation 8 for the full list, and check with your supervisor (such as HMRC or your professional body) if you’re unsure.

If you are covered, you must keep copies of the documents and information you used for the checks for five years after the business relationship ends. After that, the regulations say the personal data must be deleted, unless another law requires you to keep it, the person agrees, or it’s needed for legal proceedings. See regulation 40.

• Right to work (employers, UK-wide). You must check that a new employee can legally work in the UK before they start. The civil penalty is up to £60,000 per illegal worker. See gov.uk.
• Right to rent (landlords and agents, England only). You must check that a tenant can legally rent in England. Penalties go up to £20,000 per tenant for a repeat breach. See gov.uk.

Both checks follow Home Office rules about which documents to accept and how. For many people they are done online with a share code rather than a copy of a document. Collecting a file is not the same as completing the check.

It’s tempting to say “just send me a photo of your passport”. The trouble is where that photo ends up: in your inbox, your phone’s camera roll, your chat backups, and possibly a colleague’s phone too. It is hard to know who can see it and harder still to delete every copy when the time comes.

UK GDPR requires you to keep personal data secure. The ICO has taken action over personal information shared in an unapproved WhatsApp group, finding that it broke the security rules. Read the ICO’s reprimand. ID documents are exactly the kind of data fraudsters want, so treat them with the same care.

• Use a secure upload with a login, so the file goes to one place that only the right people can open, rather than to inboxes and phones.
• Ask for exactly what you need. “The photo page of your passport”, not “some ID”. If any one of several documents will do, list them.
• Say why you need it. One sentence, such as “We’re required to confirm your identity before we act for you”, removes most of the hesitation.
• Tell them how long you’ll keep it, in your privacy notice and ideally next to the request.
• Check it promptly, and ask for a clearer copy straight away if a corner is cut off or it has expired.
• Limit who can see it inside your business.

If the money laundering regulations cover you, keep copies for the five years they require, then delete them.

If they don’t, you may not need a copy at all. In its guidance on confirming who someone is, the ICO says you don’t need to keep copies of ID documents, and suggests recording which document you saw, when, and who checked it instead. See the ICO’s guidance. The same thinking applies whenever you only need to confirm identity once.

In PORTALD, ID is just another named request on the client’s checklist, such as “Passport photo page”, with your note on what you need and why. The client uploads it in your branded portal from their phone, and it goes onto their record. There are no public file links: only signed-in people with access to that client can open it.

You can switch on an optional AI check that looks at what’s visible, such as the type of document, the dates and whether it’s readable, and tells the client straight away if it looks expired or cut off. It can’t tell you a document is genuine or verify who someone is, and it can be wrong. If the regulations cover you, you still do your identity checks your usual way. You approve each upload, or ask for another copy with a reason.

See the secure document upload portal and our security and data handling page for more.

14 days free. No card needed.