Employer copy of ID and GDPR: what HR should hold

Hiring produces paper: CVs, certificates, references, and sooner or later someone asks for a copy of the applicant’s ID. Before an employer keeps a copy of ID, the GDPR asks one question: does this step need it? Most don’t. HR can collect for the step it is at, see an ID instead of copying it, and hold no more than that step needs. Here is how that works across a hiring process.

Collect for the step you’re at

The GDPR’s data minimization rule says personal data must be “adequate, relevant and limited to what is necessary” for the purpose (Art. 5(1)(c)). In hiring, the purpose changes as the process moves on:

• Applying: a CV and what shows the person can do the job. No ID, no bank details.
• Interviewing and shortlisting: perhaps certificates or references.
• The offer and onboarding: what the contract and payroll need.

Ask at each step only for what that step needs. A document you ask for at the start sits in your files for every applicant who isn’t hired.

The GDPR also lets each country set more specific rules for employment (Art. 88). Check the rules where you hire; this article sticks to the GDPR.

Employer copy of ID under GDPR: see it, note it

To confirm who someone is, you usually only need to see their ID. Look at it in person or on a video call, then write down that you checked it, when and who checked it.

That note is often all the record you need. North Rhine-Westphalia’s data protection authority, writing about businesses that check ID cards, says that where a record is needed, a note that the ID was presented is enough, and that a copy made for identification must be destroyed once the check is done (LDI NRW, in German). The same reasoning, for customers: should you keep a copy of a customer’s ID?

When a full copy is required

Some checks are an exception. In the UK, the right-to-work check is the employer’s own check, with its own rules on copies (gov.uk); there, a redacted copy won’t do. Which checks need a full copy, and why: when a full ID copy is required.

Ask applicants for redacted copies

Where you do need a document, ask for the fields you need and nothing else, marked for you and the purpose. The request kit has a ready message to send, in eight languages. It points applicants to a free tool that covers the rest on their own device, without uploading the document.

Delete on schedule

The GDPR also limits how long you keep data: no longer than the purpose needs (Art. 5(1)(e)). Set a deletion date for each kind of document when you collect it, for applicants who aren’t hired and for those who are. What you no longer hold can’t leak.

The landlord’s version of this question is in what landlords may keep from tenants. Ready to ask for less? Get the request kit.