Should I keep a copy of customer ID? Check, note, delete
Should I keep a copy of customer ID? In most cases, no. Check the ID, note that you checked it, and don’t keep the copy. That’s the advice of a German data protection authority, and it rests on two GDPR principles: hold only the personal data your purpose needs, and only for as long as it needs it (Article 5(1)(c) and (e)). Every stored copy is a liability you chose to carry. Here’s the rule, its one real exception, and what to do when you do need a copy.
Should you keep a copy of customer ID? Check, note, delete
The data protection authority of North Rhine-Westphalia, in Germany, works through the everyday cases one by one: contracts, phone contracts, rentals, access requests and more (LDI NRW, in German). The pattern is the same in each.
- Check. Look at the ID to confirm who the customer is. The authority says you should always ask whether a copy is truly needed at all.
- Note. Write down only what the relationship needs. For a contract, that is usually first and last name, address and possibly the validity date. Noting the ID numbers is not permitted there. A short note such as “ID was shown” records the check.
- Delete. Where it allows a copy, as for a phone contract or a data access request, the authority says to destroy it as soon as the identification is done. Archiving it is not permitted; a note is enough.
This is German guidance. The principles behind it are the GDPR’s, so they apply wherever the GDPR does.
The exception: a law that requires a full copy
Some businesses must keep a full copy: banks and others under anti-money-laundering law, and, in the UK, landlords and employers for their right-to-rent and right-to-work checks. Which checks those are, and why a redacted copy fails them: when a full ID copy is required.
If you need a copy, ask for a redacted, marked one
When there is no full-copy law but you still need to see an ID remotely, ask for less than the whole card. Where a copy is used to confirm identity for a data access request, LDI NRW says the other details may and should be blacked out, such as access and serial numbers, nationality, height, eye color, photo and machine-readable zone. Customers should be told beforehand that they can do this. The copy must also be recognizable as a copy.
Your customers can do both for free in Dress Docs, with no account and without uploading their document. Which fields to cover: what to redact on an ID card copy. How to mark it: watermark an ID copy.
To ask for it, use our request kit: a document-by-document list and a ready message. For IDs, it says “show, don’t send” first.
What you store is what can leak
A copy you never received can’t leak from your files. One you keep has to be protected, found again and deleted on time. The GDPR’s storage limitation makes that a duty, not a choice: personal data is kept no longer than its purpose needs.
For landlords, the same rule step by step: tenant documents and the GDPR.
This article is not legal advice. Check what the law requires of your business.