Copies of official identification.
WHY THEY ARE COLLECTED
Verification for financial services Account recovery Employment checks Contractual requirements
WHY THEY ARE HIGH RISK
They enable identity theft, and they cannot be reissued easily.
WHAT TO ESTABLISH FIRST
Whether you need a copy at all.
WHAT ALTERNATIVES EXIST
Verifying and recording that verification occurred Recording only the reference number Using a verification service
WHY THAT MATTERS
Recording that a document was checked is frequently sufficient.
WHAT TO DO IF A COPY IS GENUINELY REQUIRED
Store it encrypted Restrict access severely Log every access Set the shortest retention the obligation allows
WHAT TO NEVER DO
Keep copies in email Keep them in shared folders Keep them after the purpose ends
WHY EMAIL SPECIFICALLY
It is the commonest place they accumulate, ungoverned.
WHAT TO DO ABOUT COPIES ALREADY IN MAILBOXES
Find them, move or delete them.
WHAT TO TRAIN STAFF ON
Not requesting documents casually Not accepting them through messaging
WHAT TO PROVIDE
A secure upload route.
WHAT TO DOCUMENT
The basis, the retention, and the controls.
WHAT TO AUDIT
Where such documents currently exist.
