Guide · GDPR
GDPR and Collecting ID Copies From Clients
Asking a new client for a copy of their ID is routine for many firms, and routine is exactly why it gets handled carelessly. This guide covers the lawful basis for collecting an ID copy, why an email thread or a messaging app is a poor place to keep one, how long to retain it, and what to do when GDPR erasure and AML record-keeping pull in different directions.
- A legal obligation or a contract usually justifies collecting an ID copy
- A personal inbox or a chat thread is not a safe place to keep one
- AML record-keeping can outlast a client's request to be forgotten
What lawful basis actually covers collecting an ID copy
Under GDPR Article 6, processing needs a lawful basis, and for an ID copy the usual one depends on why you are collecting it. If your firm is an AML-obliged entity, the legal-obligation basis applies: due diligence rules require the check, so consent is not really the operative basis and should not be presented as something withdrawable in a way that undermines a legal duty. If AML rules do not apply to your work, a contract with the client, or your legitimate interest in confirming who you are dealing with, more commonly applies instead. Getting the basis right matters because it changes how long you can justify keeping the copy and how a deletion request should be handled.
What does minimisation mean for an ID copy specifically
Article 5 of GDPR requires collecting no more personal data than the purpose actually needs. In practice that often means a firm collects a full passport or ID scan when a name, date of birth and document number would have done, or keeps a photo long after it has served its purpose of verifying identity at onboarding. Where a due diligence check simply confirms a match, keeping the confirmation and the key details is usually enough. Whether the full image itself needs to be retained indefinitely, rather than just the fact that it was checked, is worth asking rather than assuming.
Why is a WhatsApp thread or a personal inbox a problem
None of the usual protections apply to an ID copy sitting in a WhatsApp chat or a personal email inbox: no retention schedule automatically deletes it, no access log records who opened it, and no single deletion request actually removes every copy, since the same image may sit on a phone, a laptop and a backup at once. This is less a legal technicality than a practical exposure, since a lost phone or a compromised personal account then carries a client's ID with no way to know or control who else has seen it since.
How long should an ID copy actually be kept
Retention should be tied to a specific reason, not left open-ended. Where an AML obligation applies, national law usually sets a defined record-keeping period after the relationship ends, and the copy should be kept for that period and no longer by default. Where no such obligation applies, tying retention to the life of the engagement, and deleting once the file is closed and any ordinary limitation period has passed, is a defensible default. Either way, the retention period should be a decision your firm can point to, not an accident of nobody ever going back to delete anything.
What happens when a client asks to be forgotten but AML rules require a record
GDPR's right to erasure, Article 17, is not absolute: it does not apply where processing is necessary to comply with a legal obligation, which is exactly the position an AML-obliged firm is in for the specific data its due diligence record requires. In practice this means telling the client honestly that the specific AML-relevant record will be retained for the legally required period, while erasing anything beyond that scope, marketing data, an old draft, a note unrelated to the compliance record, that genuinely has no ongoing legal basis for being kept.
How do you actually document all of this
Write down, once, which lawful basis applies to ID copies for your firm's typical client, how long they are retained and why, and what happens when someone asks for deletion. That single page is what you show if a client or a regulator asks how the firm handles this, rather than reconstructing an answer from memory under pressure. Collecting the ID as one step in the same onboarding flow that already tracks consent and retention settings per case removes most of the manual work of enforcing that policy consistently.
In Braigest
One place to collect, retain and delete client ID data
Retention runs per workflow, Full, Metadata-only or Pass-through, and erasure requests are handled per case, on every plan starting at Solo, €29 a month.
Frequently asked questions
Can I collect an ID copy without the client's consent?
If your firm has a legal obligation to run due diligence, yes, that obligation is the lawful basis rather than consent, and it should not be presented as something the client can simply opt out of.
Is it safe to receive an ID copy by WhatsApp?
No, it is a common but risky practice. There is no retention schedule, no access log, and no reliable way to delete every copy once it has been sent that way.
How long should I keep a client's ID copy?
Tie it to a specific reason: the AML record-keeping period if one applies, or the life of the engagement plus any limitation period otherwise, and delete it once that period ends.
Do I have to delete a client's ID if they ask, even under AML rules?
Not the specific record your AML obligation requires you to keep. GDPR's erasure right does not override a genuine legal obligation, though anything outside that obligation's scope should still be deleted.
Explore more of the platform
Ready to fix your onboarding?
See the whole flow in a 30-minute call, or explore the full Braigest platform.