Can a company legally keep a copy of your ID?
What the GDPR actually says about asking, keeping and deleting.
Short answer
- Asking is not automatically unlawful — verifying identity can be a legitimate purpose.
- Keeping it forever usually is — storage limitation means the copy should go when the purpose ends.
- Regulated exceptions are real: anti-money-laundering and right-to-work rules impose their own retention periods.
- You can request erasure, and complain to your data protection authority if it is refused without a reason.
“We need a copy of your ID for our records.” It is such a routine sentence that most people never ask the obvious follow-up: for which records, and for how long? In the EU, those two questions have actual legal weight behind them.
The question is not “can they ask” — it is “why, and for how long”
A business is generally entitled to satisfy itself that you are who you say you are. What it is not automatically entitled to do is keep a permanent, unedited image of the document that proves it. Those are two different things, and the gap between them is where most over-collection happens: it is simply easier to photograph the whole page than to record the one detail that was actually needed.
What the GDPR actually requires
Three principles do most of the work here, all from Article 5 of the GDPR:
- Lawfulness. There has to be a valid basis for processing your data at all — a contract, a legal obligation, or a legitimate interest that does not override your rights.
- Data minimisation (Article 5(1)(c)). Data must be adequate, relevant and limited to what is necessary. If confirming your name and photo satisfies the purpose, a copy that also carries your document number, machine-readable zone and date of birth is more than necessary.
- Storage limitation (Article 5(1)(e)). Data must be kept no longer than the purpose requires. “Our records” is not a retention period.
In practice this often means a member of staff seeing your document and noting that the check was done is a better fit for the law than a scan sitting on a shared drive.
Where a full copy genuinely is required
Some requests really do have a harder legal basis, and it is worth recognising them rather than pushing back reflexively:
- Banks and financial services, under anti-money-laundering rules, must verify and keep records of customer identity for a defined period. See what ID copy your bank actually needs.
- Employers, in many countries, must keep evidence that a right-to-work check was carried out — see sending a new employer a copy of your ID.
- Accommodation providers in countries with guest-registration duties must record and report specific traveller details.
Note what these have in common: a named obligation, with a defined retention period. That is very different from a letting agent keeping a passport scan in a folder because nobody ever deleted it.
Three questions worth asking
When someone asks for a copy, these are reasonable, and asking them politely tends to shrink the request:
- What do you need to verify? Often the answer is narrower than the request.
- Do you need to keep a copy, or just check the document? Many processes only need the latter.
- How long will you keep it, and how is it stored? A business that cannot answer this has usually not thought about it.
How to ask for deletion
Once the purpose has ended — the tenancy signed, the booking finished, the job application closed — you can ask for the copy to be erased. Write to the company or its data protection officer, state what you want deleted and why the purpose has ended, and ask for written confirmation. If they refuse without pointing to a legal basis for keeping it, you can complain to your data protection authority; in Spain that is the AEPD.
The simpler move: send a copy that is safe to keep
All of the above is your right, but it is work, and it happens after the fact. The version that takes a minute and needs nobody’s cooperation is to send less in the first place: cover the document number, the machine-readable zone, your date of birth and your signature, keep your name and photo visible, and watermark the copy for that specific request. Then it barely matters how long it sits in someone’s folder.
Anonymize my ID does this on your phone, offline — see how to redact a passport or ID card for exactly which fields to cover.
Frequently asked questions
Is it legal for a company to ask for a copy of my ID?
Usually yes, if it has a genuine reason — verifying who you are before a tenancy, a contract or an account. What the GDPR constrains is not the asking but the necessity: they must be able to say what they need it for, and collect no more than that purpose requires.
Can a company keep a copy of my passport indefinitely?
Not by default. The storage-limitation principle means personal data should be kept no longer than is necessary for the purpose it was collected for. Once a tenancy check or an age check is done, an indefinite copy of your passport is hard to justify — unless a specific law requires them to retain it.
Which businesses genuinely have to keep a copy?
Mainly regulated ones. Banks and other financial institutions have anti-money-laundering record-keeping duties, and employers in many countries must keep evidence of a right-to-work check. Those obligations set their own retention periods, which override the general default.
How do I ask a company to delete the copy it holds?
Put it in writing to the company or its data protection officer, say what you want deleted and why the purpose has ended, and ask for confirmation. If they refuse without explaining a legal basis for keeping it, you can complain to your national data protection authority — in Spain, the AEPD.
Does any of this apply outside the EU?
The GDPR covers the EU and EEA, and the UK has an equivalent regime. Many other countries have similar necessity-and-retention rules under their own privacy laws, but the specifics differ — the practical advice below (ask why, ask for how long, send less) works regardless of where you are.