General Data Protection Regulation (GDPR)
The General Data Protection Regulation (GDPR) is the European Union’s data protection law, in force since 25 May 2018. It governs any processing of personal data relating to people in the EU, regardless of where the organization doing the processing is based. For identity verification it matters twice over: the activity is unavoidably personal-data processing, and the biometric part of it falls into a category the regulation treats as especially sensitive.
| Full citation | Regulation (EU) 2016/679 |
| Adopted / applicable | 27 April 2016 / 25 May 2018 |
| Territorial reach | Establishment in the EU, or offering goods and services to, or monitoring the behavior of, people in the EU |
| Covers | ‘Personal data’ — broader than PII, and it includes pseudonymized data |
| Lawful bases | Consent, contract, legal obligation, vital interests, public task, legitimate interests |
| Special categories | Article 9 — includes biometric data processed to uniquely identify a person |
| Maximum fine | The higher of €20 million or 4% of worldwide annual turnover |
| Automated decisions | Article 22 restricts decisions made solely by automated means with legal or similarly significant effects |
The principles, and which ones bite
Article 5 sets out the principles everything else follows from: lawfulness, fairness and transparency; purpose limitation; data minimization; accuracy; storage limitation; integrity and confidentiality; and accountability. Three of these do most of the work in a verification context.
Purpose limitation means data collected to verify an identity cannot simply be repurposed later for marketing, model training or analytics. The purpose is fixed at collection.
Data minimization means collecting what the purpose requires and no more. Capturing a full identity document to confirm somebody is over eighteen is difficult to defend when a narrower check exists.
Storage limitation means keeping it only as long as the purpose needs. A verification decision is a moment; an archive of customer document images is a standing liability, and the regulation expects a defined retention period rather than an indefinite one.
Why biometric data is the hard part
This is the section that matters most for anyone building identity verification, and it is routinely handled too casually.
Article 9 prohibits processing of special category data unless a specific condition applies — and biometric data processed for the purpose of uniquely identifying a natural person is special category data. A facial template generated to match a selfie against a document photograph is squarely inside that definition.
The practical consequence: an Article 6 lawful basis is not sufficient on its own. A separate Article 9 condition is needed on top of it. In commercial verification the usual candidate is explicit consent, which creates a genuine tension — consent must be freely given, and it is not obviously free when the verification is a precondition of opening the account. Organizations relying on it should be able to explain what the alternative route is, and many cannot.
High-risk processing of this kind also generally requires a Data Protection Impact Assessment under Article 35 before it begins. That is a documented exercise, not a formality, and its absence is a plain finding.
Automated decisions, and the right to a human
Article 22 gives people the right not to be subject to a decision based solely on automated processing where it produces legal effects or similarly significant ones. An automated rejection that denies someone a bank account is a reasonable candidate for that description.
The practical requirement is usually not to stop automating. It is to provide a route to human review and to be able to explain the basis of a decision — which is difficult when the decision came from a model nobody can decompose, and which is why manual review is a compliance mechanism as much as an operational one.
What this means for identity verification
The design that satisfies GDPR is also, usefully, the design that reduces breach exposure: verify, return a decision, and retain the minimum. Identity document verification that produces an answer without accumulating a permanent store of documents and facial templates is easier to defend and less damaging when something goes wrong.
The tension to resolve is between minimization and the record-keeping that financial regulation demands elsewhere — Customer Identification Program rules require retention that GDPR’s storage limitation principle would otherwise discourage. These are reconcilable, because legal obligation is itself a lawful basis, but the reconciliation has to be documented rather than assumed. Identity verification should be evaluated partly on what it declines to keep.
GDPR compared with U.S. frameworks
| GDPR | U.S. approach | |
|---|---|---|
| Scope | One regulation covering all personal data | Sectoral — different rules by industry and by state |
| Definition | ‘Personal data’, including pseudonymized data and online identifiers | ‘PII’, defined more narrowly and inconsistently |
| Biometrics | Special category under Article 9, EU-wide | State laws such as Illinois BIPA, with no federal equivalent |
| Lawful basis | Required before processing begins | Generally notice-and-choice rather than a basis requirement |
| Maximum penalty | €20 million or 4% of worldwide turnover | Varies widely by statute and state |
What GDPR doesn’t do
It does not ban biometric processing. It conditions it. Article 9 sets out the routes; the work is identifying which applies and documenting why.
Consent is not the default answer. It is one of six lawful bases, and often the weakest in a commercial setting because it must be freely given and can be withdrawn.
It does not stop automated decisions. Article 22 requires safeguards, including a route to human review, not an end to automation.
It is not the only regime that applies. The UK has its own post-Brexit version, the EU AI Act adds separate obligations for biometric systems, and member states retain scope to legislate in specific areas.
Frequently asked questions
Does GDPR apply to companies outside the EU?
Yes, where they offer goods or services to people in the EU or monitor their behavior. The test in Article 3 is about whose data is being processed and what the organization is doing, not about where the organization is located.
Is biometric data special category data under GDPR?
It is when processed for the purpose of uniquely identifying a person, which covers face matching in identity verification. That means an Article 9 condition is required on top of an ordinary Article 6 lawful basis, and a Data Protection Impact Assessment is generally needed before processing begins.
What is the difference between personal data and PII?
Personal data is broader. It expressly includes online identifiers such as IP addresses and cookie identifiers, and it continues to cover pseudonymized data. A dataset outside a narrow U.S. definition of PII may still be personal data and fully in scope.
Can identity verification decisions be fully automated under GDPR?
Article 22 restricts decisions made solely by automated means where they have legal or similarly significant effects, which an account rejection may well have. The usual answer is not to stop automating but to provide a route to human review and to be able to explain the basis of the decision.
Related reading
- Personally identifiable information — the narrower U.S. concept, and where the two definitions diverge
- Anonymised data — why pseudonymized data stays in scope and true anonymization is rare
- Customer Identification Program — the retention obligation that has to be reconciled with storage limitation
- Facial recognition — the processing Article 9 is concerned with, and how one-to-one use differs
