HMRC & Companies House Digital ID: Privacy Guide for UK Directors

2. Deadlines and legal requirements

• • Base date: 18 November 2025 activates mandatory checks under the Economic Crime and Corporate Transparency Act 2023 (ECCTA 2023), specifically Part 1, Chapter 1.
• • New appointments: Directors and PSCs must verify before incorporation or appointment; filing without verification becomes an offence.
• • Existing roles: Directors confirm verification at their next confirmation statement within a 12-month transition window.
• • PSC nuances: PSCs who are not directors must submit their personal code within the first 14 days of their birth month once the regime starts.
• • Personal codes: Successful verification issues a reusable Companies House personal code that substitutes repeated ID checks across all appointments.
• • Offence notice: Acting as a director or filing at Companies House without verification after the deadline can trigger civil penalties and be treated as a criminal offence.

Companies House is pairing email notices with register reminders, and GOV.UK One Login metrics show the infrastructure is already scaled—over six million proven identities and fifty government services onboarded going into the mandate. The One Login credential will replace Government Gateway logins over time, so the same verified account will unlock HMRC services as they move across.

Note that Companies House explicitly instructs users not to post or email identity documents; verification must be completed via one of the approved digital or ACSP routes.

3. Verification routes compared

Every route attains the same confidence level but the artefacts collected, the duration they persist, and the attack surface vary. Below you’ll find a plain-language walkthrough of each process, definitions for the jargon that GOV.UK uses, and a privacy risk rating based on impact if data leaks, likelihood of compromise, and your ability to audit the workflow.

4. Controllers, vendors, and retention

GOV.UK One Login is controlled by the Department for Science, Innovation and Technology (DSIT) via the Government Digital Service (GDS). iProov is the primary biometric processor, with Veriff and Inverid as sub-processors. Experian acts as an independent controller for fraud and KBV checks. Key retention commitments include:

• Biometric stills and licence images: deleted from iProov systems after 30 days; selfie video discarded immediately.
• System logs: stored for one year to support troubleshooting and audit events.
• Secure audit trail: retained for seven years to detect and respond to fraud attempts.
• Post Office assisted captures: purged 11 days after collection.
• ACSP archives: statutory seven-year retention of identity evidence, including failed attempts.

Once HMRC finishes its migration, the same One Login credential will unlock personal and business tax services, so one verification spans corporate filings, PAYE, VAT, and income tax portals.

5. Privacy-first playbook for directors

1. Map your obligations: Align confirmation statement dates, PSC windows, and HMRC filing cycles so you are never locked out by missed verification.
2. Choose the right route: Default to the bank/KBV or Post Office flow if you want to avoid live biometrics; use an ACSP when you need a human audit trail or bespoke guidance.
3. Harden the exchange: Dedicate an email alias and device profile for One Login, disable optional analytics cookies, and delete local copies of IDs once uploaded.
4. Log everything: Record the route chosen, documents provided, timestamps, and reference numbers—vital if you later challenge retention or seek erasure.
5. Plan for reuse: Update internal compliance playbooks so company secretaries, accountants, and legal teams know how to reference the personal code instead of requesting fresh scans.

6. Exercising your data rights

Once the 30-day (or 11-day assisted) window lapses, you can submit a UK GDPR Article 17 request to confirm biometric deletion and ask what audit records remain. DSIT can refuse only when a legal obligation requires retention, such as fraud monitoring. ACSPs may lawfully defer deletion until their seven-year duty expires, but you should still request written confirmation.

Use this ready-to-send template for the GOV.UK One Login route:

To: gds.data.protection@dsit.gov.uk
Cc: dataprotection@dsit.gov.uk
Subject: Article 17 Request – Deletion of Biometric Images (GOV.UK One Login ID Verification)

Dear DSIT/GDS Data Protection Team,

I verified my identity using GOV.UK One Login for Companies House. Under UK GDPR Article 17, I request confirmation and, if necessary, deletion of any biometric facial data and associated still images generated from my selfie during the likeness/liveness checks, and any driving-licence images, in line with the GOV.UK One Login privacy notice stating these are deleted after 30 days and that the selfie video is not retained.

Please confirm:
1. whether these items have already been deleted;
2. if any copy remains, that it will now be erased; and
3. what audit/log data (if any) will be retained, the legal basis, and retention period.

My details:
• Full name:
• Date of birth:
• Email address used for One Login:
• Approximate date and time of verification:
• Companies House personal code (if issued):

Kind regards,
[Name]
[Postal address]
[Preferred contact number]

Keep the acknowledgement email and any refusal rationale; both form part of your compliance evidence if the Information Commissioner’s Office ever needs to review the case.