Identity and address verification for employers
An identity check confirms that the person you are hiring is who they say they are: that their documents are genuine, unaltered and belong to them. It does not tell you whether they have the right to work, a criminal record or the qualifications they claim. Those are separate checks.
For most hires, the identity check you need is already part of the right to work check, which the Home Office expects for every worker across the UK. Some frameworks ask for more. The government's Baseline Personnel Security Standard asks you to verify name, date of birth and current or permanent address, and DBS applications in England and Wales follow their own ID checking guidelines.
Outside those rules, collect the minimum. The ICO's draft guidance says that to verify identity you may need a passport or driving licence, but it is unlikely you would need both. If you use a digital service, check it is certified and registered for the purpose, because you stay responsible for the check.
What an identity check can and cannot tell you
The government's Good Practice Guide 45, How to prove and verify someone's identity, covers checking an employee as well as a customer. It describes a claimed identity as a combination of information, often a name, date of birth and address, and splits identity checking into five parts. You do not have to do them all at once.
An identity check answers one question: is this the person named in the documents? It does not confirm employment history, qualifications or convictions. BPSS treats identity, right to work, employment history and criminal record as four separate checks.
- Get evidence of the claimed identity
- Check the evidence is genuine or valid
- Check the claimed identity has existed over time
- Check if the claimed identity is at high risk of identity fraud
- Check that the identity belongs to the person who is claiming it
How it relates to the right to work check
Identity is built into the right to work check, which applies across the whole of the UK. The Home Office guide says employers must check documents are genuine, have not been tampered with and belong to the person presenting them, and that photographs and dates of birth are consistent with the person's appearance. Our right to work checks page explains the three prescribed methods.
The purposes differ. The right to work check gives you a statutory excuse against a civil penalty. An identity check for another framework follows that framework's rules: DBS, for example, publishes separate ID checking guidelines for standard and enhanced applications. Where names differ across documents, the Home Office says the reason should be explained through evidence such as a marriage certificate or deed poll.
Certified digital identity services
The UK digital verification services trust framework sets the government's rules for good digital identity services. Version 1.0 was published in final form on 9 June 2026 under section 28 of the Data (Use and Access) Act 2025. Earlier versions were called the UK digital identity and attributes trust framework, and version 0.4 under that name is still one of the current versions that providers can be certified against. The statutory digital verification services (DVS) register, run by the Office for Digital Identities and Attributes (OfDIA), lists certified providers. You can filter it for providers certified for right to work checks and use it to check whether a provider holds a valid certificate, but not for prices or experience.
For right to work, a digital check is optional. If you choose one, the provider must be on the OfDIA register and able to do right to work checks, and you remain responsible for the check. A screening agency that is not itself certified must say which registered provider carries it out. For DBS applications, registered bodies and responsible organisations using a digital service must use one certified against both the trust framework and the DBS supplementary code.
Do not make digital the only route. The Home Office says employers must not treat someone less favourably because they have no valid passport or do not want a digital check.
Spotting false documents
Use the official material. The Home Office Guidance on examining identity documents, from the National Document Fraud Unit and updated on 21 October 2026, describes four kinds of document abuse and the security features to look for, such as watermarks, ultraviolet reaction, optically variable ink and the machine readable zone. For impersonation it suggests simple first checks: can the person recreate the signature without seeing the document, do they look the right age, and do the shape and features of the face match.
For right to work, you are liable for a false document only if it was reasonably apparent: something an untrained employer could spot in a careful but brief inspection without specialist aids. If you are given a false document, or a genuine one that does not belong to the person, the Home Office says you should report it. It also runs an online document fraud awareness course.
| Type | What it means |
|---|---|
| Impersonation | A look-alike presenting a genuine document |
| Counterfeit | A complete reproduction made to resemble an official document |
| Forgery | A genuine document unlawfully altered, such as a substituted page or photograph or changed personal details |
| Pseudo or fantasy document | Looks like a passport or identity card but is not officially recognised |
Address checks and data minimisation
Some frameworks ask for a verified address. BPSS requires documents showing full current or permanent address and accepts some official digital documents such as bank statements and utility bills. A basic DBS check asks for addresses for the last 5 years, and the DBS ID guidelines suggest a conversation where address and employment history do not match.
Outside those frameworks, an address check is optional and needs a reason tied to the role. The ICO's draft guidance says you must only obtain the minimum information you need, should verify only successful candidates where possible, and must explain your verification process early. In our view, a self-declared contact address is enough for most roles. Right to work copies are kept for the employment and two years afterwards, then securely destroyed.
Where each rule applies
Disclosure Scotland and AccessNI run their own processes for Scotland and Northern Ireland. HRjoy does not run checks; we can help you decide what identity evidence each role needs and introduce you to our screening partners.
| Framework | What it asks about identity | Where it applies |
|---|---|---|
| Right to Work Scheme | Documents genuine, unaltered and belonging to the person | Whole of the UK |
| DBS ID checking guidelines | Set documents or a certified digital service; 5 year address history | England and Wales (DBS checks) |
| Baseline Personnel Security Standard | Name, date of birth, current or permanent address and photo ID | Government organisations and their suppliers |
| GPG 45 | A method for deciding how to check identity | Cabinet Office guidance for checking a customer or employee |
What to tell the candidate
- Tell candidates early which documents you will ask for, how you will check them and how long you will keep copies.
- Let candidates choose how to prove their right to work, and offer a manual check to anyone who does not want a digital one.
- Offer a secure way to share originals, such as showing them in person.
- If a document or detail does not match, give the candidate a chance to explain before you decide, and record the outcome.
Sources
- How to prove and verify someone's identity · GOV.UK (Cabinet Office and Government Digital Service)
- Employer's guide to right to work checks: 1 October 2026 · GOV.UK (Home Office)
- Guidance on examining identity documents (accessible) · GOV.UK (Home Office)
- UK digital verification services trust framework · GOV.UK (Office for Digital Identities and Attributes)
- Find registered digital verification services · GOV.UK (Office for Digital Identities and Attributes)
- DBS digital identity verification guidance · GOV.UK (Disclosure and Barring Service)
- ID checking guidelines for Standard/Enhanced DBS check applications from 22 April 2025 · GOV.UK (Disclosure and Barring Service)
- Request a basic DBS check · GOV.UK
- UK Government Baseline Personnel Security Standard, Version 7.0, June 2024 (HTML) · GOV.UK (Cabinet Office)
- Verifying candidates · ICO
- UK digital verification services trust framework (1.0) · GOV.UK (Office for Digital Identities and Attributes)
- Pre-employment vetting of candidates · ICO
General information for employers in the UK, not legal advice. HRjoy advises on screening policy and fair process. We do not run checks ourselves; where you need checks run, we can introduce you to our screening partners. Check the official sources for your situation.
When it’s justified
Usually justified
- Every new worker, as part of the right to work check
- Applicants for a standard or enhanced DBS check in England and Wales, under the DBS ID checking guidelines
- Roles within or for government under the Baseline Personnel Security Standard
Only if the role justifies it
- A verified address, where a framework asks for it or the role carries a specific risk you can name
- Extra imposter controls for remote hiring, such as keeping a photograph for later comparison, which the Home Office describes as optional
- A digital identity check through a certified provider, if you also offer a manual route
Rarely or never justified
- Asking for both a passport and a driving licence when one will do
- Accepting a National Insurance number as proof of identity, which GPG 45 says it is not
- Checking identity documents for every applicant rather than the person you intend to appoint
- Asking only candidates you assume are migrants for extra identity evidence
Questions
Something else? Ask us.
Is a right to work check the same as an identity check?
Not quite. A right to work check includes confirming that the documents belong to the person, so it covers identity for that purpose. DBS applications and BPSS set their own identity requirements, and a right to work check says nothing about employment history or convictions.
Can I ask a candidate for a utility bill to prove their address?
Only if you have a reason. BPSS and DBS ID checks do use address evidence, and BPSS accepts official digital bank statements and utility bills. For an ordinary role outside those frameworks, the ICO says to collect the minimum you need, so a separate proof of address is rarely justified.
Can I use a digital identity service to check a British candidate?
Yes, if the candidate agrees. For right to work, the provider must be registered on the OfDIA register and able to do right to work checks, and you remain responsible for the result. You must not treat someone less favourably for preferring a manual check.
What should I do if I think a document is fake?
Do not accuse the candidate on the spot. Compare it with the Home Office guidance on examining identity documents, give the person a chance to explain any discrepancy and record your decision. If you believe the document is false, or genuine but not theirs, the Home Office says you should report it.
Related checks
- Right to work checks: who to check and how from October 2026 Who needs a right to work check from 1 October 2026, including workers and sub-contractors, how each of the three methods works and follow-ups.
- BPSS checks: the Baseline Personnel Security Standard explained Who needs BPSS, the four checks in version 7.0, the three-year employment history and gaps rule, and why BPSS is not SC or DV security clearance.
- Criminal record checks for employers Which criminal record check a role can lawfully have in England, Wales, Scotland and Northern Ireland, and how to run it fairly.
- International background checks for candidates who lived abroad Overseas criminal record certificates, references and qualifications for UK employers: when they are required, best practice, data transfers and fairness.
- Employment references: what employers can ask and when When to ask for references, what to ask, the sector rules for care, schools, early years and FCA firms, and how to treat candidates fairly.
Sector guides
- Pre-employment checks in health and social care in England What CQC regulation 19 and Schedule 3 require, which DBS check each care role can have, professional registers and agency staff checks in England.
- Background checks in financial services Which checks SM&CR firms need for senior managers, certification staff and other roles: FIT, financial soundness and SYSC 22 regulatory references.
Also covered in our guides for Childcare, Construction and engineering, Education, Hospitality and retail, Logistics and transport, Public sector, Recruitment agencies, Security and facilities and Technology.
Related answers
- How do employers carry out right to work checks? Before someone starts work, employers should carry out one of three prescribed checks: a manual check of original documents, a Home Office online check using a share code, or a check through a registered right to work digital verification service provider. Done correctly, it gives a statutory excuse against a civil penalty of up to £60,000 per illegal worker.
- What are the protected characteristics under the Equality Act 2010? The Equality Act 2010 lists nine protected characteristics: age, disability, gender reassignment, marriage and civil partnership, pregnancy and maternity, race, religion or belief, sex and sexual orientation. In Great Britain, employers must not discriminate against job applicants, workers or former workers because of any of them.
- How should employers handle an employee subject access request? Employers should recognise the request, which can be made verbally or in writing, confirm the person's identity if needed, make a reasonable and proportionate search and respond without undue delay and within one month. Complex requests can be extended by up to two months. A fee usually cannot be charged, and information about other people may need redacting.
- What should employers consider when using AI in recruitment? Employers remain responsible under data protection and equality law when they use AI to source, screen or score candidates. The ICO expects a data protection impact assessment, a lawful basis, clear contracts with the provider, checks for bias, transparency with candidates and minimal data collection. Employers should also plan reasonable adjustments for disabled applicants.