Identity-data retention and deletion

Identity verification creates several records with different purposes. Do not give documents, face images, templates, decisions, logs and fraud signals one blanket retention period simply because they came from the same transaction.

For: privacy, records, compliance, security, operations and procurement teams. This is independent information, not legal, compliance or security advice.

Separate the records

• Raw document images and video.
• Extracted identity attributes.
• Face template, match and liveness outputs.
• Document authenticity and fraud signals.
• Pass/fail result and service decision.
• Manual-review evidence and notes.
• Audit, security and incident logs.

Retention decision

1. Name the purpose and owner for each record.
2. Identify applicable legal/contractual need.
3. Set the shortest justified active period.
4. Define deletion, anonymisation or restricted archive.
5. Map backups, replicas and subprocessors.
6. Document legal hold and exceptional extension.

Deletion evidence

Test account deletion, failed onboarding, withdrawn application, contract exit and data-subject request. Obtain evidence that deletion propagates and that a provider cannot silently retain material for independent fraud or model purposes.

Minimise before retention

If the service only needs evidence that a valid check occurred, avoid copying every underlying field or image into core systems. Tokenise or separate access where a limited record must be retained.

Evidence and limits

MyID separates enacted rules, official implementation material, testing and vendor claims. A source can establish what its publisher says; it does not prove that every product, deployment or interpretation works as claimed. Where Irish implementation remains unsettled, this page says so.

• General Data Protection Regulation
• Data Protection Commission

Sources checked 22 August 2026. Re-check the linked primary material before making a consequential decision.

Next useful pages

• Biometric governance
• Vendor due diligence
• Controller roles