Trace the data before buying identity verification
The output of due diligence should be a usable data map with evidence attached. Trace what enters the service, what it creates, who can access it and how it leaves. Keep this work tied to the exact product, region and configuration under consideration.
Build one row for each processing step
Start at capture and follow the proposed journey through verification, decision delivery, support, logs, storage, backup and deletion. An architecture diagram is useful, but it may leave out support access or derived information. Ask who can confirm each part and link the answer to a dated document or test.
| Field | Record | Useful evidence |
|---|---|---|
| Input and output | Images, extracted fields, templates, signals and decision records | Schema and redacted sample |
| Purpose and role | Why each operation happens and who decides it | Service design and applicable processing terms |
| Access | Application, staff, supplier and support access | Role model and access-review evidence |
| Location and onward processing | Storage, processing, support and backup locations | Architecture and named subprocessor schedule |
| Retention | Trigger, duration, configurable settings and exceptions | Policy, contract and configuration evidence |
| Deletion or return | How records leave active systems and what remains elsewhere | Procedure and scoped test result |
Settle roles for each operation
The Data Protection Commission explains the controller/processor relationship and required processing-contract provisions. Do not infer every role from a provider's general label. Ask your privacy or legal lead to assess the actual purposes and instructions for each operation, including any separate reuse of data.
If a supplier proposes using captures for product improvement or sharing signals across customers, record that separately from the verification requested by your service. Ask whether it is optional, how it is controlled and what terms govern it. A useful answer identifies the operation and evidence; “industry standard” does not resolve the question.
Worked example: a proposed document capture
Imagine a supplier says images are deleted after 30 days while decision records are kept for a year. Treat those as illustrative proposal terms, not recommended retention periods. Your worksheet should ask what starts each clock, whether the proposed configuration uses those values, what a decision record contains and whether copies remain in support systems or backups.
Suppose the privacy page says 30 days, the draft contract permits a longer period and the demonstration account shows an adjustable setting. That is a conflict to resolve, not three pieces of supporting evidence. Name the controlling document, agree the production setting and obtain confirmation of the remaining exception. Do not mark the field confirmed until the answer is coherent.
For a deletion exercise, use an authorised test record and define the expected result in advance. Check the active record and the supplier's explanation of retained audit information, backups and exceptions. An empty dashboard alone does not prove that every copy has been removed. Record the limits of what your team could directly verify.
Classify answers so gaps stay visible
- Confirmed: current evidence supports the stated configuration.
- Configurable: the option exists, but the intended setting still needs acceptance evidence.
- Contract-dependent: the proposed position needs agreement in the governing terms.
- Conflicting: sources disagree and need reconciliation.
- Unknown: no adequate answer is available yet.
Give each unresolved high-impact field an owner, a next action and a decision consequence. For example, production capture may be held until the parties settle a material retention conflict. A minor documentation correction may be tracked separately. The consequence should follow your assessed risk, not the convenience of the procurement timetable.
Hand over the map with the service
At acceptance, preserve the agreed data flow, processing terms, subprocessor list and approved settings together. Record who reviews changes and how the operating team finds the current version. A new support location, new reuse purpose or changed retention setting should not disappear into a general release note.
Use the roles guide and DPIA questions for related analysis. Send the accepted commitments into the contract review. This worksheet organises evidence; it does not determine a lawful basis, approve an international transfer or certify a supplier's compliance.
Reviewed 23 September 2026. Worked examples and worksheets are MyID editorial guidance. Check the linked primary material and your service requirements before making a consequential decision.
In this topic: Buying, privacy and implementation
How should a buyer define, procure, pilot and govern identity services?
View all 12 pages in this topic
Next useful pages
Follow the Irish evidence
Get the business briefing when Irish wallet, verification and age-assurance evidence changes.
Join the business briefing