Guidance

How to prove and verify someone's identity

Good Practice Guide (GPG) 45 helps you decide how to check someone's identity.

Documents

Details

This guidance will help you decide how to check someone’s identity. Some existing identity checking services already follow this guidance.

This guidance was written by Government Digital Service (GDS) with help from organisations across the public and private sectors. Key contributors include:

  • Department for Work and Pensions (DWP)
  • Driver and Vehicle Licensing Agency (DVLA)
  • HM Revenue and Customs (HMRC)
  • Home Office
  • Ministry of Defence (MoD)
  • National Cyber Security Centre (NCSC)
  • Barclays
  • Digidentity
  • Experian
  • IDEMIA
  • Post Office

This guidance aligns with these international standards and regulations:

This guidance does not explain the practical ways you can check someone’s identity. You’ll need to decide what tools or processes you want to use based on what’s appropriate for your service. For example, you might decide to accept a passport as evidence of someone’s identity if you know:

  • the users of your service are likely to have a passport
  • staff in your organisation have equipment they need to check the document effectively

One of the ways you can follow this guidance to check someone’s identity is by using GOV.UK Verify in your service.

Published 6 January 2014
Last updated 19 March 2020 + show all updates
  1. The guidance has been given a more active title. The 'Get evidence of the claimed identity' section now includes some information about what to do if a piece of evidence contains transposition errors. The 'Check the evidence is genuine or valid' section now explains that digital evidence will always get at least a score of 2. In the same section, the requirements needed for evidence that contains digital information have been updated to take into account things like information found in databases. The guidance about identity profiles has been updated to clarify that you do not need to add up the individual scores within a profile to come up with a total.

  2. The definition of valid has been updated in the 'Check the evidence is genuine or valid' section. Checking a piece of evidence has not expired, cancelled or been reported as lost or stolen used to be things you could do as part of the 'valid' check. These are now listed as separate checks. It's now clearer that you do not need to check if a piece of evidence has been cancelled, lost or stolen to get a score of 2 or 3.

  3. The guidance has been rewritten in plain English so it's easy for both technical and non-technical users to understand. The annexes from the previous version have been removed and the information from them added to the guidance. Examples of how checks can be done have been added throughout the guidance. Information about checking someone's biometric information has been added to the 'Check that the identity belongs to the person who’s claiming it (‘verification’)' section. The 'Identity profiles' section has been expanded. The new identity profiles will make it easier to check the identities of users who do not have much evidence of their identity.

  4. Replaced the old version of Good Practice Guide 45 (version 2.3) with the latest version of the Good Practice Guide 45 (version 3).

  5. New version of the guide published.

  6. First published.