GDPR Compliance

Understand how iDenfy processes personal data as a GDPR-compliant data processor and how to configure your integration accordingly.

Overview

The General Data Protection Regulation (GDPR) governs how personal data of EU/EEA residents is collected, processed, and stored. Identity verification inherently involves processing sensitive personal data — documents, biometric data, and personal identifiers.

iDenfy acts as a data processor on your behalf (Art. 4(8), Art. 28 GDPR). You remain the data controller, responsible for establishing the lawful basis, ensuring transparency, and fulfilling data subject rights. iDenfy does not determine the purposes or legal bases for processing — you define these exclusively as the controller.

---

Your Responsibilities as Data Controller

Obligation	What you need to do
Lawful basis	Establish a legal basis for processing. For AML-regulated entities this is typically Art. 6(1)(c) (legal obligation) or Art. 6(1)(e) (public interest) — not consent. For optional verification, consent under Art. 6(1)(a) may apply.
Transparency	Inform users what data is collected, why, and how long it is retained — in your privacy policy. Per Art. 13(1)(c), identify yourself as controller, state your legal bases, and reference applicable legislation.
Data subject rights	Respond to access (Art. 15), rectification (Art. 16), erasure (Art. 17), and restriction (Art. 18) requests within 30 days. Note: data subjects cannot withdraw from AML-based identification requirements — Art. 7(3) does not apply to statutory grounds.
Data Protection Impact Assessment	Conduct a DPIA for biometric processing (Art. 35). iDenfy maintains its own DPIA and can provide supporting documentation upon request.
Records of processing	Document the identity verification processing activity in your records of processing activities (Art. 30).

---

How iDenfy Supports GDPR Compliance

Data Minimization

Configure session creation to collect only the data you need:

{
  "clientId": "user-123",
  "generateDigitString": false,
  "address": null,
  "dateOfBirth": null
}

Only request fields required by your compliance obligations. Unnecessary data fields can be omitted from the token request. iDenfy processes only the data specified in your configuration — nothing more.

Right to Erasure (Art. 17)

Delete verification data via API when a data subject requests erasure:

curl -X DELETE https://ivs.idenfy.com/api/v2/delete \
  -u "API_KEY:API_SECRET" \
  -H "Content-Type: application/json" \
  -d '{"scanRef": "scan-reference-id"}'

See Identification Deletion for the full API reference.

Before deleting, check whether you have a legal obligation to retain the data. AML record-keeping requirements (typically 5-10 years depending on jurisdiction) override GDPR erasure rights. GDPR erasure does not override other regulatory retention obligations.

Data Retention

Configure automatic data retention periods in your iDenfy dashboard. iDenfy supports:

• Custom retention periods per service type
• Automatic deletion after the configured period expires
• Manual deletion via API at any time
• Default retention: Up to 10 years for AML-related identification records; 60 days for expired/closed customer accounts

Data Processing Agreement

iDenfy provides a GDPR-compliant Data Processing Agreement (DPA) that covers:

• Processing purpose and scope
• Sub-processor list and obligations (all sub-processors are documented and contractually bound)
• Data breach notification procedures (within 72 hours to the supervisory authority)
• Data transfer mechanisms (EU Standard Contractual Clauses where applicable)
• Technical and organizational security measures (ISO 27001, SOC 2 Type II)

The DPA is available at idenfy.com/agreement/#dpa-agreement. Contact your account manager or [e-mail] to execute a DPA before going live.

Biometric Data (Art. 9)

Identity verification with liveness detection processes biometric data, which is a special category under GDPR. Your legal basis depends on your use case:

For AML-regulated entities (banks, fintechs, crypto, gaming):

• Art. 6(1)(c) — compliance with a legal obligation (AML law)
• Art. 9(2)(g) — substantial public interest based on Union or Member State law
• Consent is not the appropriate legal basis — per EDPB Guidelines 05/2020, consent should not replace statutory grounds

For non-regulated use cases (age verification, marketplace trust):

• Art. 6(1)(a) — consent of the data subject
• Art. 9(2)(a) — explicit consent for biometric processing
• Ensure consent is freely given, specific, informed, and unambiguous

On the iDenfy “Agree & continue” button: This is a transparency and acknowledgment measure, not a consent mechanism. It fulfills your transparency obligations under Art. 13 GDPR and confirms that the data subject was informed prior to biometric capture. If you rely on consent as your legal basis, you must implement your own consent mechanism separately. You may display your own legal bases in a second verification window — we recommend identifying yourself as controller, stating your legal bases, and referencing applicable legislation per Art. 13(1)(c).

Consent Logging

For accountability purposes (Art. 5(2)), iDenfy records:

• Timestamp of user confirmation
• Version of the information displayed
• Whether the iDenfy policy, your policy, or both were shown

This demonstrates transparency compliance, not reliance on consent as a legal basis.

Cross-Border Data Transfers

iDenfy processes and stores all data within the EU (Dublin, Ireland). Data is not transferred outside the EEA unless:

• Standard Contractual Clauses (SCCs) are in place
• A Transfer Impact Assessment has been completed

If your integration requires data transfer outside the EEA, contact your account manager for transfer impact assessment documentation.

---

Data Subject Rights — How iDenfy Supports You

Right	How iDenfy supports it
Access (Art. 15)	Verification data can be retrieved via API or dashboard. When iDenfy receives a direct request, it is forwarded to you as the controller.
Rectification (Art. 16)	Contact iDenfy support to correct inaccurate verification data.
Erasure (Art. 17)	Delete verification data via API or request deletion through your account manager.
Restriction (Art. 18)	Supported where applicable, subject to AML statutory limitations.
Portability (Art. 20)	Customers can export their verification data at any time before account closure.

When iDenfy acts as processor, all data subject requests received directly are transferred to you as the data controller. iDenfy supports you upon request in accordance with the DPA.

---

Security Measures Supporting GDPR Compliance

Measure	Detail
Encryption in transit	TLS 1.2-1.3 on all connections
Encryption at rest	AES-256-GCM on all stored data
Key management	Managed key service with automatic rotation every 12 months
Access control	Role-based access, IP whitelisting, 2FA enforced
Monitoring	Cloud-native logging, audit trails, and endpoint detection and response (EDR)
Breach notification	Internal DPO notification within 24 hours, supervisory authority within 72 hours, affected clients within 8-24 hours
Incident track record	Zero security incidents in the past 12 months

---

Relevant Certifications

• ISO/IEC 27001:2022 — Continuously certified since 2020 (TUV Thuringen, DAkkS accredited)
• SOC 2 Type II — Security, availability, and confidentiality (12-month examination period)
• eIDAS Conformity — Remote ID proofing certified under EU Regulation 910/2014

---

Data Protection Officer: [e-mail] Security inquiries: [e-mail]