Skip to content
HR & Recruitment calendar_today Updated: 15 September 2026 schedule 3 min read

Can I Keep a Copy of an Employee's Identity Card?

verified Last reviewed 15 September 2026 · GDPRWise legal team

Normally not: keep a copy only when a specific legal rule requires it and a visual check or noting the necessary data is not sufficient.

summarize Key Takeaways
  • check_circle Keep a full copy of the identity card only when a specific legal rule requires it
  • check_circle Before retaining a copy, document the purpose, legal requirement, necessity, access restrictions and retention period
  • check_circle A request from your payroll provider or HR vendor is not a legal basis in itself
  • check_circle Review copies you collected without a valid reason and delete them

Normally you may not keep a full copy of an employee’s identity card. The fact that you have to verify their identity or need certain data for personnel administration does not mean you may copy the entire card.

Check visually, note selectively

Check the card visually and record only the data you genuinely need. A copy can only be appropriate when a specific legal rule requires it, for example for certain procedures relating to the employment or residence of a foreign worker. In Flanders, for instance, some work permit procedures require a copy of the passport or residence document.

A full copy contains a protected national identification number and several elements that facilitate identity fraud, such as the photograph, the signature and the card number. The Belgian data protection authority therefore states that copies should not be made unless legislation provides for them, and that a visual check may be sufficient.

Your vendor asks for a copy

A request from your payroll provider or HR vendor is not a legal basis in itself. Ask why the vendor needs the copy and whether the necessary data can be passed on separately.

What about copies you already have?

If you have already collected copies without a valid reason, review them and delete the copies for which no demonstrable necessity or legal basis exists.

If you do keep a copy on a legal basis, document beforehand the purpose, the legal requirement, the necessity, who has access and how long you keep it. Which data you may record is explained in Which data from an employee’s identity card may I record?

Keeping a copy quickly conflicts with the principles of purpose limitation, data minimisation and storage limitation (Article 5(1)(b), (c) and (e) GDPR) and requires a legal basis under Article 6 GDPR, in practice a legal obligation. If you do keep a copy, the security obligations of Article 32 GDPR apply, and Article 87 GDPR lets member states set specific conditions for the national identification number shown on the card. On top of that come national legislation on identity cards and population registers and, where applicable, regional rules on employing foreign workers.

auto_awesome Do you know which employee data you process?

GDPRWise maps your HR processes, from onboarding to offboarding, so you know for every data item why you keep it.

Share share LinkedIn mail Email
GW
GDPRWise Editorial

This article was written by the GDPRWise team and reviewed by our privacy experts. We regularly review our content for accuracy and legal correctness.