Notifications
Clear all
Topic starter
21/08/2026 4:43 pm
TL;DR: Digital ID can let people prove specific facts, such as being over 18 or holding a qualification, without disclosing full document data, using selective disclosure and receipts to improve privacy and transparency, according to Yoti. The governance lesson is that identity verification should minimise exposure by design, not by after-the-fact retention controls.
NHIMG editorial — based on content published by Yoti: Digital ID and privacy through selective disclosure
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- Only 5.7% of organisations have full visibility into their service accounts.
- 79% of organisations have experienced secrets leaks, with 77% of these incidents resulting in tangible damage.
Questions worth separating out
Q: How should organisations reduce privacy risk in identity verification workflows?
A: Reduce privacy risk by removing unnecessary human access from the standard verification path.
Q: Why does data minimisation matter in identity verification?
A: Because every extra attribute collected becomes another item to retain, protect, and govern.
Q: What breaks when identity systems rely on full-document sharing?
A: Full-document sharing makes privacy controls reactive instead of built in.
Practitioner guidance
- Map required attributes to each verification use case List every identity proofing journey and reduce each one to the minimum claim needed, such as age, qualification, or entitlement.
- Add disclosure receipts to identity workflows Capture what was shared, with whom, and when for each digital identity transaction so users and internal teams can trace disclosure events.
- Retire full-document uploads where selective disclosure works Replace blanket document capture with attribute-based proofing in onboarding, access, and age-verification flows.
What's in the full article
Yoti's full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step examples of how the Yoti ID app presents only the needed claim during verification.
- A plain-language explanation of the receipt flow showing what was shared, with whom, and when.
- Illustrative age and qualification examples that show how selective disclosure works in practice.
👉 Read Yoti's explanation of selective disclosure and Digital ID privacy →
Digital ID and selective disclosure: what it means for privacy teams?
Explore further
21/08/2026 5:04 pm
Selective disclosure is the practical privacy control that most identity programmes still underuse. The article shows that proving a claim and revealing a document are not the same thing, yet many verification flows still behave as if they were. The governance gap is purpose limitation at the point of exchange, which is where privacy risk is either contained or created. Practitioners should treat selective disclosure as a design requirement, not a UX enhancement.
A question worth separating out:
Q: Who is accountable when digital identity data is stored or shared incorrectly?
A: Accountability should sit with both the issuer and the provider that handles the data, because each controls a different part of the trust chain. Governance teams should assign ownership for proofing, storage, disclosure, and revocation separately so failures can be traced and corrected.
👉 Read our full editorial: Data minimisation in digital ID is changing privacy expectations
