Notifications
Clear all
Topic starter
30/07/2026 11:22 pm
TL;DR: Digital identity products handling biometric and personal data increasingly rely on privacy by design, data minimisation, and explicit consent controls, according to Yoti. For identity teams, the real test is whether those governance choices hold up across verification, authentication, and account recovery flows, not just in policy statements.
NHIMG editorial — based on content published by Yoti: privacy, biometric data, and digital identity governance
By the numbers:
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.
Questions worth separating out
Q: How should identity teams apply data minimisation in verification flows?
A: Start by mapping each identity decision to the smallest possible set of attributes.
Q: Why do biometric identity systems need stricter governance than ordinary identity checks?
A: Biometric data can be sensitive personal data when it is used to uniquely identify someone, which makes misuse harder to reverse and regulatory scrutiny higher.
Q: What do security teams get wrong about privacy notices in digital identity?
A: A privacy notice is not a control.
Practitioner guidance
- Build data-minimised identity flows Redesign verification journeys so each step collects only the attributes required for the specific decision, then remove any unnecessary storage, logging, or downstream reuse.
- Separate biometric estimation from biometric identification Define different policy, retention, and consent rules for face-based age estimation and identity verification, because the legal and security treatment is not the same.
- Test rights-request execution end to end Validate that access, correction, deletion, and objection requests can be completed across app, backend, and support workflows without exposing extra data or delaying response.
What's in the full article
Yoti's full article covers the operational detail this post intentionally leaves for the source:
- Privacy governance framework components such as assessments, notices, records of processing, and audit records
- Detailed examples of how the app handles biometric and identity data across verification and account recovery
- Role-specific handling for controller and processor scenarios, including who owns rights requests
- Product-specific explanations of retention windows, deletion timing, and user choices
👉 Read Yoti's privacy and digital identity governance article →
Digital identity privacy controls: what IAM teams need to watch?
Explore further
30/07/2026 11:25 pm
Privacy by design has become an access-control problem, not just a legal principle. The article frames privacy as something that must be enforced through product design, data flow limits, and retention choices. That is the right model for digital identity, because data minimisation and purpose limitation only hold if the underlying workflow prevents unnecessary disclosure in the first place. For identity practitioners, privacy governance should be evaluated like any other control surface: what is collected, who can reach it, and how long it survives.
A question worth separating out:
Q: Who is accountable when identity data rights requests fail?
A: Accountability should sit with the service owner and the data controller or processor role that applies to the workflow. Organisations need clear ownership, documented escalation paths, and evidence that deletion, access, and correction requests are handled within the system rather than passed between teams indefinitely.
👉 Read our full editorial: Privacy by design in digital identity needs tighter governance
