Identity Data Privacy and Consent Guide

Identity systems hold some of the most sensitive personal data an organisation processes. Names, contact details, government ID images, biometric templates, device identifiers, location and a detailed record of every sign-in all flow through identity providers, proofing services, directories and logs. Identity teams also make decisions that are privacy decisions: what to collect at onboarding, how long to keep proofing evidence, what consent screens ask for, and what an OAuth app or AI agent may do on a user's behalf. This guide covers the privacy principles that apply to identity data, consent and delegated access, data subject rights and retention, for workforce and customer identity.

Key takeaways

Collect less: ask for the attributes a decision actually needs, and prefer verifying an attribute to storing the evidence.
Biometric and identity document data needs extra protection and a clear legal basis.
Consent must be specific, informed and revocable, whether a user is consenting to data use or granting an app access.
Identity logs are personal data. Keep them for a defined purpose and period.
Build privacy by design into identity architecture, not as an afterthought in the privacy notice.

The identity data you hold

Data	Where it lives	Privacy note
Profile and contact data	Directory, CIAM, HR	Keep accurate; limit who can see it
Identity documents and proofing evidence	Proofing providers, onboarding systems	High risk if breached; retain only as law requires
Biometric templates and images	Proofing and authentication systems	Special category data under GDPR when used to identify. See the Biometrics Guide
Authentication and access logs	Identity provider, SIEM	Reveal behaviour, location and working patterns
Device and fraud signals	Fraud and bot defence tools	Fingerprinting may require consent under e-privacy rules
Consent and preference records	CIAM and consent management	Must be retrievable to prove consent
Delegation and grants	OAuth servers, SaaS integrations, agent platforms	Record who authorised what, for how long

Principles applied to identity

This is a practitioner summary, not legal advice. The principles below follow the GDPR and UK GDPR; many other privacy laws, such as those in US states, apply similar ideas.

Lawfulness: identify the lawful basis for each identity data use. Security and fraud prevention often rely on legal obligation or legitimate interests; marketing uses usually need consent.
Purpose limitation: do not repurpose sign-in and security data for unrelated uses, such as productivity scoring, without a proper basis.
Data minimisation: collect only what each decision needs. An age check needs "over 18", not a date of birth. See the Age Assurance Guide.
Accuracy: identity decisions based on wrong data harm people. See the Identity Data Quality Guide.
Storage limitation: set retention for proofing evidence, templates and logs.
Security: identity stores are prime targets and must be protected accordingly.
Privacy by design and by default (GDPR Article 25): the default settings should be the privacy-protective ones.

Separate consent to terms from consent to optional processing such as marketing or profiling.
Make consent granular, recorded with time and version, and as easy to withdraw as to give.
Do not bundle security processing under consent; if users could refuse it, it is not the right basis for security controls.
Manage cookie and tracking consent consistently with fraud and bot defence needs, and document where a strictly necessary exemption applies.

When a user clicks "Allow" on an OAuth screen, or asks an AI agent to act for them, they are delegating access to their data. That is a privacy decision as well as a security one.

Show clearly which application or agent is asking, what data and actions it wants, and for how long. See the OAuth 2.0 and OpenID Connect Guide.
Request the narrowest scopes needed, and let users see and revoke grants in one place.
For organisations, control which apps staff may consent to. See the SaaS and OAuth App Governance Guide.
For AI agents, record the principal, the agent, the scope and the time limit of each delegation. See the AI Agent Authorisation Guide.

Data subject rights

Access: be able to find a person's identity data across the IdP, CIAM, proofing provider, logs and connected applications.
Rectification and erasure: propagate corrections and deletions downstream, including to provisioned applications. See the SCIM Provisioning Guide.
Verify the requester: a rights request is also an attack route. Verify identity proportionately before disclosing or deleting data. See the Account Recovery and Help Desk Security Guide.

Retention

Set retention per data type, based on legal requirements (for example, AML record-keeping) and security need.
Delete document images and biometric data once verification is complete, unless a legal obligation requires keeping them.
Keep security logs long enough to investigate incidents, then aggregate or delete.
Apply retention to identity data held by vendors, and check it in contracts.

Assessments and accountability

Run a data protection impact assessment for proofing, biometrics, behavioural analytics, workforce monitoring and AI agents that process personal data.
Keep a record of processing for identity systems and their vendors.
Work with the privacy team on identity architecture decisions early.
See the Identity Security Regulatory Map for related obligations.

Practitioner checklist

Map identity data by system, purpose, lawful basis and retention.
Minimise collection and prefer attribute verification over storing evidence.
Protect biometric and identity document data with extra controls and deletion by default.
Make consent granular, recorded and revocable, and keep security processing on a proper basis.
Show clear delegation screens and a single place to review and revoke grants, including for AI agents.
Support rights requests across all identity stores, with proportionate requester verification.
Complete DPIAs for high-risk identity processing.

Standards and references

Related NHI Mgmt Group resources: Customer IAM (CIAM) Guide · Biometrics Guide · Identity Security Regulatory Map · Agentic AI Compliance Guide