A guide to digital identity certification

In April, the government updated the guidance on how certified digital identity service providers can become certified to complete digital identity checks for schemes like the Right to Work, Right to Rent, and DBS.

At the end of 2021, the government announced its intention to enable employers and landlords to use certified digital identity service providers (IDSPs) to carry out identity checks on their behalf for many who cannot use the Home Office online services, including British and Irish citizens.

As well as this, the Disclosure and Barring Service’s (DBS) proposal will enable digital identity checking within their criminal record checking process using certified IDSPs.

Updated guidance

In April this year, however, the guidance was updated on how IDSPs can become certified to complete digital identity checks for schemes like the Right to Work, Right to Rent, and DBS.

They would be certified in line with the Department for Digital, Culture, Media and Sport’s (DCMS) UK Digital Identity and Attributes Trust Framework.

It is a set of rules organisations agree to follow to conduct secure, trustworthy identity or attribute checks. 

This new guidance meant a variety of things for both employers and landlords. 

It meant they were able to work with IDSPs to utilise Identification Document Validation Technology (IDVT) to carry out digital identity checks on behalf of British and Irish citizens who hold a valid passport. This includes Irish passports. 

The relevant changes to legislation took effect from 6 April 2022.

Benefits

Enabling the use of IDVT for Right to Work, Right to Rent and DBS checks helped to support long-term post pandemic working practices, accelerate the recruitment and onboarding process, improve employee mobility and enhance the security and integrity of the checks.

This supports the continued development of the DCMS trust framework and enables employers and landlords to make use of IDVT where they already have an established commercial relationship with an IDSP.

Whilst it is not mandatory for employers and landlords to use a certified IDSP for the purposes of right to work and right to rent checks, the Home Office recommends employers and landlords use a certified IDSP. 

This has provided assurance that their chosen IDSP meets relevant scheme guidance and the standards set out in the trust framework. 

This means an employer or landlord can reduce risk by recruiting and renting in a safer way as they are able to assure prospective employee and tenants’ identities and eligibility using consistent and more secure methods. 

Employers and landlords will retain obligations that they must comply with under the Schemes, including to satisfy themselves that the IDSP has carried out an identity check on the employee/tenant, and to retain copies of the check.

For DBS checks, employers need to use a certified IDSP.

Certification

But what do IDSPs become certified against?

To become certified against the schemes, IDSPs must meet the criteria in the current version of the trust framework. 

A consultation on proposed digital identity legislative measures ran from July to September 2021. These include a plan to legislate for formalised governance arrangements for the trust framework and under these arrangements the trust framework will move to the live phase. The process for certification may change under these arrangements, with IDSPs needing to meet any new requirements.

IDSPs become certified through a step-by-step process for how providers become certified against the trust framework and Right to Work, Right to Rent, and DBS Schemes are as follows.

The first step is that IDSPs who wish to become certified must firstly decide whether they want to be certified against the Right to Work and Right to Rent Schemes only, the DBS Scheme only, or both.

Secondly, IDSPs must engage with one of the selected certification bodies and agree a contractual relationship for completing the assessment process.

IDSPs are assessed by a combination of desk reviews and on-site audits depending on the scope to be assessed. Although having taken part in the alpha testing of trust framework is not a requirement, those who did participate will be able to use their alpha self-assessments as supporting evidence as part of this process.

After the audits have taken place, certification bodies will advise DCMS and the IDSP undergoing certification of their recommendation in regard to certification.

Finally, DCMS will review the outcome of the assessment process and, if all requirements have been met, the name, contact details, and certification status of the IDSP will be published on this page. Employers, landlords and other relevant IDSPs interested in procuring digital identity services will be able to see which IDSPs have been approved.

Certification is a time-limited process and IDSPs will need to undertake an annual surveillance audit and biennial recertification to remain on the list of certified IDSPs for these Schemes.

A list of certification bodies can be found on the UKAS website

Event Diary

This year, Total Telecom’s Connected Britain is celebrating its 10th anniversary, marking a decade of networking, innovation, and collaboration. The conference is now the UK’s largest digital economy event, set to welcome over 7,500 delegates from the telecoms industry and beyond to discuss the hottest topics at ExCel London on September 11–12. 

DTX brings together creative minds and technology practitioners with the tools needed to drive change, enhance experiences and improve efficiencies across today’s organisations.

The countdown to the Environmental Services & Solutions Expo (ESS Expo) is on! As the UK’s largest environmental gathering, ESS Expo is set to take place on 11-12 September 2024 at the NEC, Birmingham.