Asking for a copy of ID under the GDPR: what the French regulator says, and how to do it properly

Mid-September, at a small local club. The volunteer secretary scrolls through her inbox: thirty-eight ID cards as attachments, front and back, the parents' and sometimes the children's. They'll sit there for years, in a mailbox whose password is also the one for the club's website. Nobody meant for this to happen: the line "copy of ID" was on last year's form, so it stayed.

Clubs, landlords, employers, freelancers: before asking for a copy of ID, two questions come first. Do you really need it? And if so, how do you receive it, protect it and get rid of it in time? This article follows the French rules and the guidance of the CNIL, France's data protection authority, which apply to anyone collecting documents in France. The GDPR principles it quotes are the same across the EU. Source by source, with a message to copy.

Why is a copy of an ID so sensitive?

Because it's often enough to pass yourself off as someone else. Cybermalveillance.gouv.fr, the French national assistance service for victims of cybercrime, defines identity theft as the use of personal or professional data that identifies a person, without their consent, to impersonate them and commit fraud (identity theft fact sheet (opens in a new tab), in French). The examples it gives include opening a phone line or a bank account, taking out a loan and renting a car. And victims may find themselves prosecuted for offences they then have to prove they didn't commit.

The CNIL also describes the reverse scenario: the fake requester. A fraudster can pose as a private individual, "for example a landlord in a property rental", and so obtain a copy of the victim's ID card or other personal information (CNIL, how to react to identity theft (opens in a new tab), in French).

So every copy you store is a target. And a badly framed request looks like a scam: careful people hesitate, and they're right to.

Does the GDPR allow you to ask for a copy?

The GDPR doesn't ban copies as such. It sets principles, including data minimisation, which the CNIL sums up as limiting collection "to the data strictly necessary to achieve your purpose" (CNIL, the six main GDPR principles (opens in a new tab), in French). The real question is: is a copy necessary for what you're doing?

The CNIL's answers depend on the situation:

• A hotel in France may not copy your ID. It may ask you to show it, in particular for the police form foreign guests have to fill in (CNIL (opens in a new tab), in French).
• A bank may, and must: banks have to verify their customers' identity as part of anti-money laundering rules and keep a copy (CNIL (opens in a new tab), in French).
• A rental: an ID document is on the list set by French decree, detailed in our article on rental application documents in France. The CNIL adds that viewings shouldn't be made conditional on handing over documents (CNIL (opens in a new tab), in French).
• A request to access one's data: the principle is no ID document, unless there is reasonable doubt about the person's identity (CNIL (opens in a new tab), in French).

The logic to keep in mind: when a rule requires the copy, you ask for it. Otherwise, before asking for a copy of ID, it's up to you to justify why a quick look isn't enough.

Isn't seeing the document enough?

Often, yes. In its framework for customer files, the CNIL writes that when an organisation needs to be sure of someone's identity before doing business with them, simply looking at an ID document "may be enough" (CNIL framework on managing commercial activities, PDF (opens in a new tab), in French).

A copy is only kept when the law requires it, or when the organisation can justify needing evidence in case of a dispute. Even then, the same text calls for enhanced security measures, such as lowering the quality of the scanned image, notably to prevent the photos being used for facial recognition.

In practice, the person shows their card at signing, at a desk session or on a video call, and you write in your tracking sheet "ID checked on 12 September by Claire". There's a record, and the card isn't stored anywhere. For a membership, that's often enough.

What should the watermark say?

If a copy is justified, ask for it to be marked. Cybermalveillance.gouv.fr advises everyone to mark the ID copies they send by writing over them the reason for sending, the date and the recipient, so the documents can't be reused for fraud (same fact sheet (opens in a new tab), in French). On the organisation's side, the CNIL lists among enhanced security measures a watermark showing the collection date and the organisation's name (CNIL framework, PDF (opens in a new tab), in French).

So give people the exact text to write, with three elements:

1. The recipient: your name, or your club's or company's.
2. The purpose: specific, for example "2026-2027 season registration" rather than "file".
3. The date the copy is sent.

A copy marked "For Les Tilleuls club, 2026-2027 season registration, 15/09/2026" is much harder to reuse anywhere else.

To do it, the French State offers FiligraneFacile (opens in a new tab) (in French), a free service run by the directorate general for planning, housing and nature. It accepts jpg, png, heic and pdf files and returns a PDF. According to the site, the original files are deleted from its servers once the watermarked file is generated, and the watermarked file is deleted after its first download, or after one day. The CNIL points to it for rental files: it "makes it easy to add a personalised digital watermark to protect sensitive documents before sending them" (CNIL (opens in a new tab), in French).

The site itself warns that some organisations, such as banks or public services, may need an unmarked document. If you're not one of them, accept watermarked copies, and say so.

How long should you keep the copy, and how do you delete it?

As briefly as possible. For the CNIL, data is kept in day-to-day use only for the time "strictly necessary to achieve the purpose pursued" (six main principles (opens in a new tab), in French). For rentals, it specifies that supporting documents must be destroyed once they are no longer useful for deciding who gets the home (CNIL (opens in a new tab), in French).

Pick an event rather than a vague duration (licence approved, lease signed), announce it, then keep your word. Deleting means everywhere:

• the attachment in your inbox, and in the trash;
• the message you forwarded to the treasurer or a colleague;
• the file in your Downloads folder;
• the photo received by messaging app, and the conversation it's in;
• the paper copy, which the CNIL's GDPR guide for associations (opens in a new tab) (in French) suggests shredding or putting in a confidential waste bin.

Where should you store copies in the meantime?

Not in your inbox, and never in a WhatsApp group. An ID posted in a group is visible to every member and stays on their phones. An inbox keeps everything until someone clears it out, and nobody ever does.

The CNIL asks you to take every useful measure to "guarantee the security of the data", including "strict management of authorisations and IT access rights" (six main principles (opens in a new tab), in French). Its guide for associations puts it more simply: data should be accessed by as few people as possible.

In practice: a dedicated folder, open only to those who need it, a password used nowhere else, and a clean-up date in your calendar.

What message should you send to ask for the copy?

A message that says why, how to mark the copy and when it will be deleted. It sets you apart from a scammer:

Hi [First name],

To complete [your registration / your file], I need a copy of your ID by [day and date]. It will only be used for [specific purpose].

Before sending it, please add a watermark with this text:
"For [organisation name], [purpose], [today's date]"
The French government site filigrane.beta.gouv.fr does it for free.

A readable photo is fine. Please don't post it in the group: just reply to this message.

It will be deleted as soon as [event: licence approved, lease signed...], and no later than [date].

If you'd rather show it to me in person than send a copy, just let me know.

Thanks,
[Your name]

And what to avoid:

Hi all! Send me your ID cards front and back here before Friday, thanks!

No reason, no watermark, no deletion date, and a group as the destination.

And when you receive dozens of them?

From a few dozen people onwards, the risk comes from scattered copies: one in the inbox, one in a chat, one on the treasurer's phone. Tracking by person is covered in how to collect documents from multiple people, and the case of staff in our article on new employee onboarding documents in France.

Please Send It sends each person their own upload link with your list of documents, follows up with those who haven't sent everything, and files each document by person, away from your inbox and group chats. Files are encrypted and hosted in France, and sensitive documents such as ID are deleted automatically 30 days after they arrive, so the clean-up happens even if you forget.