GPG45 Identity Proofing: Practical Guidance for UK Employers

GPG45 identity proofing has become a cornerstone of trusted UK identity verification. For businesses and HR teams, understanding how GPG45 frames verification levels and document validation is essential to manage recruitment risk, meet Right to Work obligations and stay GDPR-compliant.

What GPG45 means for UK businesses

The UK government’s GPG45 guidance defines a risk-based approach to identity proofing. It describes how organisations should apply proportionate checks, selecting verification levels that match the risk posed by the transaction or role. In practice this means that a low-risk interaction may require minimal validation, while regulated roles, access to sensitive systems or certain finance-sector activities will demand stronger identity assurance.

GPG45 places emphasis on three interlocking elements: robust documentary evidence, electronic verification where appropriate, and contextual checks such as employment history or external data. For HR teams this translates into clear policies about when to accept scanned documents, when to insist on original documents, and when to use biometric or database-driven checks.

Verification levels and practical selection

Verification levels are a way to match the depth of identity proofing to the risk. While implementations vary, think of verification levels as tiers — from basic to high assurance — that combine different controls:

• Basic checks: manual document inspection or simple database queries suitable for low-risk cases.
• Standard checks: document validation using MRZ or barcode scanning plus name and DOB checks against authoritative data.
• High-assurance checks: multi-factor approaches combining biometric face-matching, liveness detection and third-party authoritative data sources.

When selecting a level, start with a written risk assessment: what would happen if the identity were fraudulent? For example, hiring a night-shift retail assistant may allow a standard check, whereas onboarding a regulated financial adviser demands high-assurance verification.

Document validation: practical tips for HR

Document validation remains a fundamental element of GPG45 identity proofing. Whether you operate in-person or remotely, these steps help reduce fraud and errors:

• Train staff to recognise common security features in passports, driving licences and biometric residence permits, such as holograms, microtext and UV features.
• Use machine-assisted document scanning to read MRZ zones and check barcode data against the visible details.
• Combine document checks with independent data validation (for example, verifying a National Insurance number or using electoral roll checks where lawful).
• Adopt anti-spoofing biometric checks for remote onboarding to match a live face to the document photo.

Real-world example: a London care agency moved to standardised mobile scanning for candidate passports and driving licences. Scanning reduced human error and allowed staff to detect tampered documents more consistently. For high-risk roles, they then ran an additional database check and scheduled an in-person verification before the employee started.

Right to Work checks and GPG45

GPG45 should be applied alongside statutory obligations. Employers must still perform Right to Work checks in line with UK Home Office rules. Digital and document-based identity proofing can support Right to Work compliance, but you should follow the prescribed evidence routes and retain records to demonstrate due diligence.

For practical, employer-focused steps on meeting Right to Work obligations while using digital tools, see our guidance on Right to Work compliance. That article explains how to combine GPG45-informed identity proofing workflows with the Home Office’s prescribed checks.

GDPR and data protection considerations

Any identity proofing programme must respect data protection law. Under the GDPR, employers need a lawful basis for processing identity data, ensure data minimisation and put appropriate retention and security measures in place. Practical measures include:

• Documenting lawful bases (for example, performance of a contract or legal obligation for employment checks).
• Limiting what you store — retain only the evidence required to demonstrate compliance and delete unnecessary copies.
• Encrypting stored images and logs, and restricting access to authorised HR or compliance staff.
• Publishing clear privacy notices so candidates understand how identity data will be used and retained.

Example: a small software firm switched from storing full copies of identity documents on shared drives to a secure verification provider that stores encrypted evidence and issues time-limited verification tokens. This reduced their data exposure and simplified GDPR record-keeping.

Practical implementation checklist

• Carry out a written risk assessment for each role to determine the appropriate verification level under GPG45.
• Standardise document validation procedures and use technology to read MRZs and detect tampering.
• Combine document checks with independent data or biometric verification for higher-risk cases.
• Ensure Right to Work checks follow Home Office guidance and keep evidence to demonstrate due diligence, as described in our GPG45 identity proofing guidance.
• Embed GDPR principles: lawful basis, minimisation, secure storage and retention schedules.
• Train HR and hiring managers on recognising fraud indicators and escalation routes.

Conclusion

GPG45 identity proofing gives UK businesses a flexible, risk-based framework to strengthen hiring and compliance processes. By aligning verification levels with role risk, investing in robust document validation and applying GDPR safeguards, HR teams can reduce fraud, meet Right to Work obligations and protect their organisation. Practical implementation — documented policies, staff training and the right technology — turns guidance into reliable everyday practice.