GPG45 Identity Proofing: Practical Guide for UK Employers and HR Teams

GPG45 identity proofing is increasingly central to how UK businesses protect themselves from fraud while meeting legal obligations such as Right to Work checks and data protection under GDPR. This article explains the principles of GPG45, outlines practical verification levels and document validation techniques, and gives HR teams clear, actionable steps they can adopt today.

What is GPG45 and why it matters

GPG45 is the UK government’s good practice guidance for identity proofing. It sets out risk-based expectations for confirming someone’s identity before granting access to services or employment. For employers, following GPG45 helps to demonstrate a robust, proportionate approach when conducting identity checks — particularly for remote onboarding or higher-risk roles.

Verification levels: matching assurance to risk

At the core of the guidance is the idea of verification levels or assurance tiers: higher-risk interactions require stronger proof. For routine hires you may need primary documents and a basic check; for finance, social care or senior positions you should use stronger measures such as multiple independent documents, biometric checks and authoritative source verification.

Practical example: a seasonal retail cashier role may be verified with a passport scan and name–address check, while a senior financial controller should undergo multi-source checks, biometric liveness assurance and confirmation against government or professional registers.

Document validation: beyond visual inspection

Document validation is more than looking at a passport or licence. Modern document validation combines automated and manual techniques:

• Optical Character Recognition (OCR) and MRZ checks to ensure data integrity and detect tampering.
• Security feature analysis — holograms, UV markers and microprint verification — often flagged by specialist software.
• Authoritative source checks against government databases or trusted third-party data to confirm details like name, date of birth and immigration status.

Real-world example: a remote worker submits a driving licence photo. Automated MRZ/OCR flags inconsistencies; an identity specialist performs a secondary visual check and requests a short live video for liveness confirmation before HR issues access credentials.

Combining GPG45 with Right to Work obligations

GPG45 complements statutory Right to Work checks. Employers must follow Home Office rules on acceptable documents and retention: typically retaining copies for the duration of employment plus two years for most paper checks. Implementing GPG45-style identity proofing can strengthen remote checks and reduce the risk of employing someone who is not permitted to work.

For further practical steps on Right to Work processes and penalties for non-compliance, see our article on right to work compliance.

GDPR and data protection considerations

Collecting identity documents carries explicit data protection responsibilities. Under GDPR, employers must ensure lawful basis for processing (usually legitimate interests or legal obligation), apply data minimisation, and secure personal data with appropriate technical and organisational measures.

• Store document scans encrypted, restrict access to HR staff and audit access logs.
• Define clear retention policies aligned to statutory requirements and delete data when no longer necessary.
• Provide privacy notices explaining why the data is processed and how long it will be retained.

Practical tip: maintain a short, versioned retention schedule that maps each type of check to the lawful basis and retention period, and review it annually as regulations and guidance evolve.

Operationalising GPG45 in your HR processes

Steps to implement effective identity proofing:

• Risk-assess roles to determine the appropriate verification level. Categorise roles as low, medium or high risk and document the evidence required for each.
• Adopt a layered approach: combine document validation, authoritative database checks and biometric liveness for higher assurance.
• Train HR staff in spotting fraudulent documents and set escalation routes to specialist teams for suspicious cases.
• Use auditable digital platforms that produce time-stamped evidence trails so you can demonstrate compliance with GPG45 and Right to Work obligations.

Example workflow: for a high-risk finance hire, request a passport and proof of address, run automated document validation, perform a biometric liveness check, and complete an authoritative source verification. Store the results securely and record the decision rationale in the applicant file.

Balancing fraud prevention with candidate experience

Stronger checks can increase drop-out rates during recruitment. To minimise friction:

• Communicate clearly what documents are needed and why, referencing your privacy notice.
• Offer multiple verification routes (in-person, digital upload or secure video) depending on candidate capability.
• Use fast, mobile-friendly verification tools that reduce manual steps and provide real-time feedback.

For an overview of technologies that support secure, user-friendly identity checks, read our practical guide on GPG45 guidance for employers which outlines common toolsets and integrations for HR teams.

When to escalate and use manual review

Automated systems are powerful, but not infallible. Escalate to manual review when automated checks flag anomalies, when documents are old or low quality, or when the role carries regulatory obligations (for example, regulated financial roles or work with vulnerable people). Maintain clear criteria for escalation and ensure reviewers are trained in forensic document assessment.

Final considerations

GPG45 identity proofing allows employers to align verification levels with organisational risk while meeting legal duties such as Right to Work and GDPR. By combining robust document validation, authoritative checks and practical HR workflows, businesses can reduce fraud, improve compliance and protect their workforce. Start with a risk-based policy, deploy suitable technology, and ensure your procedures are clearly documented and auditable.

If you need tailored support, VerifyOnline can help design compliant identity proofing processes that fit your sector and risk profile.