Right to Work Digital Identity Checks: Employers’ Guide

Section A: What Are Digital Right to Work Checks?

They use Identity Document Validation Technology via a Digital Verification Service (DVS) provider – also known as an Identity Service Provider (IDSP) – to authenticate British and Irish citizens who hold a valid passport or Irish passport card. When these checks follow the Home Office rules and are completed before the start date, they can create a statutory excuse against civil liability if the worker is later found to be employed unlawfully. Employers remain responsible for compliance even when an IDSP performs the technical verification.

In the current Home Office guidance, the digital right to work route is described as using a Digital Verification Service (DVS), although the underlying provider is still technically an Identity Service Provider (IDSP) using IDVT.

1. Overview of IDVT (Identity Document Validation Technology)

Identity Document Validation Technology allows a digital copy of a physical identity document to be assessed for authenticity and to confirm that the individual presenting it is the rightful holder. In the right to work context, this involves a certified Identity Service Provider carrying out technical checks on a British or Irish passport or an Irish passport card and producing an output report that the employer can rely on as part of a compliant check. The employer then verifies likeness in person or via video, reviews the IDSP’s output, and records the date the check was completed.

2. Home Office Legal Framework

Digital checks are provided for under the Immigration (Restrictions on Employment) Order 2007 and the Home Office employer right to work guidance. These rules set out when digital checks can be used, how employers are expected to carry them out, and what records need to be retained to establish the statutory excuse. The Home Office recommends using a certified Digital Verification Service (DVS) provider operating under the Digital Identity and Attributes Trust Framework and recommends that checks meet at least a Medium Level of Confidence.Liability does not shift to the IDSP. Employers need to complete the likeness check before the person starts work and keep evidence securely for the duration of employment and for two years afterwards.

3. When Digital Checks Can Be Used

Digital right to work checks using a DVS can be used only for British citizens with a valid passport and Irish citizens with a valid passport or Irish passport card. They cannot be used for expired passports. If the individual does not hold a valid passport or does not wish to use an IDSP, the employer needs to carry out a manual document check in accordance with Home Office guidance. For all non-UK and non-Irish nationals, employers should use the Home Office online right to work service where the individual provides a share code. Manual inspection of biometric residence permits or biometric residence cards is no longer acceptable, since these documents now support digital status checks only. If an individual has a pending application or review and cannot generate a share code, the Employer Checking Service may be used to obtain a Positive Verification Notice.

Section B: How to Conduct a Digital Right to Work Check

To carry out a compliant digital right to work check, employers are required to follow the steps set out in Home Office guidance. The employer remains responsible for the outcome of the check, even where an Identity Service Provider performs the technical identity verification. A sound process will usually involve appointing a suitable, preferably certified IDSP, obtaining the individual’s agreement to use that service, reviewing the output, confirming likeness, and retaining evidence in line with record-keeping rules. Checks need to be completed before employment starts if they are to provide a statutory excuse.

1. Selecting a Certified Digital Verification Service (DVS) Provider

Employers are strongly advised to select a Digital Verification Service (DVS) provider (IDSP) that operates under the Digital Identity and Attributes Trust Framework and appears on the government’s list of certified providers for right to work purposes. Certification gives assurance that the provider’s systems and controls meet recognised standards for security, accuracy and fraud prevention. The list on GOV.UK is updated periodically, so employers should check that certification is current and that the provider’s service covers right to work checks. Contract terms should deal clearly with accuracy obligations, service standards, complaint handling and liability, as well as data protection and confidentiality. Employers should also make sure the provider’s checks achieve at least a Medium Level of Confidence (MLoC) as recommended in the guidance, and that the output report includes the document image, the outcome of verification, the level of confidence reached and the date of the check.

2. Employee Consent and Data Handling

Before a digital check takes place, the individual needs to agree to their identity being verified by an IDSP and to submit images of their passport or passport card through the provider’s system. In parallel, the employer should be clear that the legal basis for processing under UK GDPR is compliance with a legal obligation to prevent illegal working. The employer is usually the data controller and the contract with the IDSP should set out whether the provider acts as a processor, a controller in its own right or a joint controller. Where the IDSP acts as a processor, the agreement should meet Article 28 requirements and specify the nature of the processing, security measures, restrictions on sub-processing and arrangements for deletion at the end of the retention period. Employers should ensure that digital outputs and any associated records are stored securely, with access restricted to staff who genuinely need it.

3. Retaining Evidence and Audit Trail

Once the IDSP has verified the passport or passport card, it will produce a digital output report. The employer needs to review that report and carry out a likeness check in person or over a reliable video link, confirming that the person presenting for work matches the image and biographical details in the output. Employers should then record the date the check was completed and the name of the person who confirmed likeness, and store the IDSP output in a format that cannot be altered. Records should be kept for the duration of the individual’s employment and for two further years so that they can be produced quickly if the Home Office requests evidence. Checks completed after the person has started work do not create a statutory excuse, even if the IDSP report appears satisfactory, so processes need to be designed so that no one can begin working before the digital check and likeness confirmation are completed and recorded.

Section C: Employer Legal Duties & Compliance Risks

Employers have a continuing legal duty to prevent illegal working by checking every new recruit’s right to work before employment begins. Using a digital check through an Identity Service Provider is one way to meet this duty, but the responsibility for compliance always sits with the employer. A statutory excuse is available only where every prescribed step has been completed correctly and the required evidence has been retained. Any gaps in process, record-keeping or timing can remove that protection entirely and expose the organisation to enforcement action, significant financial penalties and wider operational risk.

1. Employer Liability and Statutory Excuse

The statutory excuse provides a defence against civil penalty if an employee is later found to be working illegally, but it applies only where the employer has followed the correct procedure. For a digital check, this means the identity verification must have been performed by an appropriate IDSP, the level of confidence achieved must meet Home Office expectations, likeness must have been confirmed, and the check must have taken place before the person started work. The employer also needs to keep a legible, non-editable copy of the IDSP output showing the document image, the outcome of verification, the date the check was completed and who confirmed likeness. If any element is missing or incomplete, the statutory excuse is unlikely to apply, even if the individual later turns out to have the right to work.

2. Common Errors and Risk Areas

Many compliance issues arise from operational pressures rather than a misunderstanding of the rules. Common pitfalls include using an IDSP whose certification has lapsed, relying on checks completed after the employee has already started work, or failing to carry out the likeness check with enough care. Some employers do not record the date of the check or the name of the verifier, which undermines evidential value during a Home Office inspection. Others store the IDSP output in formats that can be altered or that do not preserve the required level of clarity. These problems often surface during audits or compliance visits and can undermine even well-designed systems. Employers should ensure their processes avoid any route for staff to skip steps, and that regular audits test whether checks are being carried out consistently and to the expected standard.

3. Civil Penalties and Enforcement

The Home Office strengthened the illegal working enforcement regime in February 2024. Civil penalty levels now reach up to £45,000 per illegal worker for a first breach and £60,000 for repeat breaches. Where an employer knows or has reasonable cause to believe that a person does not have the right to work and employs them anyway, criminal liability may follow, carrying an unlimited fine and the risk of imprisonment. Civil penalty notices are published, which can damage reputation and trigger concern among clients, regulators and insurers. For organisations holding a sponsor licence, a civil penalty can also affect licence rating, compliance assessments and decisions on future applications. To manage these risks, employers should maintain a central register of checks, run periodic internal audits and ensure HR teams and recruiting managers are trained on current guidance and internal procedures.

Section D: Common Issues with Digital Right to Work Checks

Digital right to work checks can streamline onboarding, but mistakes, gaps in process or technical difficulties can undermine your statutory excuse. Employers are expected to anticipate known risk points and to resolve issues quickly. This section outlines the most frequent problems that arise and how to manage them so that checks remain compliant and defensible during any Home Office audit or enforcement activity.

1. Problems with Passport Images or IDVT Output

Digital checks rely on the individual submitting a clear image of a valid British or Irish passport or an Irish passport card. Poor-quality uploads, shadows, glare or cropped images can cause the IDSP to return an incomplete or inconclusive result. If the IDVT output does not meet the expected Medium Level of Confidence or the report is missing required fields, employers need to rerun the check. You should tell the individual to resubmit images using a well-lit, high-resolution photo taken against a neutral background. If the IDSP continues to produce inconclusive results, fall back to a manual check for British or Irish nationals, provided the document itself is suitable.

2. Likeness Check Concerns

The likeness check is a recurring point of failure. Employers sometimes treat it as a formality, but if the image in the IDSP report appears inconsistent with the person presenting for work, you cannot rely on the digital check. Differences caused by age, hairstyle or lighting can usually be resolved by asking the individual to join a video call in good light or attend in person with their physical passport. If doubts remain, complete a manual check for British or Irish citizens using the valid passport or seek advice before onboarding. A worker should not start work until likeness has been confirmed and recorded.

3. Expired Passports or Missing Documents

Digital checks only apply to valid British or Irish passports or Irish passport cards. When the individual’s passport has expired or is unavailable, attempting to force the digital route will create gaps that undermine your statutory excuse. Employers should instead switch to a manual check for British or Irish nationals, following the list of acceptable documents. If the individual claims they have applied for a new passport or is awaiting a replacement, do not allow them to start work until a valid document is provided or a manual route is legally available.

4. IDSP Technical Failures and Downtime

Occasional service outages or delays are predictable when relying on third-party systems. Employers should have a contingency route in their process so start dates do not drift or become pressured. If the IDSP platform is unavailable, you can delay onboarding until the system is restored or, for British and Irish citizens, conduct a manual check. The fallback route needs to be built into the process so hiring managers do not improvise or accept screenshots or partial outputs that fall outside Home Office rules.

5. Data Transfer or Permission Errors

Sometimes the IDSP’s system cannot match the biographical information submitted by the individual to the document image. This often stems from transcription errors, name variations or OCR mistakes. Ask the individual to re-enter their details exactly as shown on the passport. If the mismatch persists, request new images of the document and rerun the IDVT process. Where the individual has recently changed their name, employers should obtain supporting evidence and follow manual routes instead of trying to validate inconsistent identity attributes through digital means.

6. Missing Dates or Verifier Details

Incomplete internal records are among the most common issues uncovered during Home Office audits. If the date of the check or the name of the person who confirmed likeness is missing or unclear, the statutory excuse may be questioned. Employers should build mandatory fields into onboarding systems so a check cannot be saved until all required information has been entered. Retrospective updates are weak evidence and should be avoided. If a check has already been carried out without these details, repeat the check before employment begins wherever possible.

7. Inconsistent Storage and Retention Practices

Digital outputs need to be stored in a non-editable format. Risks arise when teams save files in personal folders, editable formats or locations outside controlled HR systems. Employers should centralise storage in a secure, access-controlled environment and apply consistent naming conventions so records can be produced quickly on request. If a file has been saved incorrectly, re-save it in a fixed format and document the reason for the correction. Never alter the content of an IDSP report. If quality is lost during saving, rerun the check rather than rely on a degraded copy.

8. Issues with Time-Limited Right to Work

Digital checks apply only to British and Irish citizens, but employers may still run into problems when later monitoring the expiry dates of other workers whose status is digital. A typical failure point is assuming that online status will refresh automatically or that the worker will inform HR when their permission changes. Employers should run scheduled reviews using the online service and set automated reminders. If a worker cannot produce an updated share code and has a pending application, use the Employer Checking Service promptly. Never wait for the individual to confirm progress.

9. When to Seek Further Advice

Some issues cannot be resolved through repeat checks, new images or manual routes. Complex name discrepancies, doubts about document authenticity, recent changes of nationality status or irregular immigration histories often require legal input. Employers should pause the onboarding process and seek advice rather than proceed on assumptions. A worker should not start until the right to work position is verified through a compliant method and the employer has a reliable audit trail.

Section E: Summary

Digital right to work checks give employers a fast, structured way to verify British and Irish workers, but they do not reduce the legal standard the Home Office expects. The obligation is still to complete the right check, at the right time, with the right evidence retained. Technology only helps if the underlying process is disciplined and consistently applied. If dates, verifier details or likeness checks are missing, your statutory excuse is at risk regardless of how sophisticated the IDSP may be.

In practice, compliance comes down to design and control. You need a process that makes it impossible for staff to bypass the check or to improvise when there are delays or system issues. IDSP choice, data handling, storage and record formats all need to be thought through and kept under regular review. As the system moves further towards eVisas and wider digital identity tools, the employers who have invested in clear workflows, robust training and auditable records will be in a stronger position. Treat digital checks as part of wider right to work governance, not a bolt-on, and they can support both operational efficiency and regulatory assurance.

Section F: Need Assistance?

Right to Work compliance remains a common risk for employers. If you have questions about Right to Work processes, checks or training solutions, we can help.

We can review sample files, policy documents and contracts with your IDSP, then give you clear, practical recommendations that reflect how your business operates. If you would like tailored advice on strengthening your statutory excuse and reducing enforcement risk, contact us to arrange a consultation.

Section G: Glossary

Section H: Additional Resources & Links