1. Understand our data protection roles
When we provide identity verification services on your behalf, we generally act as your data processor.
We also act as an independent data controller for our own legal, security, fraud prevention and service management purposes.
For example, when you report fraud or our systems detect suspicious activity, we act as the controller of the fraud intelligence we collect or generate. This helps us detect and prevent fraud across our network.
2. Decide your lawful basis
You'll need a lawful basis for checking people's identities, assessing fraud risk and sharing relevant information with Vouchsafe.
Depending on your circumstances, this may be:
legitimate interests
recognised legitimate interests for qualifying crime-prevention activities
legal obligation
Document your reasoning, including why your use of Vouchsafe is necessary and proportionate.
Consent usually isn't the correct legal basis
It's important to make sure users understand how their data will be used, but:
consent can be withdrawn at any time, which undermines the purpose
fraud prevention shouldn't depend on a fraudster consenting
3. Update your privacy notice
You should explain your use of Vouchsafe to the people whose data you process.
You can adapt the following wording:
We use Vouchsafe to verify identities, assess fraud risk, and detect and prevent fraudulent activity.
Information we provide to Vouchsafe, and relevant information generated through checks, may be used by Vouchsafe as an independent data controller to identify suspicious activity and help protect other organisations against fraud.
For more information, see Vouchsafe's privacy notice.
4. Complete your internal documentation
Before going live, make sure you've:
documented your lawful basis in your record of processing activities (ROPA) if needed)
updated your privacy notice
accepted Vouchsafe's data processing agreement and terms - this is automatic if you sign up to a Lite plan
considered whether a Data Protection Impact Assessment (DPIA) is necessary, particularly if using automated fraud risk scoring
Need more help?
Our trust centre contains our data protection and security documentation.
Available on request:
information for your ROPA
exemplar DPIA and LIA templates for you to customise to your business's context
boilerplate wording for your UI
Contact [email protected] or your customer success manager.
⚠️ We cannot provide legal advice - you remain responsible for your own GDPR compliance.