A lawful-basis checklist to run before any identity check
Five questions to answer before your code calls a verification API. If you cannot answer them, do not run the check.
On this page
Who is this person to us?
A customer mid-application, an onboarded vendor, a borrower in collections: there should be an existing or forming relationship. Running checks on people with no relationship to you is where trouble starts.
What decision does this check support?
Name the decision: approve this account, release this payout, confirm this is the right borrower. A check that does not feed a decision is data collection for its own sake.
Did they consent, and to this?
The consent you hold should cover this specific check against these specific sources. Generic "we may verify your identity" is weak; itemised is strong.
Is it proportionate?
A penny-drop for a one-rupee refund is not proportionate. Match the intensity of the check to the value and risk of the decision.
Can we show our work?
If a regulator or the person asks, can you produce the purpose, the consent, the check, the result and the decision? If not, fix the logging before you scale the check.