--- title: "Keep identity document scans apart and ยท Agent Wranglers" url: https://agentwranglers.se/playbook/accounts/bank-and-government-id/identity-documents id: ACC-81 level: Required applies: eu-users region: EU risk: law updated: 2026-10-27 build: a2a6bdfed830 tokens: 842 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Keep identity document scans apart and delete them after the check For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Bank and government ID](https://agentwranglers.se/playbook/accounts/bank-and-government-id.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27. - ID: ACC-81 - Level: Required - Chapter: [Bank and government ID](https://agentwranglers.se/playbook/accounts/bank-and-government-id.md) - Rule: Store scans of passports, ID cards and driving licences in their own private bucket, with its own key, readable by one role. Make no copies of them. Delete each scan within 24 hours of the check, unless a law you are under requires a copy. - Check: Upload a test ID scan on staging and pass the check. Within 24 hours the object is gone from the bucket, and no thumbnail, trash or CDN copy of it exists. A read of the bucket with the app's normal role is refused. - Risk: A law broken - Applies when: The project has users in the EU. - Region: European Union (EU). The duty comes from the law there. The rule applies only when the project serves people there, and its Applies when also holds. - How: A leaked ID scan lets anyone open accounts in that person's name, and nobody can change a passport like a password. GDPR Article 5 limits data to what the purpose needs and keeps it no longer. Once a check has passed, the result, the date and the document type are often enough. Mark this upload kind in [Define each kind of upload once](https://agentwranglers.se/playbook/files-and-media/uploads/upload-kinds.md), so the image pipeline, the CDN and the trash bin never touch it. Encrypt the bucket with its own key, as [Encrypt the most sensitive fields](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/field-encryption.md) does for columns. Where a law requires a copy, such as anti-money-laundering rules, keep it for that period only and record it in the [retention schedule](https://agentwranglers.se/playbook/compliance/records-and-data-map/retention-schedule.md). ## Sources - [GDPR Article 5 on principles of processing](https://eur-lex.europa.eu/eli/reg/2016/679/oj) ## Related rules - MED-1 [Define each kind of upload once](https://agentwranglers.se/playbook/files-and-media/uploads/upload-kinds.md) in Files and media - APS-58 [Encrypt the most sensitive fields](https://agentwranglers.se/playbook/application-security/cryptography-and-keys/field-encryption.md) in Application security - CMP-11 [Keep one retention schedule](https://agentwranglers.se/playbook/compliance/records-and-data-map/retention-schedule.md) in Compliance and governance **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers accounts and identity playbook`. In code you write, add a comment next to it with the same link. - Previous: [Keep national ID numbers out of your data](https://agentwranglers.se/playbook/accounts/bank-and-government-id/national-id-numbers.md) - [Bank and government ID](https://agentwranglers.se/playbook/accounts/bank-and-government-id.md)