Keep national ID numbers out of your data

How to do it

Article 87 of the GDPR lets each country set its own conditions for national ID numbers. Sweden allows them without consent only when clearly justified by the purpose, the need for secure identification or another strong reason. A sign-in through BankID or a wallet often returns the number whether you need it or not. Use your own user ID and the broker's subject instead. When you must match people across systems, store a keyed hash and keep the key in a secret store. Write the reason for each stored number in the record of processing. Keep the numbers out of logs, as Keep personal data out of logs says.

Examples

Python example

import hashlib
import hmac

def id_number_match_key(id_number: str, key: bytes) -> str:
    digits = "".join(ch for ch in id_number if ch.isdigit())[-10:]
    return hmac.new(key, digits.encode(), hashlib.sha256).hexdigest()

JavaScript example

import { createHmac } from 'node:crypto'

export function idNumberMatchKey(idNumber, key) {
  const digits = idNumber.replace(/\D/g, '').slice(-10)
  return createHmac('sha256', key).update(digits).digest('hex')
}

How to check

Search the schema for columns that hold ID numbers. Each sits in the one allowed table and is encrypted or hashed. A test scans a day of logs and analytics events for the pattern of 10 or 12 digits with an optional dash, and finds none.

Sources

• GDPR Article 87

Related rules

• ACC-73 Offer BankID sign-in to Nordic users in Accounts and identity
• OPS-9 Keep personal data out of logs in Operations and observability