How to Ask a Company to Delete a Copy of Your ID or Passport

← All posts

Write to the company, list the copies of your ID or passport you gave it (when and what for), ask it to delete them and any copies made from them, and ask it to confirm in writing. In the EU, the GDPR gives you a right to have data erased once it is no longer needed, and the company must answer within one month, normally free of charge. In Switzerland, the Data Protection Act works differently, but the result is close: data that is no longer needed must be destroyed, and a company that keeps your copy against your clearly stated wish needs a reason the law accepts.

The main exception is a law that obliges the company to keep the copy, as anti-money-laundering law does for banks. Below are the rules in each place, a request you can copy and what to do if nobody answers. This is general information, not legal advice.

In the EU: the right to erasure

Article 17 of the GDPR says a company must erase your personal data “without undue delay” when one of several grounds applies. For an ID copy, three matter most: the data is no longer necessary for the purpose it was collected for, you withdraw the consent it was based on (and there is no other legal ground), or it was processed unlawfully. A copy taken to check you in or rent you a car has usually done its job once the stay or the rental is over.

The rules for answering are in Article 12:

• One month. The company must tell you what it has done without undue delay and at the latest within one month. For complex or numerous requests it may take two more months, but it must tell you so, with reasons, within the first month.
• Free. Only a request that is “manifestly unfounded or excessive”, for example because it is repeated, may be charged for or refused, and the company has to show that it is.
• Proof of identity only when in doubt. The company may ask for more information to confirm who you are only if it has reasonable doubts.

And under Article 19, a company that passed your data on must pass the erasure on to each recipient too, unless that is impossible or takes disproportionate effort, and tell you who they are if you ask.

When a company may keep your copy

Article 17 has exceptions. The two you are most likely to meet: the company must keep the data to comply with a legal obligation under EU or national law, or it needs it to establish, exercise or defend legal claims. If it refuses for such a reason, it is fair to ask which law requires it, for how long, and that the copy be deleted when that period ends.

Banks are the clearest case. Germany’s anti-money-laundering act is one example from the EU: it gives banks and other obliged businesses the right and the duty to copy the document you identify yourself with, to keep those records for five years, and to destroy them after ten years at the latest. Switzerland’s Anti-Money Laundering Act requires financial intermediaries to identify you from a document with evidential value and to keep the records of those checks for at least ten years after the business relationship ends.

Hotels are a different story, at least under Swiss federal law. The rule for registering foreign guests has the host fill in a registration form from your identity papers, have you sign it and send it to the cantonal authority. It speaks of showing your document, not of keeping a copy (cantons can add rules of their own). Our guide to sharing a copy of your ID safely covers when a copy is needed in the first place.

In Switzerland: the same request, a different route

The revised Federal Act on Data Protection (FADP, in German DSG) has been in force since 1 September 2023. It has no article that works like Article 17 of the GDPR, with a list of grounds and a one-month deadline. Your request rests on three things instead:

• The principles in Article 6. Personal data may only be collected for a purpose you can recognise, and it is destroyed or anonymised as soon as it is no longer needed for that purpose.
• Your stated wish, in Articles 30 and 31. Processing data against the express wishes of the person concerned breaches their personality rights, and that is unlawful unless justified by consent, an overriding private or public interest, or the law. A written “please delete my ID copy” is such an express wish.
• The courts, in Article 32. If the company will not act, you can ask a court, among other things, to have the data deleted or destroyed.

The 30-day deadline you may have read about belongs to the right of access (Article 25), the request to see what data a company holds about you. For deletion, the law sets no fixed deadline. Still, the Federal Data Protection and Information Commissioner (FDPIC) says people asking for access, correction or deletion do not have to give a reason, and it publishes a model letter for such requests.

The GDPR, for its part, applies to companies established in the EU and to some outside it, for example when they offer goods or services to people in the EU. For a hotel, landlord or employer in Switzerland, the Swiss act is normally the one to cite.

If they refuse or do not answer

In the EU, a company that does not act on your request must tell you so within one month, with its reasons, and tell you that you can complain to a supervisory authority and go to court. Article 77 gives you the right to complain to a data protection authority, in particular in the country where you live, where you work or where the problem happened.

In Switzerland, the FDPIC can open an investigation when there are sufficient signs of a significant breach, and it can order a company to delete data. But it says itself that it cannot exercise your rights for you: someone who reports a case has no right to make it act and is not a party to the proceedings. It asks you to contact the company first and to describe the steps you took. To have your own claim decided against a private company, the route is the civil court, and the FDPIC notes that no court costs are charged in disputes under the Data Protection Act.

A request you can copy

This is the text our app ID-Shield writes for you. Fill in the brackets, one line per copy. The reference is the tracing code the app prints on each copy; leave it out if you made your copy another way.

Subject: Request to delete copies of my identity document

Hello [company],

I previously gave you copies of my identity document:

• [date]: [document], purpose “[purpose]”, reference [code]

Under Article 17 of the GDPR (right to erasure), please delete these copies and any copies made from them, unless you are legally required to keep them, and confirm the deletion in writing.

Thank you.

For a company in Switzerland, replace the sentence that starts “Under Article 17” with something like: “Under the Swiss Federal Act on Data Protection, personal data must be destroyed once it is no longer needed for its purpose (Art. 6 para. 4). I do not consent to you keeping these copies. Please delete them and any copies made from them, unless you are legally required to keep them, and confirm the deletion in writing.”

• Ask in writing, to the data protection contact in the company’s privacy policy if there is one. A registered letter is your proof if you ever need it.
• Keep the request and the reply, and note the date you sent it: in the EU, the month starts there.
• Do not send a fresh full copy to prove it is you. For requests by post, the FDPIC says you can usually black out your height, photo and document number, as long as your name and date of birth stay readable.
• Keep a list of who has your ID. You cannot ask for a copy to be deleted if you have forgotten who has it.

Where ID-Shield comes in

That last habit is the one ID-Shield takes care of. Every protected copy you make is kept in History with its purpose, recipient, date and tracing code. Switch History to Recipients, the app’s “Who Has My ID”, and you see everyone who has a copy. Open one and you get each copy they have and two buttons: Request Deletion opens the share sheet with the request above already written, ready to send by e-mail or message, and Copy Request Text puts it on the clipboard. The app’s text cites the GDPR, so for a company in Switzerland, edit that sentence before you send it.

By default, each copy carries its own tracing code, such as IDS-7F3K9, with a QR code in the corner, and the watermark across it reads purpose, recipient, date and code. If a copy turns up where it should not, search History for the code to see who you gave it to. Before you share, Smart Redact blacks out what the recipient does not need, with presets such as Swiss ID / Passport or Passport for Check-in.

ID-Shield is for iPhone, iPad and Mac, on the App Store only. Your first protected copy is free; after that, a one-time purchase unlocks unlimited copies, with no subscription. Protecting a copy straight from the share sheet in Photos, Files or Mail, on iPhone and iPad, needs the purchase.