The venue is the data controller when it scans ID at the door. Under UK GDPR the controller is the organisation that determines the purposes and means of processing, and it is the nightclub that decides to scan, what to capture, why and for how long. The company that supplies the scanner and stores the data on the venue’s instructions is usually a processor. A licence condition that requires scanning does not move that responsibility to the licensing authority, the police or the vendor.
The venue decides, so the venue is the controller
A controller determines the purposes and means of the processing; a processor processes personal data on behalf of the controller and acts only on its instructions unless the law requires otherwise. Controllers are ultimately responsible for the processing and must be able to demonstrate compliance; processors have more limited duties. The ICO’s biometric guidance applies the same test to a venue buying a recognition system: the venue is the controller, the system provider its processor. A vendor that sets its own purposes for the scans, for example by pooling records across venues for its own use, becomes a controller for that processing.
Whenever a controller uses a processor there must be a written contract with the Article 28(3) terms: documented instructions, confidentiality, security, sub-processor rules, help with individuals’ rights, deletion or return at the end, and audit rights.
ID scanning is not a mandatory licensing condition. The Schedule to the Licensing Act 2003 (Mandatory Licensing Conditions) Order 2010 contains four: irresponsible promotions, free drinking water, an age verification policy and smaller measures. Where scanning is required, it is a condition on the individual premises licence.
Why a licence condition is rarely consent
The ICO lists seven lawful bases, says none is always better than the others, and expects the basis to be settled before processing starts and stated in the privacy information. Consent fits a door scan worst. The ICO says consent is inappropriate where the organisation would still process the data on another basis if consent were refused, where there is a clear imbalance of power, or where consent is a precondition of a service, because there is no genuine choice. A person who cannot enter without being scanned is not consenting.
Two bases do fit. Legal obligation applies where processing is necessary to comply with a common law or statutory obligation, not a contractual one; the ICO asks the controller to identify the specific legal provision or an appropriate source of guidance and to document the decision. Where a premises licence condition requires scanning, the condition and the licence it sits on are that provision. Where scanning is the venue’s own choice, legitimate interests is the usual fit: the ICO calls it the most flexible basis, apt where data is used in ways people would reasonably expect with minimal privacy impact, or with a compelling justification. It carries a three-part test of purpose, necessity and balancing, recorded in a legitimate interests assessment.
Minimise, retain for a reason, then delete
Data minimisation requires personal data to be adequate, relevant and limited to what is necessary. The ICO asks controllers to identify the minimum personal data needed for the purpose, hold that much and no more, and not collect data on the off-chance it might be useful later. A full image of a passport page captures a document number, nationality and place of birth that an entry check does not need; keeping only the name, date of birth and photograph, or only a pass or fail against the policy age, is the principle applied.
Storage limitation requires data to be kept no longer than necessary. The UK GDPR sets no specific time limits; the controller must justify how long it keeps data, needs a policy setting standard retention periods wherever possible, and periodically erases or anonymises what it no longer needs. A retention period for door scans is therefore a decision the venue writes down, tied to the purpose, such as the period a banning policy or incident investigation needs, not a default the scanner shipped with.
Biometrics trigger a DPIA and usually explicit consent
The ICO describes biometric recognition as the automated recognition of people from their biological or behavioural characteristics, covering both identification (one-to-many) and verification (one-to-one). Because the purpose is to uniquely identify someone, the biometric data involved is special category data. A photograph on its own is not biometric data. A scanner that reads the document and stores the photo for a human to look at is not a recognition system; one that compares the holder’s face with the document photo, or with a banned list, is.
For a recognition system the ICO is direct: a DPIA must be completed before the system is used. The DPIA guidance lists biometric processing, decisions affecting access to a service and the novel application of existing technologies among the triggers. The venue also needs an Article 9 condition alongside its lawful basis; the ICO says explicit consent is likely to be the most appropriate, with a suitable alternative for people who choose not to consent. A face match at the door therefore comes with a non-biometric route in, usually a manual check of the document.
The notice at the door and requests from the police
Privacy information is provided when the data is collected, actively, not left on a website. For a door scan the ICO’s list runs to the venue’s identity and contact details, the purposes, the lawful basis and any legitimate interests, who receives the data, retention periods, the individual’s rights, the right to complain to the ICO, and whether providing the data is a legal or contractual requirement. The ICO’s layered approach fits the door: a short sign at the scanner, a line on screen, and the full notice from staff and online.
Police requests are a separate decision each time. The ICO says data protection law allows sharing with law enforcement where necessary and proportionate, does not force disclosure unless a court order or other legal obligation applies, and still requires an Article 6 basis, documented, with only what is adequate, relevant and limited to the purpose shared. Paragraph 2 of Schedule 2 to the Data Protection Act 2018 lifts some transparency and rights obligations where applying them would be likely to prejudice the prevention, investigation or detection of crime or the apprehension or prosecution of offenders; the ICO stresses it is not a blanket exemption.
What VenueOra does here
A check before arrival on the guest’s own phone changes the picture in three ways. VenueGo, a verification platform designed for venues, provides age verification on the guest’s phone: at sign-up or ticket purchase the guest captures their face, then the document, then a photo holding it; the venue receives approved, declined or needs review; images are deleted after 30 days unless a review is open; processing runs in London and data is stored in the UK. First, no device at the door holds copies of documents. Second, retention is fixed at 30 days and applied automatically, a definite figure for the venue’s retention policy. Third, because the capture includes the guest’s face alongside the document, the ICO’s biometric guidance applies as it would to a face-matching scanner: a DPIA before use, an Article 9 condition and an alternative for guests who decline. The venue remains the controller and the check runs under a data processing agreement. The guides on Challenge 25 at events and festivals and digital proof of age for alcohol sales cover the licensing side for the nightclub and bar stack. The ICO guidance cited is current as of October 2026; the ICO notes its biometric guidance is under review after the Data (Use and Access) Act 2025.
VenueGo reads the document in the camera. It does not look up DVLA, the passport office, or any other government database, and it does not read a passport chip. A clear result is not proof a document is genuine. It does not replace a premises licence, a challenge at the bar, or legal advice.
This page describes how VenueOra’s products handle card data, personal data and age checks. It is not legal advice. Your premises licence conditions and your own data protection assessment take precedence.
Sources
- What are controllers and processors? (ICO)
- When is a contract needed and why is it important? (ICO)
- Licensing Act 2003 (Mandatory Licensing Conditions) Order 2010, Schedule
- A guide to lawful basis (ICO)
- When is consent appropriate? (ICO)
- Legal obligation (ICO)
- Legitimate interests (ICO)
- Principle (c): Data minimisation (ICO)
- Principle (e): Storage limitation (ICO)
- Biometric recognition (ICO)
- How do we demonstrate our compliance? (ICO biometric data guidance)
- How do we process biometric data lawfully? (ICO)
- When do we need to do a DPIA? (ICO)
- Right to be informed (ICO)
- Sharing personal data with law enforcement authorities (ICO)
- Data Protection Act 2018, Schedule 2, paragraph 2