# Nightclub ID scanning and the data controller

> Who the data controller is when a nightclub scans ID, which lawful basis fits, how long to keep scans, when a DPIA is needed and what police requests require.

Canonical page: https://venueora.com/guides/nightclub-id-scanning-data-controller

Updated 30 October 2026. Author: Warren Doyle, VenueOra Ticketing Limited.

The venue is the data controller when it scans ID at the door. Under UK GDPR the controller is the organisation that determines the purposes and means of processing, and it is the nightclub that decides to scan, what to capture, why and for how long. The company that supplies the scanner and stores the data on the venue's instructions is usually a processor. A licence condition that requires scanning does not move that responsibility to the licensing authority, the police or the vendor.

## The venue decides, so the venue is the controller

A controller determines the purposes and means of the processing; a processor processes personal data on behalf of the controller and acts only on its instructions unless the law requires otherwise. Controllers are ultimately responsible for the processing and must be able to demonstrate compliance; processors have more limited duties. The ICO's biometric guidance applies the same test to a venue buying a recognition system: the venue is the controller, the system provider its processor. A vendor that sets its own purposes for the scans, for example by pooling records across venues for its own use, becomes a controller for that processing.

Whenever a controller uses a processor there must be a written contract with the Article 28(3) terms: documented instructions, confidentiality, security, sub-processor rules, help with individuals' rights, deletion or return at the end, and audit rights.

ID scanning is not a mandatory licensing condition. The Schedule to the Licensing Act 2003 (Mandatory Licensing Conditions) Order 2010 contains four: irresponsible promotions, free drinking water, an age verification policy and smaller measures. Where scanning is required, it is a condition on the individual premises licence.

## Why a licence condition is rarely consent

The ICO lists seven lawful bases, says none is always better than the others, and expects the basis to be settled before processing starts and stated in the privacy information. Consent fits a door scan worst. The ICO says consent is inappropriate where the organisation would still process the data on another basis if consent were refused, where there is a clear imbalance of power, or where consent is a precondition of a service, because there is no genuine choice. A person who cannot enter without being scanned is not consenting.

Two bases do fit. Legal obligation applies where processing is necessary to comply with a common law or statutory obligation, not a contractual one; the ICO asks the controller to identify the specific legal provision or an appropriate source of guidance and to document the decision. Where a premises licence condition requires scanning, the condition and the licence it sits on are that provision. Where scanning is the venue's own choice, legitimate interests is the usual fit: the ICO calls it the most flexible basis, apt where data is used in ways people would reasonably expect with minimal privacy impact, or with a compelling justification. It carries a three-part test of purpose, necessity and balancing, recorded in a legitimate interests assessment.

## Minimise, retain for a reason, then delete

Data minimisation requires personal data to be adequate, relevant and limited to what is necessary. The ICO asks controllers to identify the minimum personal data needed for the purpose, hold that much and no more, and not collect data on the off-chance it might be useful later. A full image of a passport page captures a document number, nationality and place of birth that an entry check does not need; keeping only the name, date of birth and photograph, or only a pass or fail against the policy age, is the principle applied.

Storage limitation requires data to be kept no longer than necessary. The UK GDPR sets no specific time limits; the controller must justify how long it keeps data, needs a policy setting standard retention periods wherever possible, and periodically erases or anonymises what it no longer needs. A retention period for door scans is therefore a decision the venue writes down, tied to the purpose, such as the period a banning policy or incident investigation needs, not a default the scanner shipped with.

## Biometrics trigger a DPIA and usually explicit consent

The ICO describes biometric recognition as the automated recognition of people from their biological or behavioural characteristics, covering both identification (one-to-many) and verification (one-to-one). Because the purpose is to uniquely identify someone, the biometric data involved is special category data. A photograph on its own is not biometric data. A scanner that reads the document and stores the photo for a human to look at is not a recognition system; one that compares the holder's face with the document photo, or with a banned list, is.

For a recognition system the ICO is direct: a DPIA must be completed before the system is used. The DPIA guidance lists biometric processing, decisions affecting access to a service and the novel application of existing technologies among the triggers. The venue also needs an Article 9 condition alongside its lawful basis; the ICO says explicit consent is likely to be the most appropriate, with a suitable alternative for people who choose not to consent. A face match at the door therefore comes with a non-biometric route in, usually a manual check of the document.

## The notice at the door and requests from the police

Privacy information is provided when the data is collected, actively, not left on a website. For a door scan the ICO's list runs to the venue's identity and contact details, the purposes, the lawful basis and any legitimate interests, who receives the data, retention periods, the individual's rights, the right to complain to the ICO, and whether providing the data is a legal or contractual requirement. The ICO's layered approach fits the door: a short sign at the scanner, a line on screen, and the full notice from staff and online.

Police requests are a separate decision each time. The ICO says data protection law allows sharing with law enforcement where necessary and proportionate, does not force disclosure unless a court order or other legal obligation applies, and still requires an Article 6 basis, documented, with only what is adequate, relevant and limited to the purpose shared. Paragraph 2 of Schedule 2 to the Data Protection Act 2018 lifts some transparency and rights obligations where applying them would be likely to prejudice the prevention, investigation or detection of crime or the apprehension or prosecution of offenders; the ICO stresses it is not a blanket exemption.

## What VenueOra does here

A check before arrival on the guest's own phone changes the picture in three ways. VenueGo, a verification platform designed for venues, provides [age verification on the guest's phone](https://venueora.com/age-verification): at sign-up or ticket purchase the guest captures their face, then the document, then a photo holding it; the venue receives approved, declined or needs review; images are deleted after 30 days unless a review is open; processing runs in London and data is stored in the UK. First, no device at the door holds copies of documents. Second, retention is fixed at 30 days and applied automatically, a definite figure for the venue's retention policy. Third, because the capture includes the guest's face alongside the document, the ICO's biometric guidance applies as it would to a face-matching scanner: a DPIA before use, an Article 9 condition and an alternative for guests who decline. The venue remains the controller and the check runs under a [data processing agreement](https://venueora.com/legal/data-processing-agreement). The guides on [Challenge 25 at events and festivals](https://venueora.com/guides/challenge-25-at-events-and-festivals) and [digital proof of age for alcohol sales](https://venueora.com/guides/digital-proof-of-age-alcohol-sales) cover the licensing side for the [nightclub and bar stack](https://venueora.com/industries/nightclubs-bars). The ICO guidance cited is current as of October 2026; the ICO notes its biometric guidance is under review after the Data (Use and Access) Act 2025.

VenueGo reads the document in the camera. It does not look up DVLA, the passport office, or any other government database, and it does not read a passport chip. A clear result is not proof a document is genuine. It does not replace a premises licence, a challenge at the bar, or legal advice.

This page describes how VenueOra's products handle card data, personal data and age checks. It is not legal advice. Your premises licence conditions and your own data protection assessment take precedence.

## Sources

- [What are controllers and processors? (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/)
- [When is a contract needed and why is it important? (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/when-is-a-contract-needed-and-why-is-it-important/)
- [Licensing Act 2003 (Mandatory Licensing Conditions) Order 2010, Schedule](https://www.legislation.gov.uk/uksi/2010/860/schedule)
- [A guide to lawful basis (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/)
- [When is consent appropriate? (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/when-is-consent-appropriate/)
- [Legal obligation (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/legal-obligation/)
- [Legitimate interests (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/legitimate-interests/)
- [Principle (c): Data minimisation (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/data-minimisation/)
- [Principle (e): Storage limitation (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-protection-principles/a-guide-to-the-data-protection-principles/storage-limitation/)
- [Biometric recognition (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/biometric-data-guidance-biometric-recognition/biometric-recognition/)
- [How do we demonstrate our compliance? (ICO biometric data guidance)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/biometric-data-guidance-biometric-recognition/how-do-we-demonstrate-our-compliance-with-our-data-protection-obligations/)
- [How do we process biometric data lawfully? (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/biometric-data-guidance-biometric-recognition/how-do-we-process-biometric-data-lawfully/)
- [When do we need to do a DPIA? (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/when-do-we-need-to-do-a-dpia/)
- [Right to be informed (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-be-informed/)
- [Sharing personal data with law enforcement authorities (ICO)](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/sharing-personal-data-with-law-enforcement-authorities/)
- [Data Protection Act 2018, Schedule 2, paragraph 2](https://www.legislation.gov.uk/ukpga/2018/12/schedule/2/paragraph/2)

## Questions

Q: Who is the data controller when a nightclub scans ID at the door?
A: The venue. It decides to scan, what to capture, why and for how long, which is what determining the purposes and means of processing means under UK GDPR. The scanner supplier that stores and processes the data on the venue's instructions is usually a processor and needs a written contract with the Article 28 terms. A supplier that uses the scans for its own purposes, such as pooling records across venues, becomes a controller for that processing.

Q: Is consent the right lawful basis for ID scanning on the door?
A: Usually not. The ICO says consent is inappropriate where the venue would scan anyway on another basis, where there is a clear imbalance of power, or where the scan is a precondition of entry, because the person has no genuine choice. Legal obligation fits where a premises licence condition requires scanning; legitimate interests fits where scanning is the venue's own choice, with a recorded three-part assessment. Explicit consent still matters as the Article 9 condition if the scanner uses facial matching.

Q: How long can a nightclub keep scanned ID data?
A: As long as it can justify and no longer. UK GDPR sets no fixed period, so the venue sets a standard retention period in a written policy tied to the purpose, such as the time a banning policy or incident investigation needs, reviews the data periodically and erases or anonymises what it no longer needs. A default built into the scanner is not a justification. Individuals have a right to erasure once the data is no longer needed.

Q: Does a nightclub need a DPIA for an ID scanner?
A: If the scanner performs biometric recognition, yes: the ICO says a DPIA must be completed before a biometric recognition system is used. That covers a scanner that compares the holder's face with the document photo or a banned list. A scanner that only reads the document and stores a photograph for a human to look at is not a recognition system, though the ICO's DPIA criteria on denial of service and new technology may still apply, so a screening assessment is the usual first step.

Q: What has to be on the privacy notice at the nightclub door?
A: The venue's identity and contact details, the purposes, the lawful basis and any legitimate interests, who receives the data, how long it is kept, the individual's rights, the right to complain to the ICO, and whether providing the data is a legal or contractual requirement. The ICO expects the information at the time of collection, actively provided, and accepts a layered approach: a short sign at the scanner, a line on screen, and the full notice from staff or online.

Q: Can a nightclub hand scanned ID data to the police?
A: It can where sharing is necessary and proportionate, and it must where a court order or other legal obligation applies. Otherwise the ICO says the venue chooses, with an Article 6 lawful basis identified and documented for each request, and shares only what is adequate, relevant and limited to the purpose. The crime exemption in Schedule 2 to the Data Protection Act 2018 relaxes some transparency duties only where meeting them would prejudice an investigation.

## Related pages

- Digital proof of age for alcohol sales in 2026: https://venueora.com/guides/digital-proof-of-age-alcohol-sales
- Challenge 25 at events and festivals: https://venueora.com/guides/challenge-25-at-events-and-festivals
- PCI DSS compliance for UK venues and attractions: https://venueora.com/guides/pci-dss-for-venues-and-attractions
- Age verification: https://venueora.com/age-verification