Biometric Information Notice
As part of the PPAC product and services, we may capture biometric data as part of the data subject journey. This notice explains what happens to the biometric data you will use when completing an identity check using the PPAC application, what happens to that data, how long it will be retained for, where it is stored and the performance and security of the biometric testing to provide assurances to the person submitting their biometric data.
Who is responsible for the check
The organisation that asked you to complete the required identity check, usually your employer or your agency, acts as the data controller and has requested PPAC to conduct the check on their behalf. PPAC carries out the check on their instructions and is the data processor. Due to the nature of biometric data and the requirement for explicit consent at the point of collection, this biometric policy and consent box within the check is ensuring we meet our requirements under GDPR Article 9. PPAC as data processor does not have control or visibility over our Clients decision to pass or fail you, and should you have specific considerations regarding the outcome of your result we would request you to reach out to the organisation who requested the check.
What we collect and why
Through the PPAC product we collect a short selfie video and extract your facial geometry features/biometric template. We use it for two things: To confirm that a real person is present at the time of the check, rather than a photograph, a mask or a recording. And to compare your face with the photograph stored on the chip in your passport. This is to ensure the person being presented is who they say they are and can be authenticated for the reason of the check, verifying your identity against your provided identity documentation and conducting a liveness check as a fraud prevention mechanism.
How the comparison works
The comparison is one to one. Your selfie is compared with the single photograph held on your passport chip, and with nothing else. Your selfie is not compared against a database of faces, it is not used to search for you in any records, and it is not used to identify you to anyone else. PPAC utilises a third party vendor product, Regula, within our application to complete the check, however your data is not passed onto the third party and kept within PPAC.
Separately from the face comparison, the details from your passport are checked against fraud prevention records held by Cifas, a fraud prevention organisation whose members share data with each other to prevent fraud. That check includes checking whether you have been recorded as a victim of fraud, which is there to protect you.
Whether your selfie is used to train software
Your selfie is not used to train, test or develop face matching software, or any other artificial intelligence system and is not used for any purpose beyond what is described in this notice.
Where your selfie is stored
Your biometric data does not leave the United Kingdom and is stored in servers within the United Kingdom.
How long we keep it
2 years since last period of inactivity. The period runs from the date the result of your check is issued. When the period ends your selfie is deleted.
The technology we use, and how it has been tested
The check for a real, live person uses a component that has been independently tested against presentation attacks, meaning attempts to defeat the check using a photograph, a mask, a screen or a recording. That testing was carried out by iBeta, an independent laboratory, to Presentation Attack Detection Level 2 on 10 December 2025. This ensures the product has been tested against an advanced tier of biometric security and performance under a recognised international standard. Further detail on this and what this means for the security and performance of the biometric check can be found here.
If you cannot or do not want to use a selfie
There is no obligation for you to supply your biometric data however if you do not want to, you will need to stop this digital check and speak to the organisation that asked you to complete it. They will offer an alternative route to carry out a different Right to Work check, which usually means looking at your original documents in person, with no penalty or impact on your Right to Work. Choosing not to continue does not mean you do not have the right to work.
If you change your mind after the check
You can withdraw your consent at any time during the process up until the check for which the biometric data was taken has been completed, and ask us to delete your selfie at any time, at dpo@ppac.co.uk. You can at any point submit a data deletion request through to the same e-mail, as a data subject requests under GDPR.
Your rights, and who to contact
Because the organisation that asked for the check is the data controller, a request about your personal data, including asking for a copy of it or asking for it to be deleted, is made to them first, and PPAC will help them answer it. You can also contact PPAC's Data Protection Officer at dpo@ppac.co.uk. PPAC Solutions LTD is registered with the Information Commissioner's Office under registration number ZA207961. If you are unhappy with how your personal data has been handled, you can file a complaint to the Information Commissioner's Office.
If something goes wrong with your check
If you think the result of your check is wrong, or you need help because your identity has been misused, see [LINK: the PPAC support page carrying complaints, incident reporting and identity repair]. That page tells you how to ask us about your check and how to get support.
Biometric Data Security
PPAC ensures all personal data including biometric data within our product and our vendors is done so to a high industry standard and commitment to this through our certifications in ISO 27001 and Cyber Essentials. PPAC ensures appropriate security measures and data protection controls are in place regarding your personal data.
Other Requests and Privacy Notice
If you would like any further information regarding our privacy practices and data protection controls, such as how to exercise your rights, make a complaint/dispute, or to request further information please see our Privacy Notice {Link to Product PN on website}
Changes to this notice
We review this notice regularly. If we start using your selfie for anything new, or we change the organisations that help us carry out the check, we will tell you before we make the change. The version and date at the top of this notice tell you which version applied when you took your check.
If something has not gone as you expected with PPAC Solutions LTD, we want to hear about it. You can complain by email to info@ppac.co.uk, describing what happened. There is no charge, and no one will be treated less favourably for making a complaint.
What happens next
We acknowledge your complaint within 3 business days and assess it within 3 business days. Where an investigation is needed it begins within 5 business days, we update you at least every 10 business days, and we aim to resolve your complaint within 20 business days where practicable. If we need more time, we will tell you why, what progress we have made and when we now expect to finish.
If you are not satisfied
You can ask for your complaint to be treated as a dispute. It will then be handled by our Chief Operating Officer, with oversight by our Chief Executive Officer, and we will give you our final response in writing. Other routes open to you
If you are not happy with our final response, you can take things further.
About your personal data. You can complain to the Information Commissioner's Office, the UK's independent regulator for data protection. You can do this at any time and you do not have to wait for us to finish. The ICO does ask you to give an organisation the chance to deal with your complaint first, so it is usually quicker to come to us before you go to them. You can find out how at ico.org.uk/make-a-complaint.
Where your check was requested by an employer or agency, that organisation is responsible for deciding that the check happens and for the personal data involved, so you can also raise a data protection concern directly with them.
About your right to work. Your employer, not PPAC, decides what to do with the result of a check and is responsible for confirming your right to work. If you are concerned about how a result is being used, or you need your right to work confirmed another way, speak to your employer. They can check your right to work using the other methods the law allows.
Please tell us if something has gone wrong. That includes anything you think might be a security or fraud problem, anything suggesting that someone else has used your identity or your details, and anything that stops the service working, such as the app being unavailable or a check failing again and again.
Email us at info@ppac.co.uk. Tell us what happened, when you noticed it, and how we can reach you. If you think someone has used your identity, please say so in the subject line so that we can treat it accordingly.
What we do with your report
We record every report we receive and assess it to establish what has happened, how serious it is and who needs to deal with it. We then act to contain the problem, put it right, and keep you informed while we do. Afterwards we look at what caused it, so that the same thing does not happen again.
Where a report involves personal data from an identity check, we also tell the organisation that asked for that check. That organisation is responsible for your personal data under data protection law, and we support it in meeting its own obligations, including telling the Information Commissioner's Office or telling you where the law requires that.
You do not need to decide whether something is a complaint or an incident. Tell us what happened and we will deal with it the right way.
Identity repair means getting back the use of your own identity after someone else has used it.
Contact us if you think someone has used your identity, your documents or your details to complete a check with us, or if you have been told that a check was carried out in your name that you took no part in.
Email info@ppac.co.uk and put "identity repair" in the subject line.
We will look into what happened and talk it through with you. We will tell you what you can do straight away to protect yourself, who else you should tell and how to report the fraud, and where to get independent support. Where we can confirm that your identity was misused, and you ask us to, we can give you evidence of that to help you put things right with other organisations.
You do not need to have a complaint, or to have finished a check with us, to contact us about this.
Nothing. There is no fee for you to use PPAC's identity verification service. The organisation that asked you to complete the check, usually your employer or your agency, pays for it.
You will never be asked for payment details as part of a check. If anyone asks you to pay to complete a PPAC check, it is not us, and we would like to know. Email info@ppac.co.uk.
This statement explains how PPAC Solutions LTD makes money from its identity verification service. We publish it separately from our terms and conditions so that it is easy to find.
We make money by charging organisations for access to the service. Employers, agencies and contractors pay PPAC a subscription or licence fee to use it, and that fee is what funds the service.
We do not charge you anything, and we do not make money from you or from your personal data. In particular: we do not sell, rent or otherwise share your personal data with anyone for their own commercial purposes; we do not use your personal data, your identity documents or your face image for advertising or marketing; and we are not paid by anyone to reach a particular outcome on a check. The outcome is produced automatically, the same rules apply to every check, and no fee we receive depends on the result.