ID copies: show only what is needed

A nurse in Winterthur is applying for a flat. The application form asks for name, income and an extract from the debt enforcement register; at the bottom it says: “Please enclose a copy of your identity card.” They photograph the card on the kitchen table, front and back, and attach the two pictures. In the evening they wonder whether that was necessary — and what exactly they actually sent.

An ID copy is often requested and rarely looked at closely. Yet with little effort, you can control what it shows.

What is on the identity card

The Identity Documents Act (IDA) sets out which data every Swiss identity document must contain:

Detail	What it is used for
Official surname, given names	Identification
Date of birth	Identification
Sex, nationality	Part of the personal details
Place of origin	Part of the personal details
Height	Matching with the person
Signature, photograph	Matching with the person
Issuing authority, date of issue and expiry	Validity of the document
Document number and type	Identifier of the document

Some of this data also appears on the document in machine-readable form (Art. 2 IDA) — in the lines of letters, digits and the “<” character on the back. Anyone who covers the front but sends the back in full has therefore passed on part of the details after all.

When a copy is requested

For rented flats, the FDPIC has published a dedicated information sheet. In it, the FDPIC states: an ID copy, such as of the identity card or the residence permit, may only be requested once the applicant has been finally chosen and the tenancy agreement is to be drawn up — provided the documents are suitable for verifying the details on the application form.

Behind this is the principle that personal data is only processed to the extent that is proportionate to the purpose (Art. 6 para. 2 FADP). For the nurse in Winterthur, this means: with the first form, they can ask whether the copy is already needed now, or only once the flat is offered to them.

Other occasions have their own rules. Anyone reading up at the FDPIC on how to request access to their own data will find the advice to enclose a copy of an official identity document with a written access request. The controller must take appropriate measures to identify the person (Art. 16 para. 5 DPO).

What can be made illegible

For the access request, the FDPIC explicitly describes what can be covered: data that is not strictly necessary for identification — for example height, photo and document number — can generally be made illegible. Name and date of birth should remain readable; further data such as the address may be needed. And the controller may only use the data on the document for identification.

This statement refers to the right of access. The thinking behind it can, however, be applied to other cases: whoever knows what the copy is for can ask which details are really needed for it.

Why an ID copy is sensitive

In its guide on data security breaches, the FDPIC names the loss of copies of identity documents as an example of data that can mean a high risk, even though it is not sensitive personal data. A copy with photo, signature and document number is more useful to someone who wants to pass themselves off as another person than a name alone.

This is no reason to worry about every copy, but a good reason to keep every copy as limited as the purpose allows.

Residence permits and other documents

Not everyone looking for a flat in Switzerland has a Swiss identity card. The FDPIC’s information sheet on rented flats addresses this too: the question about the residence permit already answers whether someone is from Switzerland or from abroad; a further interest in knowing the nationality as early as the first selection round is not apparent. Here too, the copy of the permit belongs at the moment the tenancy agreement is drawn up.

For the access request, the FDPIC names the driving licence alongside the identity card as a possible official identity document. Where a body only wants to verify identity, a document with fewer details may be enough.

Making the copy clean

A photo of the identity document becomes, in a few steps, a copy that shows what it is meant to show:

1. Crop. Only the card, without kitchen table, post or screen in the background.
2. Cover. Give the details that are not needed for the purpose an opaque patch that is fixed in the image — not as an annotation that can be removed again.
3. Remove metadata. A photo from a phone can contain the place where it was taken — for a picture of the kitchen table, that is your own address.
4. Shrink. A readable copy does not need ten megabytes.

Some people also add a short note to the copy, such as “Copy for tenancy agreement, flat Seenerstrasse, 9/2026”. This records what the copy was intended for.

The copy’s path

Sending it deserves a thought as well. A copy sent as an email attachment then sits in at least two mailboxes, often for years. An upload field in a form that states who sees the file and when it is deleted is clearer for both sides. What matters with such fields is described in the post File uploads in forms.

For businesses that request copies

There are decisions on the other side too. The FDPIC’s information sheet on rented flats states that once the tenancy agreement has been signed, the application forms of the other applicants, including attachments, are to be destroyed, unless there is a particular justification. In general, personal data is destroyed or anonymised as soon as it is no longer needed for the purpose (Art. 6 para. 4 FADP).

For a business, three questions therefore arise: what is the copy needed for? At what point? And when is it deleted again? Writing the answers next to the upload field or into the request makes things easier for both sides.

For the nurse in Winterthur

With the next form, they go about it differently. They ask the property management whether the copy is already needed for the application. When they get the flat, they send a cropped copy of the front, with height and document number covered, without metadata and with a note of what it is intended for.

The image tools we are building will crop, shrink, convert and strip metadata from images — processed in Switzerland, in memory, without any image being kept. For identity documents and other private documents, confidential mode will do this work entirely on your own device.