GOV.UK Digital Identity Wallet App – Privacy and Cybersecurity considerations

Many people struggle with carrying and keeping track of multiple physical identification documents, which can be easily lost or damaged. To address this issue, the GOV.UK Wallet (the Wallet) will launch in June 2025, as announced by Peter Kyle, the Secretary of State for Science, Innovation, and Technology. The Wallet will initially offer digital driving licenses and veteran cards, allowing users to verify their identity without physical documents. 

The Wallet will offer several features to enhance convenience and security for users. These include secure storage for government issued documents, identity verification without physical documents, and facial recognition checks to ensure that only authorized users can access the stored documents. Additionally, by the end of 2027, the wallet will expand to include additional documents like DBS checks and other government credentials, simplifying access to services and improving the security of personal information. 

Healthcare services such as the National Healthcare Services and the Driving Vehicle Licence Agency can benefit from the Wallet by enhancing the identification process, which will streamline access to services and improve data accuracy by reducing human error when completing forms. In financial services, such as HMRC, banks, and insurers, the Wallet can help reduce fraud, improve customer experience, and simplify identity checks. However, with new tools come new risks.  

This article looks at what healthcare and finance organisations need to know about the risks and regulations tied to the Wallet and aims to inform organisations on how to stay compliant while benefitting from these technologies. 

What is The GOV.UK Wallet app and what are the key benefits? 

The Wallet will make government-issued documents available on your phone, starting with a Veteran Card and an early version of a digital driver's license later this year.  

These new tools are part of a broader overhaul of how the public sector builds, uses, and funds technology projects. This follows a report identifying £45 billion in potential efficiency savings and outlines a plan to leverage technology to drive growth and deliver the Plan for Change. 

The primary goal of the Wallet is to allow individuals to prove their identity securely and access government services without relying on physical documents. The Government is seeking to offer individuals and organisations a user-friendly experience that aligns with contemporary digital practices, allowing individuals to have control over storage and sharing of their personal information. For example, according to the UK Government, the Wallet will be a secure digital platform which will enable individuals to save their driving licences, veteran cards and eventually passports and birth certificates. 

How does the Wallet work?  

Users can download the GOV.UK Wallet app, create a profile with their personal information, and complete a one-time verification process. This may involve submitting an ID, a photo, or a brief video for identity confirmation. 

Following this, once verified the user will be required to upload and store the documents online via a secure link which will enable the documents to be stored securely and encrypted on the device. To prove their identity at the bank, benefits application or GP appointment, the user will share the required information securely via QR code or direct integration with online system with the service provider (e.g., bank/ health care organisation).  

Microsoft Azure DevOps will likely play a role in the development and maintenance of the GOV.UK Wallet. The UK Government has a strategic partnership with Microsoft, which includes access to Azure cloud services. This partnership aims to support digital transformation and innovation across the public sector. Azure DevOps provides tools for continuous integration and delivery, project management, and collaboration, which are essential for developing secure and reliable applications like the Wallet. 

Data Protection and Cybersecurity considerations  

Although the UK government states that all identity data will be processed in line with the UK Data Protection Act 2018 and overseen by the Information Commissioner’s Office (ICO), privacy concerns remain. 

According to the ICO Digital Identity Position Paper, the use of facial recognition in public services such as health care must be transparent, proportionate and subject to regular oversight by a human, especially if verification fails.  

There are several Data protection concerns that will need to be considered, these include risks such as: 

• Loss of Sensitive Information: the Wallet may expose sensitive personal information, leading to privacy breaches. Unauthorised access to this data could allow attackers to create detailed profiles for identity theft and social engineering attacks. 

• Data Minimisation: the Wallet may collect more data than necessary this can include personal details, transaction histories, and even location data. This excessive data collection increases the risk of misuse or unauthorised access. 

The ICO guidelines emphasize the importance of securely storing and processing personal data, including biometrics and ID scans, to prevent unauthorised access and data breaches. 

In light of the data protection concerns shared above, guidance from the UK’s National Cyber Security Centre (NCSC) shared that digital identity applications, like the Wallet, should be  designed to protect user data and maintain high levels of security. Key aspects include: 

• Secure Authentication: The NCSC recommends robust authentication methods, such as multi-factor authentication (MFA), to ensure that only authorised users can access sensitive information 

• Regular Updates and Monitoring: Digital identity apps must be regularly updated and monitored to address emerging security threats and vulnerabilities such as spoofing attacks or malware. 

By adhering to these guidelines, organisations can create secure and reliable digital identity solutions that protect user privacy and comply with data protection laws. 

What steps should organisations follow to prepare for the Transformation?  

To successfully ensure data protection compliance while adopting the Wallet, organisations will need to consider key steps including:  

• Conducting a Gap Analysis: Evaluate your current identity verification systems to ensure they meet the Wallet's technical and compliance standards. This includes implementing secure APIs, integrating with government services, and ensuring compatibility with digital ID platforms for a seamless user experience. 

• Investing in Employee Training and Awareness: It is important that all employees are aware of how the Wallet operates, including how personal data will be verified, processed, and protected. 

• Data Protection: you should consider creating a clear communication strategy for internal teams and end users to ensure transparency about how data will be used. For example, by updating privacy notices in line with the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).  

• User support: you should provide users with the opportunity to seek access assistance when needed from a human.  

• Pilot testing: Finally, organisations should provide internal user testing team before the product goes live and address the related feedback. It is important to assess whether the systems organisations are compatible with the Wallet’s technical requirements and whether staff are prepared to handle new workflows. 

Our team offers guidance and technical support if your organisation is looking to adopt digital identity tools. Our Data Cyber Security team will be able to help you evaluate and manage risks associated with digital identity implementations. Here’s how this can be achieved:  

• Risk Assessment and Assurance: We assist organisations conduct robust risks assessments, focusing on privacy, security and ethical AI use in compliance with UK Data Protection Act and GDPR.  

• Scenario Planning and Impact Modelling: By using AI- driven analysis, we can simulate different deployment scenarios to highlight potential vulnerabilities and mitigation strategies before implementation.  

• Policy and Governance: Our team can help develop digital identity governance polices tailored to your needs ensuring alignment with legal, ethical and operational standards.  

• Training and Stakeholder Engagement: We offer workshops, training and strategic briefings to ensure successful adoption.  

If you would like to discuss our services, please contact our advisors.