For many South African access-controlled sites, scanning a visitor’s ID document has become the default. It feels quick and familiar, but it can also create a large store of personal information that must be justified, protected, accessed responsibly and deleted when no longer needed.
The Information Regulator’s proposed conduct-code focus, as reported in May 2026, should prompt a basic review: if a less intrusive workflow can meet the same purpose, why are you still scanning and storing full ID documents for every visitor?
Why full-document scanning creates more risk
A smart ID card or ID book scan can contain much more than the minimum needed for a gate decision. It may include names, ID number, date of birth, photograph, document imagery and other details. Once stored, that information becomes your responsibility.
- You need a defensible reason for collecting and keeping it.
- You need security controls to prevent unauthorised access.
- You need clear retention periods and deletion procedures.
- You need to know whether guards, vendors or software providers can access the records.
- You need a plan for data subject requests, incidents and policy reviews.
Scanning may still be necessary in some workflows
This is not an argument that every ID scan is automatically unlawful or unnecessary. Some environments may have stronger legal, safety or operational reasons for document capture. The point is that the reason should be documented and proportionate to the purpose.
If your only purpose is to check whether the supplied 13-digit South African ID number follows the valid structure, a full scan may be more intrusive than required.
A lower-retention alternative
A structural validation workflow uses the ID number itself for a quick check, then avoids retaining the ID number or decoded result unless your own approved policy says retention is necessary. CheckID is designed around that privacy-conscious model.
- It checks that the ID number is exactly 13 digits after acceptable normalisation.
- It validates the encoded date and rejects impossible dates.
- It decodes age, gender encoding and citizenship indicator where supported by the ID format.
- It validates the checksum using the South African ID Luhn algorithm.
- It does not store, log or retain the ID number or decoded result on our servers. Your browser may keep a short local history of recent checks, which you can clear at any time.
Risk comparison: scanning versus minimal validation
| Question | Full ID scan | Minimal structural validation |
|---|---|---|
| How much data is collected? | Usually the document image and visible personal details. | Only the ID number needed for the structural check. |
| What must be retained? | Often a stored image or visitor record unless configured otherwise. | CheckID retains no ID number or decoded result on its servers. Your browser may store a short local history that you can clear. |
| Main compliance question | Can you justify and secure the full document copy? | Is a structural validation check sufficient for this purpose? |
| What it proves | That a document image was captured, not necessarily that identity was verified against a government database. | That the ID number structure, encoded fields and checksum are valid. |
Questions to ask your security provider
- Which visitor fields are collected at each access point?
- Which fields are mandatory, and why?
- Are ID document images, licence scans or CCTV clips linked to visitor records?
- How long are visitor records kept?
- Who can view, export or delete records?
- Can the process use a structural ID validation check instead of a stored document scan for lower-risk visitors?
- Are ID numbers excluded from logs, analytics tools and support tickets?
The practical takeaway
The proposed conduct-code discussion does not mean South African organisations must stop checking visitor IDs. It does mean they should be ready to explain the purpose, necessity, security controls and retention period behind each step.
If your team can meet the access-control purpose with a minimal structural ID validation check, consider whether scanning every visitor ID still makes sense. Start by reading the visitor ID validation workflow guide, then test CheckID with 10 free verifications.