2018 Market Guide for Identity Proofing & Corroboration Get the Guide

Accelerate Your Journey to GDPR Readiness

Discover the key ingredients for a complete, compliant identity verification solution.
GDPR Compliance for Online Identity Verification

Jumio is not only fully GDPR compliant as a data processor, with a robust and transparent program for maintaining all standards laid out in GDPR, but also our identity verification solution is a key GDPR enabler, offering customers the ability to maintain data protection and contribute to their compliance with GDPR requirements.

5 Critical Ingredients for GDPR Compliance & Online Identity Verification
Human Review

GDPR gives data subjects (i.e., your online customers) the right not to be subject to decisions solely based on automated processing that produce ‘legal effects’ or other significant effects. As increasingly more online verifications are carried out by algorithms, concerns have been raised about the lack of transparency behind the technology, which leaves individuals with little understanding of how decisions are made about them.

Since Jumio takes a hybrid approach to online identity verification, combining machine learning, AI, computer vision and biometrics, coupled with human review, we're able to provide much greater transparency about the rationale for acceptance or rejection for any given identity verification transaction.

Compliant Machine Learning

Many identity verification vendors aggregate data across multiple customers to develop their machine learning algorithms. With GDPR, vendors can only develop specific AI models trained on the data of a given customer and cannot leverage data from other customers to create more comprehensive models.

Jumio’s compliant machine learning approach builds in data privacy and security at every stage of the machine learning workflow including initial data capture, ID preprocessing, data tagging, algorithm training and model deployment.

Data Retention

GDPR requires that personal data should be ‘limited to what is necessary for the purposes for which they are processed,’ and requires personal data storage being ‘limited to a strict minimum.’

Because Jumio is PCI-DSS compliant, we are already mandated to adhere to strict data retention procedures ensuring that personal data that is no longer needed is discarded appropriately and in a timely fashion. Our enterprise customers can customize data retention policies based on their unique business needs.

Breach Notification

GDPR requires data processors to notify the controller ‘without undue delay’ once aware of a data breach. Most identity verification vendors don’t have established or tested processes in place for data breach notifications.

Because Jumio is already PCI-DSS compliant, we regularly test our notification processes and procedures for dealing with data breaches. This ability helps our business customers manage their own breach notification and mitigation processes.

Data Encryption

GDPR requires data processors to have ‘appropriate’ measures to ensure security of personal data, including encryption, ensuring confidentiality, restoring data access and regular auditing/testing.

Because Jumio is PCI DSS Level 1 compliant, we regularly subject our security practices to stringent regulatory security audits, vulnerability scans and penetration tests to ensure compliance of the product. All personal data, including ID documents and selfies is encrypted twice: all data is encrypted in transit via TLS encryption using strong cipher suites and at rest with military-grade 256 bit AES encryption.

“People come to me and say, ‘How do I achieve GDPR compliance?’… Start with PCI DSS.”
Jeremy King,

International Director at the Payment Card Industry Security Standards Council (PCI SSC)

GDPR & Online Identity Proofing - An Inconvenient Truth
How is your customer identity verification program impacted by GDPR and what do you need to do to enable compliance in your processes? This guide explains it all.
Get the E-Book
5 Key Components of GDPR Compliance
Understand the 5 key components of GDPR compliance and how to enable compliance in your online identity verification processes.
Watch the Webcast

Get Started

Enable GDPR compliance into your identity verification process quickly and easily with Jumio's Netverify® Trusted Identity as a Service solutions. Start by requesting more information and we’ll be in touch shortly.

Request More Information