How can I confirm someone’s identity?

The Privacy Act requires that agencies satisfy themselves about the identity of someone requesting their personal information before releasing that information.

Similarly, agencies may be required to confirm the identity of the person they are dealing with as part of taking reasonable steps to make sure the information they hold is kept safe, and that the information they use is accurate.

What steps are reasonable to check identity will depend on the circumstances in each case, including the nature of your dealings with the individual. For example, is this the first time you’re dealing with the individual? If so, you may need to take additional steps to confirm the individual’s identity (for instance checking the individual’s passport, driver’s licence or 18+ card). For an example of a case where the agency concerned didn’t take reasonable steps to confirm the identity of the person it was dealing with, see this case note.

If you have a prior relationship with the individual, then you may be able to confirm identity by asking security questions previously set by the individual, or by asking the individual to provide information in relation to their account which only they would know (for instance about previous transactions or bills).

For more detailed guidance on verifying identity, we suggest you also take a look at the Identification Management Standards(external link) developed by the New Zealand Government. These standards provide a framework for the consistent establishment and on-going confirmation of identity. For more information about identification management standards, please contact identity@dia.govt.nz. 

We've also published this blog post on why some organisations have to take a lot of care in verifying a person's identity.

Reviewed November 2020