Good Practice Guide (GPG) 45: proving and verifying a person’s identity

GPG45 provides a standardised approach to identify a person is genuinely who they say they are when interacting with a service.

It allows organisations to be confident that the right people access the right information and services and prevents fraudulent activity. 

It works by describing a range of Identity Profiles and the evidence and checks necessary to meet these. 

It does not force a single identity threshold on all public services; lower risk applications (replacing bins or accessing libraries) can meet a lower confidence profile than a benefits service. 

It allows public bodies flexibility based on their requirements; responding to the needs of a specific use case or service, whether for a simple or sensitive application.  

As the guidance describes criteria over mandating specific processes, organisations remain free to decide how to carry out their practices. It standardises how we determine our confidence in the resulting identity that any process creates. 

This will be useful when assessing identity risks associated with services; services which make payments would be expected to be more confident in a claimant is who they say they are.  

GPG45 supports the GOV.UK OneLogin product, which aims to provide UK service users with a single, reusable account.  

The scope of the OneLogin does not include the wider Welsh public sector, but the underlying principles included in GPG45 are transferable and would facilitate migration to that platform if applied. 

Your products and services should meet points 4, 5 and 11 on the Digital Service Standard for Wales – ensure everyone can use the service, in a joined-up way and that embeds ethics, data and security throughout.  

As a public body building products/services that require the use of person's identity, you should: 

• use this guide to determine your confidence levels for identities across a range of services you may offer. It will also support designing secure services and set the foundations to adopt digital identity solutions (such as OneLogin) in future. 

CDPS won’t be monitoring your compliance but points 4, 5 and 11 of the Digital Service Standard for Wales sets the expectation that everyone can use your service, that the experience is joined up and that it is secure.