Revolut collects copies of your identity documents and processes biometric-style data as part of identity verification, which is a more sensitive category of personal data under UK data protection law.
This analysis describes what Revolut's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
Identity document data and biometric verification data are treated as special categories under UK GDPR, meaning stricter rules apply to how they are collected, stored, and used, and Revolut must have a stronger legal basis for this processing.
Interpretive note: The document does not specify retention periods for identity documents or the precise legal basis for biometric-style processing, creating interpretive uncertainty about whether all UK GDPR special category requirements are fully addressed in disclosed terms.
Revolut retains copies of your passport or driving licence and processes them through identity verification systems, which constitutes high-sensitivity data processing; if there were a data breach involving this data, the consequences for affected individuals could be severe.
How other platforms handle this
Request that we limit our use of your sensitive personal information to what is necessary to perform the services you requested.
Objection to Processing. You have the right to object to us processing your personal data, where the legal basis for processing that information is legitimate interest.
Right to data portability. You have the right to request that we transfer the information that we have collected to another organization, or directly to you, under certain conditions.
"copies of your identification documents (for example, your passport or driving licence) and any other information you provide to prove you are eligible to use our servicesExcerpt from Revolut's Privacy Policy (Superseded URL)
(1) REGULATORY LANDSCAPE: Processing of biometric data used for unique identification and identity document data may engage UK GDPR special category provisions, requiring an explicit legal basis such as explicit consent or a legal obligation …
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Ad personalization controls removed. Contact scanning added. Advertiser data partnerships quietly dropped. A timeline of every change.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
Identity document data and biometric verification data are treated as special categories under UK GDPR, meaning stricter rules apply to how they are collected, stored, and used, and Revolut must have a stronger legal basis for this processing.
Revolut retains copies of your passport or driving licence and processes them through identity verification systems, which constitutes high-sensitivity data processing; if there were a data breach involving this data, the consequences for affected individuals could be severe.
ConductAtlas has identified this type of provision across 287 platforms. See the full comparison.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Revolut.