We want to unlock the personal and economic benefits of digital identity in the UK.
At the core, we’re building trust through a framework of standards, governance, and legislation that helps people and businesses know what a good digital identity service looks like for those who want to use them.
There are three foundational parts to our approach:
1. We’re creating consistent standards that companies building digital identity services can follow
We’ve created a set of rules that define what a good digital identity product or service looks like, called “the UK digital identity and attributes trust framework”.
The trust framework is standards-based and technology-agnostic – to ensure we’re designing robust and future-proof solutions. It sets the minimum quality we expect from any trustworthy digital identity service in the UK.
Keeping your data safe and private is a priority for us, which is also why we’ve worked with the Information Commissioner’s Office to ensure the trust framework is as robust as it can be on these issues.
We’ve published three successive versions of the trust framework so far and expect to publish our next version soon. You can find the most recent version and previous versions of the trust framework on GOV.UK.
2. We’re providing assurance that those standards are being followed
We’ve created a certification process, working with the UK Accreditation Service, that allows independent evaluation of a digital identity service by qualified auditors against the rules set out in the trust framework.
This means that members of the public and companies can trust that a service does genuinely meet the standards we have set out.
Today, over 50 services have been certified as meeting the standards in the trust framework, and hundreds of thousands of digital identity checks are taking place each month using them.
You may already have used a certified service if you have recently undertaken a Disclosure and Barring Service check, or needed to prove your right to work and rent in the UK – as part of pilots we have been running.
3. We’re making it easy to check that a digital identity provider is trustworthy
But how can we expect people in general, who don’t care as much as we do about trust frameworks and certification processes, to navigate the intricacies of this system?
The answer is that we don’t.
Instead, we’re providing some easy ways for members of the public and businesses to check whether an identity service is safe, secure and trustworthy.
The first is a new online register of trusted digital identity services. When a digital identity service provider has been through our robust certification process and can prove it meets our rules, the provider will be able to join the register and have its service listed on GOV.UK.
The second way is a new digital identity ‘trust mark’. This is a symbol that digital identity services can display to prove they are trustworthy. It will only be available to providers to use if they are on the register, and only on the services they have registered. We're not quite ready to issue trust marks yet, but when we do, each one will have a unique identifying number, and you will be able to check the trust mark is genuine on GOV.UK.
We’ll share more information about both the register and the trust mark soon.
That’s not all
This is just the start of what we’re doing to enable digital identity services to be used across the whole UK economy.
We’re also working to make it possible to use digital identity services in more places. We’re scaling up our governance and oversight of the market inside DSIT, to ensure the market develops in a trusted and inclusive way. We’re looking at ways to work even more closely with industry to improve the security of digital identity products. And lots more besides that too.
The work we’ve written about here – clear standards, independent assurance and easy ways to check trustworthiness – are the foundations. With these things in place, we think we can create a strong, safe and trustworthy digital identity market in the UK that works for the public and businesses.
Sign up to email alerts to receive an update whenever we publish a new blog post.
Leave a comment