Stop Storing Personal Data: Use Verifiable Credentials

Don't store it, verify it: the future of personal data

Think about the last time someone asked you for a copy of your ID.

Most of us have emailed a photo of our ID, a proof of address and a payslip to a bank, a landlord, a recruiter, a gym, a car dealer. Each of those copies now sits somewhere we can't see: an inbox, a shared drive, a database, sometimes a WhatsApp chat. The company thought it was verifying us. What it actually did was start storing us.

My argument in this post is simple. For most everyday checks, an organisation doesn't need your document. It needs the answer to a question, such as "is this person over 18?" or "is this the account holder?", and a way to trust that answer. If it can get the proof without keeping the paper, it has less to protect, less to lose, and less to explain when something goes wrong.

Holding data is getting more expensive

In South Africa, the cost of keeping personal information is rising from three directions at once.

The regulator is paying attention. At a briefing on 31 August 2026, the Information Regulator said it had received more than 8,000 security compromise notifications since the enforcement provisions commenced, with over 1,220 arriving since 1 April and about 3,000 expected by the end of the year. The common causes are unglamorous: weak controls, employee negligence, weak passwords, malware.

It is also looking at what you collected, not only how you guarded it. In its enforcement notice against the SABS, issued after a 2024 ransomware attack, the Regulator found the organisation had processed "excessive or irrelevant information" as well as having insufficient security safeguards, and gave it 90 days to fix both. The Regulator has also said it wants GDPR-style fines that apply immediately on a finding of non-compliance, instead of the current grace period. (Polity)

Breaches are expensive. One local estimate, from the security firm Cube ICT, puts the national bill at about R142 billion a year. That comes from multiplying 3,219 reported breaches in 2025/26 by IBM's average cost of R44.1 million per breach. I'd treat it as a rough indicator rather than a hard number, since it applies one average to every breach and comes from a company that sells security services. The direction is still clear.

Stolen identity is being used. Impersonation fraud rose 38% in 2024 according to the Southern African Fraud Prevention Service. In August, Minister Schreiber said about 300,000 identity documents linked to suspected fraud had been blocked and were under review, and that most identity theft cases involve the older green ID book (TimesLIVE).

Put those together and every stored copy of an ID starts to look like a liability: something a criminal wants, a regulator can ask about, and you pay to protect.

The flip: ask for a proof, not a copy

A verifiable credential lets the other side check a fact without receiving the document it came from. The person holds the credential on their phone, chooses what to show, and your system gets a signed answer it can trust. If you want the plain-language background, I covered it in my last post.

Here is how that changes some everyday checks:

Notice what you keep in the right-hand column: a record that a check happened, when, and whether it passed. You don't keep the document. If someone breaks into your systems, there is much less in there worth taking.

The last row matters more than it looks. A photocopy can't be recalled. It stays valid in your files long after the person's circumstances have changed. A credential can be revoked, so the information stays current without anyone chasing paperwork.

What changes for a business, and what stays hard

The upside is easy to describe. You collect less, so you have less to secure, less to retain, and less to disclose when the Regulator or a customer asks what you hold. Onboarding can get faster too, because the customer shares a proof instead of hunting for documents. And your risk profile shifts: a breach of your systems exposes records of checks, not a library of identity documents.

The honest part is that none of this is automatic.

• Someone has to issue the credentials. South Africa's national digital ID is expected to reach citizens in the 2027/28 financial year, so for now organisations need credentials from other trusted issuers or their own.
• Not everyone has a smartphone. Any real system needs a fallback for people without one, and a way for that fallback to be just as respectful of their data.
• You still need a lawful reason to ask. Verifying instead of storing doesn't excuse collecting more than you need. Asking for the smallest proof that answers your question is the whole point.
• Trust moves, it doesn't vanish. You are now relying on whoever issued the credential, so choosing which issuers to accept is a real decision.

None of those is a reason to wait. They are reasons to start with a small, clear use case and learn from it.

Where to start this quarter

You don't need a national rollout to begin. Three steps are enough.

1. Map what you collect. List every place your organisation asks for a copy of an ID or similar document, and write next to each one the question it is really answering. You'll probably find some copies that answer no question at all.
2. Review what you keep. Some sectors have legal duties to retain certain records, so check what you must keep before deleting anything. For everything else, ask why the copy is still there.
3. Pick one use case and test a proof. An age check, staff access, or re-verifying a returning customer are good candidates. Ask your vendors whether they support verifiable credentials and open standards such as W3C Verifiable Credentials, OpenID4VP and mdoc, and what the fallback is for people without a smartphone.

One last thought

For decades, "verify" has meant "collect and keep". It doesn't have to. The organisations that learn to verify without hoarding will be easier to trust, cheaper to run and harder to hurt.

If you'd like to talk about what that could look like for your organisation, get in touch at iyam.digital.