How to Watermark a UK Passport Copy Before Sending It

Renting a flat in London or Manchester, opening a Monzo or Starling account, starting a new job that requires a Right to Work check, signing up for a crypto exchange, applying for a professional qualification — nearly every serious transaction in UK life ends with the same prompt: "Please send a photo of the biographical page of your passport." You hold the passport up, take the photo, and hit send. Ten seconds, and the file is in someone else's system for years.

This article is about what actually happens after those ten seconds. What a UK passport copy really gives away, what UK GDPR and the Data Protection Act 2018 give you, when a watermark helps and when it will get you bounced back at an Identity Service Provider check, and how to watermark the copy locally in your browser so a leaked file is bound to exactly one transaction. Everything the tool does runs on your own device.

What a UK passport copy actually contains

The UK biometric passport biographical page carries:

• Full name (surname and given names, in the printed and MRZ forms).
• Nationality (British Citizen, British Overseas Territories Citizen, etc.), place of birth, and date of birth.
• Passport number and personal number. The passport number is the one on every ticket, hotel booking and KYC form; the personal number is a separate lifetime identifier.
• Sex, issue date, expiry date, issuing authority.
• Photograph and signature, both at high enough resolution to be reused.
• MRZ (Machine Readable Zone): two lines of fixed-format OCR-A text at the bottom of the page that encode passport number, nationality, date of birth, sex and expiry in a compact machine-readable form. This is the zone airport border readers scan.

The MRZ is worth pausing on. It is the highest-density identity payload on the whole page. A cheap smartphone app can decode it in under a second and dump the full contents to text. Two consequences follow:

1. Masking the printed fields but leaving the MRZ visible is effectively no masking at all — the MRZ contains the same information in machine form.
2. Light blur over the MRZ can be partially decoded by modern OCR. If you need to hide the MRZ, use a proper mosaic or solid-color block, not a Gaussian blur.

The rest of the page is what most people think of as the passport's data: enough to open online-only accounts, impersonate you in KYC flows, and produce convincing forged documents that pass automated checks. A clean high-resolution scan of both sides of a UK passport is the identity theft equivalent of handing over a starter kit.

Where UK GDPR fits

Almost every business handling your passport copy in the UK is a data controller under the UK GDPR and Data Protection Act 2018. That gives you a defined set of rights, and gives them a defined set of obligations.

The rights that matter most in passport-copy contexts:

• Right to be informed — you should be told the purpose of processing, the lawful basis, the retention period, and any recipients (including processors). If a letting agent, employer or crypto exchange will not name its KYC processor, that itself is a signal.
• Right of access (SAR) — you can request a copy of your personal data held by a controller, including the passport image and any derived data. Controllers must respond within one month, extendable to three in complex cases, generally at no cost.
• Right to erasure — you can ask a controller to delete your passport image once the purpose is complete. This right has limits: where the controller has a legal obligation to retain (five years under Money Laundering Regulations 2017 for anti-money-laundering purposes, for example), erasure can be refused. But outside that limit, deletion should happen when the purpose ends.
• Right to rectification, restriction, portability and objection — used less often for passport copies specifically, but worth knowing.

Two practical questions do most of the work at a counter:"What is the copy used for, and how long is it retained for?" A well-run business answers both easily. Hesitation is information.

What to write on the watermark

Three elements, every time: the recipient, the purpose, and the date. Write the recipient's registered legal name — the exact trading name that appears on Companies House if it is a UK limited company, not a nickname.

• Weak: "COPY" or "CONFIDENTIAL" — names nobody, limits nothing, never expires.
• Weak: "For KYC only" — which KYC? A passport copy marked "for KYC only" still fits the next KYC.
• Strong: "For Monzo Bank Ltd account opening only — 6 Sep 2026". One controller, one process, one moment.
• Even stronger for regulated services: add the KYC vendor named in the privacy policy. "For Monzo Bank Ltd (via Onfido) account opening — 6 Sep 2026".

Scenario by scenario

Renting a flat (Right to Rent)

Right to Rent, introduced in 2016, requires landlords in England to check that adult occupants have the right to live in the UK. A passport is one of the acceptable documents. But the check is only triggered when a tenancy is being granted, not at the viewing stage. A letting agent who requires a passport scan just to book a viewing is asking for more than the law requires.

At the viewing stage, offer to bring your passport for sighting, or send a heavily watermarked copy marked "For [agent] viewing appointment only — [date]" if remote. At the tenancy agreement stage, a copy is reasonable — watermark with the agency name plus the property address plus "Right to Rent check only". Increasingly, letting agencies use certified Identity Service Providers (IDSPs) such as Onfido, Yoti, iProov and Persona for a digital Right to Rent check. Those flows include a live selfie and may require a clean scan at the automated step; a light watermark generally passes, but be ready to resubmit clean if the specific IDSP rejects it.

Right to Work checks for employment

Since April 2022, employers checking the Right to Work of British and Irish citizens can use certified Identity Document Validation Technology (IDVT) providers instead of doing a manual check. The IDVT step usually involves uploading a passport image plus a selfie to the IDSP's portal; images are then held for a defined retention period. Watermark with the employer name plus "Right to Work check only" plus the date. Do the IDVT step through the employer's official portal, not via email attachments to the hiring manager.

UK banks and neobanks (Monzo, Starling, Revolut, HSBC, Barclays)

Regulated under FCA rules and the Money Laundering Regulations 2017, which require identity verification and record-keeping for at least five years after the customer relationship ends. Almost all bank onboarding routes through a third-party KYC provider named in the privacy policy. A light watermark generally passes automated document checks; a fresh watermarked scan is expected for account tier upgrades (higher deposit limits, wealth products, business accounts).

Crypto exchanges regulated in the UK

Since the FCA's cryptoasset registration regime came into force, UK-facing crypto exchanges (or those serving UK customers under the overseas persons exemption) run full KYC. Coinbase, Kraken, Bitpanda and others use standard KYC vendors; the file is stored for compliance retention periods. Watermark the same way as a bank: exchange name, vendor name if named, date.

Hotels, car hire and travel agents

A hotel front desk asking to hold a copy for "incidental purposes", a car hire counter asking for a scan against rental damage claims, a travel agent processing a package booking. These often store the image less carefully than a regulated financial service. Watermark on the spot from your phone browser: "For [hotel] booking [reference] only — [date]". Mask the MRZ if they only need to see your face and name — the MRZ is not needed for a hotel check-in.

Solicitors, conveyancers and estate agents (property purchase)

Buying a property triggers anti-money-laundering identity verification by the solicitor, the mortgage lender and sometimes the estate agent. Each keeps a copy for at least five years after the transaction. Watermark each submission separately — one for the solicitor, one for the lender, one for the agent — with the recipient name and "property [address] AML check only" plus the date.

Beyond the watermark

• Send only the biographical page, unless the specific process requires visa or stamp pages. Fewer pages in circulation, fewer fields to lose.
• Mask the MRZ when the recipient does not need to verify document authenticity themselves. Use a mosaic or solid color block, not a blur.
• Strip the EXIF metadata before you send. A phone photo of your passport typically carries GPS coordinates and a precise timestamp; your passport does not print your home address, but the GPS effectively adds one. Remove them with the EXIF cleaner.
• Prefer the recipient's portal to an email attachment. Portals have access logs; emails sit forever on multiple servers.
• Exercise your DSAR right periodically. Every year or so, ask one or two businesses holding your passport copy for a Subject Access Request. It tells you what they actually have and where.

If a passport copy has already leaked

1. Report to Action Fraud (0300 123 2040 or actionfraud.police.uk) if identity fraud is suspected. You get a Crime Reference Number needed for later steps.
2. Register with CIFAS Protective Registration — a paid annual service that flags your details across CIFAS-member lenders, insurers and telcos, requiring extra checks when someone tries to open something in your name. Well worth the fee after a suspected passport leak.
3. Contact the passport issuer (HMPO) if you believe your passport itself has been compromised — they can advise on cancellation and reissue, especially if the physical passport has also been lost.
4. Send DSARs to any businesses you believe leaked the copy, then exercise the erasure right for any remaining copies not under a legal retention obligation.

A watermarked copy is what makes step 4 possible. You can point to the specific submission that leaked, the controller involved, and the date — instead of trying to reconstruct after the fact.

FAQ

Q: What can someone do with a copy of my UK passport?
A: The biographical page carries passport number, full name, date of birth, MRZ and photograph — enough to open online crypto exchanges and neobanks, apply for BNPL credit, register for overseas services, and impersonate you in KYC flows. The MRZ specifically means masking the printed fields alone is not enough.

Q: What does UK GDPR give me when I send a passport copy to a business?
A: UK GDPR and the Data Protection Act 2018 apply to any business processing your data. You have rights to be informed of purpose and retention, to access, to rectification, to erasure (with legal-obligation limits), and to object. Two questions do most of the work: what is the copy used for, and how long is it retained?

Q: Will a watermark get my Right to Work or Right to Rent check rejected?
A: Home Office guidance focuses on identity verification, not clean unmodified images. A light purpose-bound watermark usually passes if name, DOB, photo, expiry and MRZ are clearly legible. Digital IDSP flows are stricter; try light watermark first, resubmit clean only if the automated check rejects it.

Q: Should I mask the MRZ?
A: If the recipient does not need it, yes — with a proper mosaic or solid-color block, not a blur. For Right to Work, Right to Rent and financial KYC the recipient usually does need the MRZ. For a hotel or insurance claim, they don't.

Q: What if a letting agent asks for a passport copy before a viewing?
A: That is not required for Right to Rent, which only applies when a tenancy begins. Offer to bring your passport for sighting, or send a heavily watermarked copy if remote. Scraped rental listings followed by a passport-and-deposit request over WhatsApp are a common UK rental fraud pattern.

Q: Does ImageMarker upload my passport to a server?
A: No. Everything runs inside your browser, so the image never leaves your device. Switch on flight mode and the tool still works.

Before you hit send

You cannot avoid sending UK passport copies. What is written on those copies when they go is still up to you. Bind each copy to one controller, one purpose, one date. Send only the pages that are required. Mask the MRZ when the recipient does not need to verify authenticity themselves. Strip the metadata. Then send through the recipient's official portal, not to an email address someone gave you on WhatsApp. That is the difference between a copy that works for exactly the transaction it was made for and a copy that works for whoever ends up with it.