Not every freelancer needs a Right to Work check. Before you start collecting passports, dates of birth or anything else, your first job is to work out whether you actually need to carry out a check.
We looked at that in our earlier article on Right to Work checks for freelancers, including the changes coming in from 1 October 2026, associates, subcontractors and substitution. And if you’re still wondering whether asking a freelancer for their UTR counts as a Right to Work check — it doesn’t.
This article starts where that one finishes. You’ve established that you need a Right to Work check. Now, how do you check a freelancer’s Right to Work?
How can you check someone’s Right to Work?
Once you know a check is needed, there are three main ways to do it.
1. Use the free government online check
For many people who aren’t British or Irish citizens, this will be the easiest option. The person gets a Right to Work share code and gives you the code and their date of birth. You then do the check yourself on the government online Right to Work service.
The government service tells you whether they have the Right to Work and whether there are any limits on the work they can do. Don’t ask your freelancer or associate to look themselves up, take a screenshot and email it to you. They give you the information and you use it to carry out the check. The service is free.
2. Check the documents yourself
If you meet physically then getting them to bring you the relevant documents can still work. But asking remote team members to simply email them is not a sensible option as it risks their ID related data going astray.
There is another question too: are you confident you would recognise a fake passport? You need to follow the current government instructions about which documents can be accepted and how they must be checked. This isn’t a process you can invent for yourself by asking somebody to email you a photograph of their passport.
3. Use a registered digital checking service
For British and Irish citizens with an appropriate passport, a digital checking service can be a practical option. The service checks the person’s identity and document electronically and gives you the result. You still have things to do and evidence to keep, but you aren’t the person trying to decide whether the passport is genuine.
It won’t be the right route for everybody, and you can’t insist that someone proves their Right to Work in a particular way. But where digital verification is available, a few pounds can buy you a much more sensible process than becoming an amateur passport checker.
Using a digital checking service doesn’t mean you hold no identity data. It means that you aren’t trying to authenticate the passport yourself or devising your own system for somebody to send it to you. The specialist service handles the document-verification process and gives you the evidence you are required to keep.
Only use a digital identity service that is on the government’s Digital Verification Services Register and certified for Right to Work checks. You can check the official register before you buy. Don’t use a provider that isn’t on the official register for Right to Work checks.
What does a digital Right to Work check actually cost?
This is surprisingly difficult to answer. You may see services advertising Right to Work checks for only a few pounds, but the price per check isn’t necessarily what your one check will cost you.
Some providers charge a joining or setup fee. Some require you to buy a minimum number of checks or a block of credits. If you’re only going to do an occasional check, you also need to know whether unused credits expire.
Before you choose a provider, check what it will actually cost you to do one check today and the number of checks you really think you will need, whether there’s a joining or setup fee, whether there’s a minimum spend or minimum number of checks, and whether unused checks or credits expire. A service advertising checks for £2 each isn’t much of a bargain if you have to spend £50 to get started.
Prices and services change, so check the current terms. And only use a service on the government register for Right to Work checks.
What do you need to keep after a Right to Work check?
Doing the check isn’t the end of the job. You also need to keep the evidence that you’ve done it.
If you use the Home Office online service, save the required record of the check. If you use the manual route, keep the required copies and record of the check. If you use a registered digital checking service, it will give you the required result or output from the check.
That digital result can include information identifying the person and the document checked, the date of the check, the service that carried it out and confirmation that the person’s identity was successfully verified. So using a digital service does not mean there is nothing for you to keep.
Don’t collect extra identity documents just in case. Keep what you need for the Right to Work check, not everything you could possibly collect.
How long do you need to keep the Right to Work record?
Keep the evidence while the person is doing the work for you and for two years after that work ends. After that, securely destroy it.
When you’re working with freelancers, associates and subcontractors, it isn’t always as obvious when that point has been reached as it is with an employee. If you use KoffeeKlatch Terms with separate Booking Forms, the end of the person’s last Booking Form may be a sensible date to work from, provided that really is when they stopped doing work for you.
For example, if their final Booking Form ends on 30 November 2026 and they do no more work for you, keep the Right to Work evidence until 30 November 2028 and then securely destroy it. If you give them another booking, the relationship hasn’t finished for record-keeping purposes.
And don’t forget that not every freelancer needs a Right to Work check in the first place. If you’re unsure, go back to our article on Right to Work checks for freelancers before collecting identity information.
Where should you keep Right to Work records?
Right to Work records contain identity information, photographs and, depending on the route you’ve used, passport information. Think about where the result is going to go before you start carrying out checks.
For a tiny business, create a secure folder specifically for Right to Work records and, where practical, a separate subfolder for each person you check. That makes it easier to control access on a need-to-know basis. If someone needs Fred’s record, they don’t automatically get everyone else’s.
The folder should be backed up and access restricted to the people who genuinely need it. If your digital checking service provides the result through a secure portal, download the record you need directly into the right secure folder. Don’t leave copies sitting in Downloads, email, WhatsApp or a general team folder. When the two-year retention period ends, securely delete them.
Don’t collect more than you need
Data minimisation is different from security and access control. It means collecting and keeping only the personal information you actually need.
Don’t ask for extra identity documents “just in case”. Don’t collect a passport as well as the result of the check if you don’t need both. Most importantly, don’t collect Right to Work information at all if no Right to Work check is required.
What if you’re helping a client with Right to Work checks?
Right to Work checks may come your way because you’re a VA or another small business helping a client with their administration or onboarding. But that doesn’t mean you need to receive the identity information yourself.
Where the system allows it, we’d prefer the VA to give the client the link and instructions and let the client log in, carry out the check and save the result directly into their own secure records. You can help your client with the steps, send the link and remind them to do it without becoming the storage point for their workers’ passports and identity information.
It’s rather like credit-card information. If you don’t need to handle valuable information yourself, don’t build a process that makes you handle it.
VAs may be asked to help clients with other identity-checking administration too. We looked at this previously in our article on ID checks for landlords. Right to Rent checks have some similarities, but the rules aren’t exactly the same. A Right to Work check and a landlord’s Right to Rent check are two different checks, so don’t assume that doing one means you know how to do the other.
If a client genuinely wants you to carry out the check for them, work out exactly what information you will receive, where you will store it, who can access it and when it will be deleted. Make sure the client’s instructions and your Data Processing arrangements cover what you’re actually being asked to do.
And check your insurance. If you’re going to collect or store passport and identity information for clients, don’t assume your existing insurance covers you if that information is lost, stolen or disclosed to the wrong person. Check what your policy actually covers.
Treat Right to Work records as high-risk identity information
Think about what could happen if the information fell into the wrong hands. A Right to Work record may contain a person’s photograph, passport information, name and date of birth — exactly the sort of information that could be useful for identity theft or fraud.
That means good security, tightly controlled access and secure deletion when the information is no longer needed. If you’re going to handle this information for clients, include it in your risk assessment and make sure your insurance covers loss, theft or accidental disclosure.
For a VA helping a client, the safest identity information for you to hold is information you don’t need to hold at all. Wherever possible, help the client carry out their own check and let the result go directly into their secure records.
What if a client wants the Right to Work information too?
This is where things can get messy for businesses using associates and subcontractors. Imagine the working arrangement looks like this:
Client → you → associate or subcontractor
You’ve carried out a Right to Work check on your associate. The client then says, “Great — send me a copy.”
Don’t automatically send it. First ask why the client needs it. If the client has its own legal requirement to carry out a check, work out exactly what it needs to do to meet that requirement. Don’t assume that forwarding the record you’ve already obtained will do the job.
And don’t assume that because you were entitled to collect someone’s identity information for one purpose, you’re automatically entitled to pass it further up the client chain.
Tell the person what is happening
If an associate’s or subcontractor’s identity information really does need to be shared with somebody else, they should know who is going to receive it, why they need it, what will be shared and what they will do with it.
That doesn’t necessarily mean you are asking the associate for GDPR consent. There may be a legal requirement for the processing. It means being transparent about what is happening to their information.
That matters for another reason too. Your associate may decide, “I don’t want to work on that client’s account if it means they need to receive my identity information.” That’s something they should be able to decide before their information is shared, not discover afterwards.
Before you introduce your associate or subcontractor to your client
One of the biggest worries for any small business using associates or subcontractors is the client cutting them out and engaging the associate directly. So before you put your associate or subcontractor in direct contact with your client for a Right to Work check, make sure your contracts are already in place.
If you’re using KoffeeKlatch contracts, you should have the appropriate agreement with both your client and your associate or subcontractor before you reach this stage. Those agreements help protect the business relationships you’ve built if somebody tries to go around you.
Once that’s sorted, letting the person deal directly with whoever actually needs to carry out the Right to Work check can be a good data-protection solution. You don’t need to become the middleman for their passport or identity information just because you’re the middleman for the work.
Could the associate provide it directly?
If somebody further up the client chain genuinely needs to carry out their own check, consider whether the associate or subcontractor can deal with them directly. That may be much safer than:
associate → you → client → somebody else
with copies of identity information accumulating at every stage.
Before identity information travels up the client chain, work out who actually needs it, why they need it and make sure the person whose information it is knows where it is going.
Right to Work check: a practical checklist
Before you start:
- Have you established that a Right to Work check is actually required?
- Who actually needs to carry out the check?
- Which of the permitted checking routes is appropriate?
- If you’re using a digital service, is it on the government register and certified for Right to Work checks?
- What evidence will you need to keep?
- Where will you store it securely?
- Who needs access to it?
- When will it need to be deleted?
- If information needs to be shared with a client or anyone else, have you established why they need it and told the person concerned?
- If you’re handling checks for clients, have you checked your data-processing arrangements and insurance?
