Supplementary code for digital right to rent checks (0.4)
Source: gov.uk (2025-12-01)

This publication sets out rules for digital verification services supporting landlords who choose to conduct digital right to rent checks.

0. Version and certification validity notes

0.a. This version of the 0.4 publication of the supplementary code for digital right to rent digital identity checks (‘the RtR supplementary code’) comes into force on December 1 2025 and is the first statutory RtR supplementary code under section 29 of the Data (Use and Access) Act 2025 (‘the Act’).

0.b. The certifiable rules previously set out in Home Office regulations and guidance for landlords, most recently published on 12 February 2025, and the non-statutory 0.4 version of the RtR supplementary code published on 26 June 2025 will remain valid for a limited period of time (see 0.c.) for the purposes of:

certification, such that certificates issued against those versions are valid and any audit and surveillance in respect of those certificates are conducted against those versions as relevant; and

Part 2 of the Act (where relevant and where there exist certificates which are valid against them) such that references to supplementary code are to be read as references to the certifiable rules set out in Home Office regulations and guidance for landlords, and to the non-statutory 0.4 version of the RtR supplementary code where those versions apply.

0.c These non-statutory versions will no longer apply for the purposes of certification and the Act, and certificates issued against them will expire and should be ignored for those purposes from and including the following dates respectively:

certificates against the certifiable rules previously set out in Home Office regulations and guidance for landlords, most recently published on 12 February 2025, will expire on 31 March 2026; and

certificates against the non-statutory 0.4 version of the RtR supplementary code will expire on the date set out in the next version of the statutory RtR supplementary code as to when certifications against the 0.4 version of the RtR supplementary code expire.

0.d For clarity, the content in this statutory version of the 0.4 RtR supplementary code is entirely unchanged from the 0.4 non-statutory version save for the replacement of an earlier validity statement by 0.a-0.d in this section 0. The non-statutory publication can be found on the UK Government Web Archive (https://webarchive.nationalarchives.gov.uk/ukgwa/timeline1/https://www.gov.uk/guidance/supplementary-code-for-digital-right-to-rent-checks-04). Certificates against both versions accordingly confirm compliance with the same rules.

0.e. The RtR supplementary code sets out rules for digital verification services (DVS) conducting right to rent checks on holders of British and Irish passports or passport cards. It is published by the Office for Digital Identities and Attributes (OfDIA), part of the Department for Science, Innovation and Technology (DSIT). OfDIA is responsible for maintenance of the supplementary code.

0.f. DVS have been able to undergo certification for this purpose since 6 April 2022 as part of the UK digital identity and attributes trust framework certification scheme, by being certified against rules previously set out in Home Office regulations and guidance for landlords. The most recent version of the Home Office landlord’s guide to right to rent checks was published on 12 February 2025 and can be accessed on the UK Government Web Archive (https://webarchive.nationalarchives.gov.uk/ukgwa/timeline/https:/www.gov.uk/government/publications/landlords-guide-to-right-to-rent-checks).

0.g. This publication is designed to support continuity, and the auditable requirements on DVS are designed to be unchanged. This RtR code either precisely replicates DVS facing rules from the previous Home Office regulations and guidance for landlords, omits them where they repeat the trust framework or constitute un-auditable recommendations, or reflects them in clearer, more auditable language. It also adds some new ‘could’ rules that providers do not need to follow but might support OfDIA and Home Office policy aims.

0.h. Certifications against the rules that were set out in Home Office guidance will remain valid until one of the following occurs:

a digital verification service uplifts its certification to this publication (including through an annual surveillance audit), thereby replacing the earlier certification; or

the digital verification service’s certification against the beta (0.3) publication of the UK digital identity and attributes trust framework expires; or

the digital verification service’s certification against the rules in Home Office guidance expires.

0.i. To be certified against the RtR supplementary code, services will need to also be certified against a current publication of the UK digital identity and attributes trust framework, from the gamma (0.4) publication onwards.

Part 1 - Background and context

1. Introduction

1.a. This is the (0.4) publication of the RtR supplementary code for digital right to rent checks. It sets out rules DVS must follow, and the recommendations they can follow, in order to be certified against the RtR supplementary code.

1.b. A DVS’s certification against the RtR supplementary code assures landlords who choose to conduct digital right to rent checks that they can use the service to help meet Home Office requirements and recommendations (for example, regarding the level of confidence or authenticator quality) for digital right to rent checks for holders of British and Irish passports, or Irish passport cards.

1.c. Landlords will also need to comply with requirements for digital right to rent checks, set out in Home Office regulations (https://www.legislation.gov.uk/uksi/2022/242/part/5/made) and guidance (https://www.gov.uk/government/publications/landlords-guide-to-right-to-rent-checks), to obtain and retain certain data from the DVS and to check that the individual whose identity was verified is the same person who presents themselves to rent.

1.d. This RtR supplementary code builds on the rules set out in the 0.4 version of the UK digital identity and attributes trust framework (https://www.gov.uk/government/collections/uk-digital-identity-and-attributes-trust-framework), (the ‘trust framework’). DVS can only certify against this RtR supplementary code if they are certified against the trust framework.

1.e. Terms in this document are defined as set out in the trust framework’s definitions and glossary. In this document, ‘you’ and ‘your service’ are used to direct a provider to the specific rules their organisation and service(s) must follow, and the recommendations they can follow, to be certified.

1.f. The RtR supplementary code does not set any new requirements on, or recommendations for, landlords for conducting compliant right to rent checks. These are set by the Home Office, not OfDIA or DSIT. The RtR supplementary code helps DVS show they can be used by landlords to fulfil their obligations.

Part 2 - Rules of the RtR supplementary code

2. Applicable roles

2.a. You must perform at least the role of identity service provider as described in the trust framework to be certified against the RtR supplementary code. You must additionally perform the role of holder service provider to be certified against the rules in section 5.

3. Identity verification

3.a. You must follow the rules for identity service providers set out in the trust framework.

3.1. Acceptable documents

3.1.a. For the purposes of digital right to rent checks, the identity must be created using one of the following documents:

A British passport, or

An Irish passport, or

An Irish passport card.

3.1.b. The passport or passport card must be valid according to GPG 45 and not be expired or visibly clipped.

3.2. Acceptable GPG 45 Profiles

3.2.a. For the purposes of digital right to rent checks, the identity check must meet a medium level of confidence or above according to GPG 45.

4. Data to share with landlords

4.a. If the check is successful, you must provide the following information to the landlord relying on your service in a clear, legible format which cannot be altered:

4.b. You must know what GPG 45 profile the check was conducted according to. You could provide the GPG 45 profile to the landlord.

4.c. You could provide the landlord with a record that your service was certified at the time the check was conducted, so they can retain that record for compliance purposes.

4.d. You could retain your own record that you conducted the check. Retention of information listed in 4.a is the landlord’s responsibility, as set out in Home Office regulations (https://www.legislation.gov.uk/uksi/2022/242/part/5/made) and guidance (https://www.gov.uk/government/publications/landlords-guide-to-right-to-rent-checks). Your service does not need to retain this information.

4.e. You could use the trust framework data schema to support a standardised approach to sharing data with landlords.

5. Using a holder service to conduct a right to rent check

5.a. Passports and passport cards can be withdrawn or cancelled, and right to rent checks are not transferrable from one landlord to another. As such, if you want to use a pre-existing identity stored in a holder service to conduct a right to rent check, you must be able to assure the landlord that the user holds a British passport, Irish passport or Irish passport card at the time the check is conducted, and that the passport or passport card is not expired or visibly clipped by conducting a GPG 45 validity check on it.

5.b. If a holder service is used to conduct a right to rent check, you must follow the rules for holder service providers set out in the trust framework and the holder service must have medium protection using medium quality authenticators as a minimum according to GPG 44.

5.c. To be used as described in 5.a, the pre-existing identity must have been created in line with 3.2, and the data in 4.a must be shared with the landlord.