13/10/2025
Here is a template in full for anyone wanting to write to Companies House about digital ID opposition (provided by Sarah W. on Substack and taken from the Conscientious Currency Substack).
-------
The Registrar
Companies House
Crown Way
Cardiff
CF14 3UZ
Subject: Concerns Regarding Identity Verification via One Login and Request for Clarification on Data Sharing and Rights
Dear Sir/Madam,
I am writing as the director of [Company Name], Company Number: [Insert Number], regarding the recent requirement for identity verification through the Government’s “One Login” system.
I fully understand the importance of verifying identity for company transparency and compliance purposes, and I am happy to provide my personal details to Companies House directly for this purpose. However, I have serious reservations about doing so through the centralised “One Login” system, and I would like written clarification on several key points before proceeding.
⸻
1. Data Sharing and Security Concerns
Please confirm which government departments, agencies, or third-party organisations Companies House or the Government Digital Service (GDS) will share personal data with as part of the One Login verification process.
Please explain the legal basis for this data sharing, and how long personal data will be retained.
I am particularly concerned about the consolidation of all personal data within a single digital profile and login system across multiple government services. Centralising personal data in this way increases the potential risk of large-scale cyberattacks, hacking, and unauthorised access.
In addition, I am aware that Gov.uk One Login lost its key safety certification under the Digital Identity and Attributes Trust Framework (DIATF) in May 2025. This framework is designed to ensure secure and trustworthy digital identity services, including compliance with standards for privacy, security, and interoperability. The loss of certification reportedly arose due to the lapse in accreditation of its biometric authentication supplier, iProov, which provides facial verification technology. iProov’s decision not to renew its DIATF accreditation—stating it no longer aligned with their customer requirements—directly affected One Login’s compliance status, as the framework requires all critical suppliers to maintain active certification.
This situation, compounded by earlier whistleblower reports of potential security vulnerabilities and the platform’s incomplete alignment with National Cyber Security Centre (NCSC) guidelines, raises significant questions about the reliability and security of the One Login system. Given that millions of users, including company directors, are being directed to use One Login for statutory verification, I am concerned about the risks of participating in a platform currently operating in a “grey area” regarding DIATF compliance.
I would therefore like Companies House to confirm how it has assessed the current security and compliance status of One Login in light of these developments, and what assurances it can provide regarding data protection and accountability for any breach or misuse of information.
I also request confirmation that Companies House will continue to offer an alternative verification route for those who choose not to use the One Login system, and that such individuals will not be disadvantaged, penalised, or restricted from fulfilling their statutory duties as company directors.
⸻
2. Consequences of Non-Compliance
Please clarify what actions Companies House may take if a director declines to verify their identity using the “One Login” method.
Will refusal to use this system result in the company being struck off, suspended, or otherwise prevented from operating lawfully, despite the director’s willingness to provide identification by alternative means?
Please also confirm whether any administrative or financial penalties will apply in such cases, and whether a manual or paper-based verification option remains available.
⸻
3. Human Rights and Right to Work Considerations
Please confirm how any enforcement action for non-compliance aligns with:
• Article 8 of the European Convention on Human Rights (Right to respect for private and family life), and
• Article 1 of Protocol No. 1 (Protection of property).
I would like to understand how restricting or removing a director’s ability to act, or preventing a company from continuing to trade, would be compatible with these rights.
The right to privacy, freedom of choice regarding digital participation, and the right to conduct lawful business should not be compromised by the introduction of a centralised login system. I therefore request clear legal justification and guidance on how Companies House intends to uphold these fundamental rights while implementing the One Login requirement.
⸻
Given the legal and personal significance of this matter, I respectfully request a written response addressing each of the above points before proceeding with any verification through One Login.
Thank you for your time and consideration. I look forward to your response.
Yours faithfully,
[Name]
Director of [Company Name]
[Email Address]
[Phone Number]
