Before Uploading ID to a Lottery Website: A Privacy Checklist
An identity-document request is not a reason to upload immediately. First establish who is asking, what information is needed and what will happen to it. This checklist concerns document handling, not whether a lottery service is legally available to you or whether a prize claim is valid.
Source review: 13 October 2026. Privacy rights depend on the applicable law. The UK examples below are not a worldwide statement of legal rights.
Separate the request from the document
Before attaching anything, write down the requesting organisation, the account or case reference and the stated purpose. Ask questions without sending a passport photograph as part of the question. A useful first message is: “Please identify the organisation receiving my document and explain the purpose, required fields, retention period and upload channel.”
Do not send identity documents to this website, a public comment section or an unsolicited social-media contact. For broader identity checks, see our website identity checklist.
Read the notice for the actual recipient
The UK Information Commissioner’s transparency guidance identifies purpose, retention and recipients as key privacy information. Use those headings to organise your questions. If a separate verification company handles the upload, ask which organisation is responsible for your information and where its privacy notice is located.
- Purpose: What specific check requires this document?
- Scope: Which document and which fields are necessary? Ask whether a less intrusive alternative is available.
- Recipients: Who can access the file, including verification providers?
- Retention: How long is the image kept, and is a verification result stored separately?
- Contact: Where can you raise a privacy question or complaint?
Do not improvise document changes
If you want to redact unrelated details or add a purpose watermark, ask the verified recipient whether that is accepted first. Do not falsify information or assume that an edited copy meets its requirements. If the explanation remains unclear, pause rather than sending additional documents to several different contacts.
Keep a record without making extra copies
Record the date, recipient, stated purpose and confirmation reference. Your action log does not need another copy of your passport. Avoid putting sensitive files into a shared folder simply to remember that you submitted them.
Does closing an account delete the ID?
Do not assume so. Ask separately about deletion and any information the organisation says it must retain. The ICO’s UK erasure guidance explains that deletion rights have conditions and exceptions. Request an explanation of any refusal; readers elsewhere should consult their relevant privacy authority.
This checklist does not certify a provider or make document sharing risk-free. If you already shared details through a suspicious link, use our incident-response guide.