gdpr european-union data-protection data
Identity verification prior granting access to personal data [GDPR]
<p>When receiving by E-Mail a Subject Access Request (SAR), which steps must be taken to ensure that the person requesting the SAR is the effective owner of the personal data? </p>

<p>You should make sure that the person making the request is actually the data subject. However, you have a lot of flexibility to create an approach that is appropriate for your specific circumstances.</p>

<p>Per Art 12(6), where you have reasonable doubts about the identity of the person making the request, you may request additional information to confirm the identity. The information that you request should be proportional to the data you are processing.</p>

<p>Per Recital 64, you should use “all reasonable measures” to verify the identity of the data subject who requests access. However, you should not keep data for the sole purpose of being able to respond to requests. (Compare also the data minimization principle and Art 11).</p>

<p>Per Art 11, you do not have to satisfy data subject requests if your data doesn't allow for identification. However, the data may still allow indirect identification if they provide enough contextual information.</p>

<p>If you are running some online service, then asking the data subject to log into their account is a reasonable identity verification mechanism – but that's only as strong as the “I forgot my password” mechanism that you've implemented. Effectively, it may be sufficient if the requestor is able to demonstrate that they can receive emails on an email address that you already have on file.</p>

<p>When you ask for identity verification, the one-month deadline for responding to the data subject request starts when you receive that verification. (This isn't explicit in the GDPR, but it's a reasonable consequence and e.g. the ICO says so in their guidance).</p>
