Confirm a data subject request by using what you already hold: a logged in session, a confirmation link to the address on file, or matching details the person already gave you. Ask for new documents only if reasonable doubt remains, because collecting a passport scan for a privacy request creates new risk.
Why this matters
Two failures sit on either side. If you hand a person's data to an impostor, you have caused a breach. If you demand heavy proof from everyone, you create friction and collect sensitive documents you do not need.
GDPR Article 12(6) strikes the balance: where the controller has reasonable doubts about the identity of the person making a request, it may ask for additional information necessary to confirm it. The trigger is reasonable doubt, not a blanket rule. Article 12(2) also asks controllers to facilitate the exercise of rights.
A tiered approach
Tier 1, authenticated users. If the request comes from a logged in account, or after login with the usual multi factor step, treat that as identity. Offer the request form inside the account.
Tier 2, unauthenticated request by email. Send a confirmation link or one time code to the address on file. Only act once the person confirms. This proves control of the mailbox you already have for them.
Tier 3, doubt remains. If the details do not match, or the account looks recently taken over, ask for limited extra proof. Prefer information you can compare with existing records, such as the last order date or the last four digits of a phone number, over a document.
Tier 4, documents. Reserve ID documents for high risk cases. Collect the minimum, check it, record that you checked, and delete the copy promptly.
Requests through a third party
Agents, lawyers and family members may act for someone. Ask for evidence of authority, such as a signed mandate, and verify with the data subject where the risk is high. Do not send data to the third party until that is settled.
Data you do not hold in identifiable form
If your records cannot be linked to a person, for example anonymous analytics, you may not be able to find their data at all. Say so plainly rather than collecting extra identifiers in order to search. Collecting more data to answer a request undermines data minimisation under Article 5(1)(c).
Guard against abuse
Attackers use rights requests for social engineering and to harvest data. Rate limit the form, log attempts, and never reveal whether an email address has an account in the unverified reply. Use the same neutral wording for all requests: "if we hold data for that address, we have sent a confirmation link."
Record what you did
Note which tier you used and why, and delete any proof documents once the check is done. This shows accountability under Article 5(2).
Quick check
Can I always ask for a copy of ID?
No. Article 12(6) allows extra information only where you have reasonable doubts about identity. Use lighter checks first.
Does the clock stop while I verify?
Check with counsel for your jurisdiction. Verify quickly so the one month limit is not at risk.
Sources
Last reviewed: 19 October 2026.
