How to verify identity for a subject access request

Ask for extra proof of identity only when you have reasonable doubts, and use the lightest method that removes them. A passport copy by default is usually too much.

The GDPR does not tell you to check every requester's identity. It says you may ask for more information when you have reasonable doubts about who is asking (Article 12(6)) [1]. The EDPB adds that the check must be proportionate [2][4]. This guide shows how to decide, what to ask for and how to word the request.

Why identity matters, in both directions

If you send someone's data to the wrong person, you have disclosed personal data to someone who had no right to it. If you demand too much proof, you make it hard for people to use their right of access, and you collect extra personal data you then have to protect. Article 12(2) says you must facilitate the exercise of the data subject's rights, and Article 12(6) only allows extra information that is necessary to confirm identity [1].

The test: reasonable doubt and proportionality

Under the EDPB guidelines, the controller carries out a proportionality assessment and must be able to justify the verification method it uses [2][4]. Two questions help:

Do I actually doubt who this is? If the request comes from the email address, account or phone number you already use with this person, there is often no reasonable doubt.
What is the least I need to remove the doubt? Use information you already hold before asking for new documents.

Methods, from light to heavy

Method	When it fits
No extra check	Request from the contact details you already know, low-risk data
Log in to the existing account	You run an online service with accounts
Confirm through known contact details	Request from a new address: write to the address on file and ask the person to confirm
Ask one or two facts you hold	Customer number, date of last order, part of an invoice number
Copy of an ID document	Only if necessary, for example where the actual identity matters and lighter methods cannot work

On ID documents, the EDPB position, as applied in a Swedish supervisory decision, is that a copy should not be requested unless it is necessary, and that this is only relevant where the actual identity matters [4]. If you do check an ID document, the guidelines recommend noting that the ID was checked rather than keeping a copy [2].

The clock while you wait

If you need more information, ask straight away. The EDPB says the one-month period may be suspended until you receive the information needed to identify the person, but only if you asked without undue delay [3]. In a 2024 decision the Swedish authority refused to accept an extension where the identification problem was of the controller's own making [4]. See our deadline and extension guide for how to count the month.

Worked example

A gym chain receives a request through its website form from "Tom de Vries", using a Gmail address that is not in its member system. The member file has a Tom de Vries with a different email address and a phone number.

Wrong: reply "please send a scan of your passport and a utility bill". This asks for more than needed and creates new data to protect.
Better: the same day, send a short message to the email address on the member file: "We received an access request in your name from another address. Was this you? Reply to this email to confirm." If Tom confirms from the known address, the doubt is gone. The answer then goes to the address on file, or to the new one after confirmation.

The gym writes in its log: date of receipt, date of the identity question, date of confirmation, and the method used. That record lets it explain its choice later.

Requests made for someone else

A relative, lawyer or other representative may send a request on someone's behalf. Here the question is not only who is asking, but whether they have authority. Ask for proof that the person has authorised them, for example a signed authorisation, and send the answer in a way that protects the data subject. Keep the same proportionality test in mind.

Identity question template

Subject: Your request of [DATE RECEIVED], ref. [REF]: please confirm

Dear [NAME],

We received a request for access to personal data in your name on
[DATE RECEIVED]. To protect your data, we need to make sure we send
it to the right person.

[Choose one:]
- Please reply to this message from the email address we have on
  file for you.
- Please tell us [ONE OR TWO FACTS WE HOLD, e.g. your customer
  number and the date of your last order].

We only use this information to confirm your identity and will not
keep it longer than needed for that purpose.

As soon as we have your reply, we will continue with your request.

Kind regards,
[NAME], [ORGANISATION]

Checklist

Decide on the day of receipt whether there is a reasonable doubt.
Pick the lightest method that removes the doubt.
Ask without delay and log the date you asked.
Do not keep copies of ID documents you do not need.
Once confirmed, answer with our response letter template.

Deciding whether to do this in-house at all? Read our comparison of a spreadsheet, a tool and a consultant.

Related guides

Sources

This guide explains the rules in plain language. It is not legal advice. Check your own country's law and, when in doubt, ask a qualified adviser.