Verifying Identity Before Fulfilling a GDPR Request

You can ask for ID before fulfilling GDPR requests — but only when necessary. Here’s how to verify identity without breaching privacy.

The UK GDPR allows companies to request ID if they have reasonable doubts about the identity of the requester.

But be careful — asking for too much ID or failing to protect it can create its own risks.

Best practice:

• Only ask when necessary (e.g. requests from non-company emails)
• Set a clear retention policy for ID documents
• Avoid collecting more information than needed

💡 Tip:

Use secure portals or encrypted email to exchange ID documents. Never request personal data over open email.