How do I verify the identity of the person making the request?

Before you share all the personal data you hold on someone, you need reasonable confidence that the person asking is actually the person that data belongs to. The challenge: making verification thorough enough to protect privacy without making it so burdensome that it effectively denies people their rights.

For most email marketing SAR requests, the simplest verification is a confirmation email. Send an email to the address in question with a time-limited verification link. If they can click it, they control that inbox and that's sufficient. This works cleanly for most scenarios.

When a confirmation email isn't enough:

• If the request involves additional personal data beyond just the email record (financial data, health data, detailed behavioral profiles), higher verification is warranted
• If the email address in the request doesn't match anything in your system, you may need to ask for additional identifying information to locate the right record
• If the request is from an authorized representative (legal counsel, data protection authority), you'll need documentation of that authorization

What you can't do: ask for more verification than is necessary. Requesting a government-issued ID for someone trying to see what newsletter preferences you have is disproportionate. GDPR says verification should be proportionate to the sensitivity of the data.

You also can't use the verification step to stall. If you need to verify identity, request what you need quickly and clearly. The one-month response clock may continue ticking even while you're waiting for verification. check your local supervisory authority guidance on this.

For the full SAR response picture once identity is confirmed, see what to include in the response. See also handling deletion requests.