Key takeaway
Start with the authentication already available. Record a specific reason for any additional check instead of demanding an identity-document copy by default.
An access process can create a second privacy problem
A customer asks for a copy of personal data through the account they normally use. The company’s standard response demands a passport scan and additional biographical details. That may feel cautious, but the new collection needs a reason of its own. Extra identifiers can create another sensitive file without resolving an actual authentication gap.
EDPB Guidelines 01/2022 distinguish identifying the relevant data from authenticating the requester. They explain the reasonable-doubt condition for seeking additional information and the need to limit that information to what is necessary. The EDPB small-business guide gives practical examples, including requests outside an authenticated account. An unfamiliar email is a reason to examine the facts, not automatic proof of fraud.
Three requests, three actual gaps
Hypothetical example: a fictional equipment-service portal receives three access requests. Assume EU GDPR access handling applies and the company has an established account-authentication process. No individual’s records or identity documents are used here.
The completed triage below separates the route, the unresolved fact and the next proportionate question. It deliberately avoids assigning a passport requirement to every row. It also keeps identity checking separate from deciding which records and third-party information belong in the eventual response.
| Request route | Actual gap recorded | Illustrative next action |
|---|---|---|
| Existing authenticated account | No new identity doubt established | Use the established process; do not add an ID-copy demand by default |
| New address with an old account reference | Connection to the account is not established | Assess a proportionate existing-account verification route |
| Representative for an account holder | Authority to act and receive information unresolved | Check appropriate authority evidence as well as relevant identity facts |
Ask which evidence would resolve the doubt
The EDPB guidance discusses using existing authentication procedures and explains why collecting a copy of an identity document is generally inappropriate unless necessary, suitable and consistent with national law. It also addresses minimising information on a document where such a document is justified. A copy is not a universal answer, especially when the source service operated under a pseudonym.
For the hypothetical new-address request, write down the mismatch and the evidence already held before asking for more. If the company never collected a date of birth, collecting one now may not provide a reliable comparison with the account. The reviewer should explain why the chosen method resolves the identified risk rather than merely adding friction.
A representative’s authority is another dimension. The guidance discusses national-law requirements and evidence that a representative may act and receive information. Do not confuse a matching name with that authority, or require the account holder and representative to supply every identifier simply because two people are involved.
Keep a decision record without duplicating the sensitive file
Record the request reference, existing authentication method, the specific doubt if any, the chosen additional check and why it is proportionate. Retain the outcome and appropriate evidence reference under the actual security and retention arrangements. A general commercial spreadsheet is not a sensible destination for copies collected during rights handling.
The example ends with three differentiated actions, not three declarations that identity has been verified. A person still needs to complete the chosen process, and the company still needs to prepare the appropriate response. This article does not prescribe request deadlines, national identification rules or an automated identity score.
Use inventory to locate the relevant account and artifact lineage, then keep the legal request workflow separate from a potential business-data referral. A VOID fit discussion does not require a customer’s passport or authorise receiving their access-response package. The useful standard is a documented, risk-related authentication choice rather than a bigger collection of identifiers.
Use this review agenda with your legal and privacy advisers. Requirements depend on the records, jurisdictions and intended use.