PrivacyGDPR

Require SMS verification on the request form

Have your Privacy Center's request form prove the requester's mobile number with a texted code before it accepts the request.

Updated 1 min read

The Privacy register's Settings tab has one switch for your Privacy Center's request form: Require phone verification. Anyone who works the register can change it, including a DPO you've engaged. The switch is offered only where the platform can send text messages; where it can't, the row says so in its place.

What it does

With the switch on, the request form on your Privacy Center asks for a Mobile number, texts it a six-digit code with Send code, and accepts the request only once the code entered under Code from the text message is confirmed with Verify. A code works for 10 minutes, and Send a new code sends another. If the form can't send texts, for example because your Privacy Center has reached its daily limit of 200 texts, it asks for no number and accepts the request without one. Confirming the email address works as before; see Verify a requester's identity.

Turn it on or off

  1. Go to Compliance › Privacy › Settings.
  2. Flip Require phone verification.
  3. Confirm with Require it, or, to turn it off, Stop requiring it.

The change applies to requests filed from then on. Requests already filed are untouched, and keep the number they were filed with and the record of it answering the code. The change is written to the audit log.

Mobile numbers on requests

  • A number proved on the form shows as Verified under Verification in the request's drawer, with the day it answered the code. It can't be changed afterwards.
  • When you record a request yourself, you can enter the Mobile number the subject gave you, in international format starting with +. It's recorded as given, nobody is texted, and it shows as As recorded.
  • The requests export includes Mobile number and Mobile verified on; see Export privacy requests.