Verify a requester's identity
Confirm the email address on a request filed through your Privacy Center, and ask for, review and record a government ID.
Each request's drawer has a Verification section with two checks: whether the subject's email address is confirmed, and whether you've verified a government ID. GDPR Article 12(6) lets you ask for the information needed to confirm a requester's identity where you have reasonable doubts about it.
Email confirmation
A request filed through your Privacy Center arrives with an address nobody has confirmed, so we email the subject a link to confirm it. The link works once and expires after seven days. Until they open it, the queue marks the request Unconfirmed, and the Email address row reads Typed on the public form; the person who typed it has not confirmed it yet. Resend link sends a fresh link, and any earlier one stops working.
A request you record yourself counts as confirmed, because you stand behind the address you typed. Nothing waits on the confirmation: you can work, extend, reject or resolve a request whose address is still unconfirmed.
Ask for a government ID
- Open the request and, on the Government ID row under Verification, select Request ID document.
- Optionally add Instructions, such as what kind of document you need.
- Select Send link.
Today is recorded as the day you asked, the subject is emailed a single-use upload link that works for seven days, and the request moves to Awaiting subject. The subject uploads a PDF, JPG, PNG or WebP under 10 MB on your Privacy Center. A request can hold up to five identity documents.
You can also ask while recording a request, by setting Identity verified to Pending — request ID document; the request then opens as Awaiting subject. While an ask stands unanswered, the row offers Resend link, which replaces the old link, and Cancel ask, which withdraws the ask and expires every link still out. Nothing is sent to the subject when you cancel.
Review the document
When a document arrives, the request moves back to In progress and the document appears under Verification marked To review. Check it, then select:
- Confirm match if it matches the person the request names. The check becomes Verified.
- Could not verify, with your reason, if it doesn't. The request stays open: ask for a fresh document with Request a fresh document, or reject the request with Identity could not be verified.
Each document is reviewed once, and the decision, with who made it and when, goes to the audit log. A wrong call is put right with a fresh document. A document that hasn't been reviewed can be removed.
A document sent another way
If the subject sends ID by email or post, file it on the Identity document row with Upload. File an identity document asks for the Document type: Passport, National ID card, Driving licence or Other document. It's kept apart from the request's other files and reviewed the same way, and it brings a request that was awaiting the subject back to In progress.
Where the check stands
The pill beside Verification reads Not requested, Awaiting document, Document to review, Verified or Could not verify, from the ask and the newest document's review. The check is advice, not a gate: resolving an access, erasure or portability request without it shows a warning, and nothing stops you.
Where the request has a mobile number, a Mobile number row shows Verified if the subject answered a text-message code on your Privacy Center, or As recorded if a member typed it in. See Require SMS verification on the request form.


