From the ICO "An individual can make a [Subject Access request] SAR verbally or in writing, including on social media. A request is valid if it is clear that the individual is asking for their own personal data. An individual does not need to use a specific form of words, refer to legislation or direct the request to a specific contact."

The Credit Industry Fraud Avoidance System (Cifas) says "If you wish to request a copy of any data held about you on the Cifas Database, the only way is to apply online", "In line with government recommendations the Cifas office is now closed and therefore we are unable to send or receive post" and "we are unable to handle requests over email as we require originals of some documents in order to prove your identity before releasing information about you". If you go through the web form (which requires javascript to even load) it provides an option for online verification (submission of images of Proof of ID and Proof of address). There appears to be no way to make a DSAR using the web form until after you have provided documents.

Is it consistent with the GDPR for companies to restrict the means through which a GDPR DSAR can be made, particularly if the restrictions require one to provide specific PII prior to being able to make a request, rather than after? Does it make a difference if the restriction makes technical sense, ie. so "only through post as we need originals" may be justifiable when "we will accept images submitted by a web form but not over email" may not be? If one sent an email request to these people, and at least one email reached its destination would that count as a valid DSAR? Is it reasonable to request original documents to complete a DSAR? While I may feel like I could trust Cifas, I really would not want to send any original documents to most data controllers.

1 Answer 1


GDPR (Recital 64 Identity verification) says about this topic:

The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests.

In the opinion of ProtonMail, GDPR also means:

It's easy for your customers to request and receive all the information you have about them.

People have the right to see what personal data you have about them and how you're using it. They also have a right to know how long you plan to store their information and the reason for keeping it that length of time. You have to send them the first copy of this information for free but can charge a reasonable fee for subsequent copies. Make sure you can verify the identity of the person requesting the data. You should be able to comply with such requests within a month.

Looks like this is still open to interpretation how to handle this till there are first court decision.

  • GDPR seems to impose language requirentsr that no language can be declined so do we have to set up a translation department! Commented Dec 1, 2020 at 14:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .