From the ICO "An individual can make a [Subject Access request] SAR verbally or in writing, including on social media. A request is valid if it is clear that the individual is asking for their own personal data. An individual does not need to use a specific form of words, refer to legislation or direct the request to a specific contact."
Is it consistent with the GDPR for companies to restrict the means through which a GDPR DSAR can be made, particularly if the restrictions require one to provide specific PII prior to being able to make a request, rather than after? Does it make a difference if the restriction makes technical sense, ie. so "only through post as we need originals" may be justifiable when "we will accept images submitted by a web form but not over email" may not be? If one sent an email request to these people, and at least one email reached its destination would that count as a valid DSAR? Is it reasonable to request original documents to complete a DSAR? While I may feel like I could trust Cifas, I really would not want to send any original documents to most data controllers.