Is email verification step required before asking users to enter personal details?

A bit lost in GDPR documents.

Should contract between user and the app be signed (via phone number + sms or email + verification email) before asking user to enter personal info like Name, Gender etc.?

Or I should have a «roadblock» banner with "Verify your email to continue" message?

Many thanks.

  • You do know that both a phone number and an email address are personal data?
    – Dale M
    Jul 12, 2021 at 12:34
  • @DaleM yes I do, and before Phone/Email is verified, I don't do anything with it except sending "Sign a contract" message (4-digit code or verification link). Furthermore, I have "You agree for data processing" checkbox to enable before user press Submit button. The question about providing other data before contract is «signed». Jul 12, 2021 at 15:38

1 Answer 1


GDPR does not make specific provisions. You are required to implement appropriate security measures. What is appropriate depends on the context of this data collection, and the relevant risks.

For example, it is completely normal for a webshop to ask for a shipping address including full name and title/form of address which is largely equivalent to gender. It is not normal for a webshop to ask for phone number or email verification before asking to place and order, and this wouldn't mitigate relevant risks. It would also be wrong to consider name/gender more personal than email or phone number – all of these are typical examples of directly identifying personal data.

But there can be other contexts in which stronger verification could be needed, for example when “gender” is health data which needs additional protection per Art 9 GDPR. Email or phone number verification is not typically a good way to do that though. Such verification can make it more likely that user accounts are backed by a real person, but can't verify that the corresponding personal data would be correct.

Another issue with collecting phone numbers or emails is that under the GDPR, you can only collect data that is necessary for a given purpose (see Art 5(1)(b) purpose limitation principle and Art 5(1)(c) data minimization principle). If all you need is a name, you can't ask for an email address.

So no, you shouldn't ask for extra data just because of GDPR. In fact, Art 11(1) GDPR explicitly says you're not required to collect or keep extra identifying data. Instead, collect the data that you actually need for your business processes, and then think about what appropriate security measures would be needed to protect this processing of personal data.

  • Too small an edit: "phone number OF email verification" should be "phone number OR email verification"? (second paragraph, and I will delete this comment upon fix or verification.)
    – CGCampbell
    Aug 11, 2021 at 14:00

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .