Law Stack Exchange is a question and answer site for legal professionals, students, and others with experience or interest in law. It only takes a minute to sign up.
Sign up to join this community
Is email verification step required before asking users to enter personal details?
A bit lost in GDPR documents.
Should contract between user and the app be signed (via phone number + sms or email + verification email) before asking user to enter personal info like Name, Gender etc.?
Or I should have a «roadblock» banner with "Verify your email to continue" message?
Many thanks.
GDPR does not make specific provisions. You are required to implement appropriate security measures. What is appropriate depends on the context of this data collection, and the relevant risks.
For example, it is completely normal for a webshop to ask for a shipping address including full name and title/form of address which is largely equivalent to gender. It is not normal for a webshop to ask for phone number or email verification before asking to place and order, and this wouldn't mitigate relevant risks. It would also be wrong to consider name/gender more personal than email or phone number – all of these are typical examples of directly identifying personal data.
But there can be other contexts in which stronger verification could be needed, for example when “gender” is health data which needs additional protection per Art 9 GDPR. Email or phone number verification is not typically a good way to do that though. Such verification can make it more likely that user accounts are backed by a real person, but can't verify that the corresponding personal data would be correct.
Another issue with collecting phone numbers or emails is that under the GDPR, you can only collect data that is necessary for a given purpose (see Art 5(1)(b) purpose limitation principle and Art 5(1)(c) data minimization principle). If all you need is a name, you can't ask for an email address.
So no, you shouldn't ask for extra data just because of GDPR. In fact, Art 11(1) GDPR explicitly says you're not required to collect or keep extra identifying data. Instead, collect the data that you actually need for your business processes, and then think about what appropriate security measures would be needed to protect this processing of personal data.
