Bob was party to an incident in a shop that keeps CCTV footage for 30 days. 28 days later he submits a request for this responsive footage, but neglects to include with it adequate selfidentification materials like license or proof of address.
Two slightly different questions here which I think are similar enough to be asked in a single post:
Suppose they have a SAR processing backlog of 3 days by which time the data will have been deleted. Do they have why duty to first preliminarily review any requests and triage them by material auto deletion date?
And secondly, forgetting any processing backlog related lead times, remembering that Bob had failed to include adequate identification proof to satisfy the data controller's procedures, must they make efforts to preserve the responsive materials even if they feel that they cannot yet responsibly disclose them to Bob while his request pends due to inadequate identification?