There are two bits of apparently contradictory advice on the internet. The first is somewhat harder to find because it seems so obvious:

The second in some form is in most pages from the google of "How do I make a subject access request"

Also relevant is the advice given to companies in regards identity verification when presented with an SAR. From here Recital 64 of GDPR states;

“The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers.”

In the ICO’s detailed Right of Access Guidance (published October 2020) it states;

You can ask for enough information to judge whether the requester (or the person the request is made on behalf of) is the person that the data is about.

Some situations where I am sending an SAR are somewhat adversarial, as in I suspect they do not have a valid justification for processing my personal information. In these situations I do not want to send any information they do not already have, and it does not seem "reasonable and proportionate" for the data controller to request data they do not hold. Is there an accepted mechanism to solve this problem?

I know one should not design ones own schemes, but just to demonstrate the sort of thing I am thinking about one could send the md5 hash of ones identifiers with "randomStringOne" appended and request the data controller send the md5 hash of any identifiers they request (such as driving licence number for driving licence) with "randomStringTwo" appended.

2 Answers 2


You are entitled to your information; they must protect everyone else's

I think of this as the "John Smith problem"; as in "Please send me all the information you have about John Smith?" - the only sensible reply is "Which one?".

You supply this information to identify you for a subject access request (SAR). This is a lawful ground for processing under the GPDR as a lawful obligation: the law requires that they sufficiently identify you to give your and only your data. The law also gives them the power to decide what information is sufficient.

The data minimisation principle suggests that they should collect only the bare minimum. If your login details are sufficient, they shouldn't need your name; if your name is sufficient, they shouldn't need your address, etc. Bearing in mind that the data they have on you might have come from sources other than you, a login will rarely be sufficient on its own. It certainly won't be sufficient for you to recover your login details for obvious reasons.

At the same time, the sensitivity of the data is also a factor in determining what is reasonable. A SAR to Stack Exchange is going to reveal data that is mostly already public; a SAR to your bank or doctor is going to require more robust identification.

Reasonable people can disagree about what information is sufficient to identify an individual in any particular set of circumstances uniquely, but the law gives the casting vote to the organisation, not the individual. The individual can, of course, complain to the regulator if they disagree, but they do not have the right to compel an organisation to adopt their identification method. The regulator may or may not conduct their own investigation and may or may not require the organisation to change their procedures; in the meantime, you wait, or you give them the information they request.


Well, you send them information that you think will be sufficient to identify you and prove that identity. If they disagree, they ask you for more information. The two of you hash out what provision of proof would be acceptable to both of you. If you think they’re being unreasonable, you complain to the appropriate national body.

Your mechanism sounds fine, as long as it’s acceptable to both parties. (I have no opinion on its security or efficacy.)

  • I originally asked this on security. It sounds like the sort of problem that has been "solved" by mathematicians or something, and it would obviously be easiest for everyone if there was an established procedure. I am not sure that is a legal question though.
    – User65535
    Commented Feb 14 at 22:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .