Recital 64

Verification of the Identity of the Data Subject Unofficial title

The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests.

https://gdpr.digiphile.law/recital/recital-64.html

Text as at 19 September 2026.

This is an unofficial convenience version of the EU GDPR (Regulation (EU) 2016/679). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.