GDPR Recital 64 EN
LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this law. Contains: the full text of every article, recital and provision of this law. Everything links back to its source on overview.legal — legal information, not advice.

Recital 64 — data subject identity verification for access

Identification Personal Data IP Address Controllers
In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗
Version history 2
  • 2016-05-04in force CELEX 02016R0679-20160504
  • 2016-04-27 CELEX 32016R0679

The controller should use all reasonable measures to verify the identity of a data subject who requests access, in particular in the context of online services and online identifiers. A controller should not retain personal data for the sole purpose of being able to react to potential requests.

Related across sources

Case Law NSS - 1 As 183/2023-62 Enforcement NAIH fines online store HUF 2M for unclear and incomplete privacy notice Enforcement Italian DPA sanctions Lusha Systems for processing contact data without consent in B2B Case Law OLG München - 36 U 1054/25 e Case Law SG Nürnberg - S 5 SF 65/24 DS Enforcement NAIH fines online store HUF 15M for transparency and Article 12(1) GDPR violations