Identity checks for privacy requests without demanding too much

A privacy request can become a data breach if the business sends information to the wrong person. It can also become needlessly intrusive if the business demands an identity-document copy for every routine correction. The design problem is to obtain enough assurance for the action without collecting more personal data than the situation warrants.

The final DPDP rights rule addresses published request methods and particulars used to identify the Data Principal. It does not prescribe one universal identity document for every request. As of 22 October 2026, rule 14 and the underlying rights provisions are scheduled for May 2027 under the commencement notification.

Match assurance to the consequence

Start with what the requested action could expose or change. Providing a summary of health-related records, redirecting an account to a new email address and correcting a misspelt display name have different consequences. The identity check should reflect those consequences and the context already available.

An authenticated account session may offer useful assurance, particularly when supported by appropriate account security. It is not automatically conclusive if there are signs of compromise. A message from an unfamiliar address requires a different assessment from a request made through the customer’s established channel.

Write a small set of verification routes rather than leaving every staff member to improvise. Include escalation for lost access, shared accounts, representatives and suspected fraud. These are recommended operating controls, not a statutory hierarchy of approved methods.

Use existing information carefully

Consider a hypothetical online tutoring service. An adult learner requests a summary of their account data through the signed-in portal. The service may be able to use that account context rather than ask for a fresh identity-document image.

Another person emails from a new address claiming to be the same learner and asks for all lesson notes. The team should not reveal whether particular sensitive information exists while verifying the claim. It can explain the verification route without supplying answers that help an impostor.

Avoid questions based on information that is easy to find publicly or has already been exposed. A date of birth or postal address is not inherently secret. Use the service’s risk assessment to determine what combination of evidence is meaningful.

Collect less where less will work

If additional evidence is necessary, explain why it is needed and whether a less revealing alternative is available. Do not request a complete document when only a limited detail is relevant without assessing the extra collection.

Define where verification material will be stored, who can access it and when it will be deleted or otherwise handled under applicable retention requirements. A document attached to an unrestricted support ticket can persist long after the identity decision is complete.

Keep a record of the method and outcome where that is sufficient. The business may not need to retain every underlying image indefinitely to show that it performed a check. Assess the evidence requirement separately from the convenience of keeping all attachments.

Do not confuse verification with obstruction

A customer who has lost access to an old phone number may have a legitimate request. Provide an alternative review route instead of insisting that the unavailable number is the only possible proof. The alternative can be more careful without becoming an endless series of unexplained demands.

Tell the person what remains unresolved and what information would help. Avoid repeatedly asking for details already supplied. A clear status record helps the next colleague continue the assessment without restarting the conversation.

Verification also should not silently expand the request. If the customer asks to stop optional promotions, examine whether the action can be completed with less assurance than a full data disclosure. The business must still prevent malicious changes, but the risk comparison should be deliberate.

Review the release as a separate step

Passing an identity check does not remove the need to check the response. Confirm the recipient, account match, included records and whether information about other people is present. Shared family accounts and group conversations are common sources of accidental disclosure.

For higher-consequence actions, use a second authorised reviewer or a separate confirmation step where appropriate. Keep the decision and exception record concise enough to be useful, with access limited to those handling the request.

Test the process with a legitimate customer who lost their credentials and with a plausible impostor scenario using dummy data. The aim is not maximum friction. It is a route that gives a real person a workable path while preventing the business from disclosing or changing records on an unsupported claim.