The GDPR significantly enhances data subject rights, including the right to information, access, rectification, and erasure. It is common for businesses to question how to deal with data subject access requests where a data subject requests a copy of their personal data. Businesses and Data Protection Officers may find themselves asking what constitutes a reasonable request for further information for verifying identity? And do you need to ask for additional information in all circumstances?
