Question

A retail company receives an email from an individual demanding a copy of all personal data the company holds about them, citing their right of access under applicable privacy law. The requester provides only a name and email address. The data protection officer must decide how to proceed before releasing any records. What is the MOST important action to take first?

Accepted Answer

Verify the identity of the requester to a reasonable level of assurance before disclosing any personal data

Answer

Immediately compile and send all records to meet the statutory response deadline

Answer

Reject the request because it was not submitted on the company's official request form

Answer

Charge the requester a processing fee to cover the cost of gathering the records