Is it really them? A GDPR Article 12(6) identity check sheet for data requests that arrive through AI chatbots, without asking for ID copies
What you get: a finished identity check sheet in three tabs: a check log with one row per request and a formula that picks the lightest check that fits, a method table with what to ask for and what never to ask for, and a pause tracker that works out the new reply-by date while you wait for the person, plus AI tool examples and three made-up example rows.
Short answer: under Article 12(6) GDPR you may ask for extra information only when you have reasonable doubts about who is asking, and only what is necessary to confirm their identity. The EDPB says a copy of an ID card is generally not an appropriate way to check identity, and is disproportionate when the person is already known to you, for example through a login or the email address they gave you. If you ask for information without undue delay, the one-month clock can be paused until you get what you need (EDPB Guidelines 01/2022, para. 159).
Why AI tools make this harder
A request typed into a website chatbot, an AI phone agent or a support widget often comes with nothing but a first name. The data itself may sit in a chatbot transcript, a call recording or a meeting note-taker, and sending that to the wrong person is a personal data breach (EDPB para. 80). So you need a check, but a light one: asking everyone for a passport scan collects more data than you need and makes the right harder to use, which Article 12(2) forbids.
Step 1: tab 1, check log (one row per request)
| Column | What to write | Source |
|---|---|---|
| A. Request ref | Same reference as in your request deadline tracker | |
| B. Received on | The date it reached any of your official channels, including a chatbot | EDPB para. 159 |
| C. Channel | "logged-in account", "email from address on file", "website chatbot, no login", "AI phone agent", "someone acting for them" | our working rule |
| D. Already known to us? | Yes if the request came from a logged-in account, or from the email or phone number already on file | EDPB paras. 66, 72, 73 |
| E. Sensitive data involved? | Yes for health, therapy notes, children's data or other special categories in transcripts or recordings | EDPB paras. 70, 78 |
| F. Reasonable doubt? | Yes or No, with one line on why: new address, name does not match, request asks for data to be sent somewhere new | Art. 12(6) |
| G. Lightest check | =IF(F2="No","No extra check: answer",IF(C2="someone acting for them","Ask for proof they may act for the person",IF(D2="Yes","Confirmation code or link to the email or phone on file",IF(E2="Yes","ID check may be justified: see tab 2, keep a note, not a copy","Ask 1 or 2 questions only the person can answer from data you already hold")))) | EDPB paras. 69 to 81; formula is our working rule |
| H. Asked on | Date you sent the identity question. Send it straight away: the pause only applies if you asked without undue delay | EDPB para. 159 |
| I. Answer received on | Date you had enough to confirm who it is | EDPB example 31 |
| J. Outcome | "Confirmed", "Could not confirm: told the person", "Cannot identify any data: told the person (Art. 11(2))" | Art. 11(2), 12(4) |
Step 2: tab 2, method table (what to ask, what not to ask)
| Situation | Proportionate check | Avoid |
|---|---|---|
| Customer with an online account | Ask them to log in and send the request from the account, or use the two-step code set up at sign-up | An ID copy: the EDPB calls this disproportionate here (example 13) |
| Request by phone or AI phone agent | A one-time code to the mobile number given when the account was set up (EDPB example 12) | Reading out data before the code is confirmed |
| Chatbot visitor with no account | Ask which email or phone they used with you and send a confirmation link there; or ask about a booking date or order number you already hold | Asking for date of birth or address you do not already hold: you would have nothing to compare it with (EDPB para. 76) |
| Health, therapy or other sensitive data | An ID check can be justified. Tell them which parts they may cover up; keep only a note such as "ID card was checked" and delete any copy after the check | Keeping ID scans on file (EDPB para. 79) or ID copies where national law limits them |
| Lawyer, relative or app acting for someone | Proof of authority under your country's rules, such as a signed authority or power of attorney, and a check on the representative if in doubt | Sending the data to the representative with no proof of authority (EDPB paras. 80 and 81) |
| You cannot link the request to any data | Tell the person, if possible, and say what extra detail would let you find their data, such as the chatbot session date | Collecting new data just to be able to answer (Art. 11(1)) |
Step 3: tab 3, pause tracker
| Column | What to write | Source |
|---|---|---|
| A. Days used before asking | =IF(Tab1!H2="","",Tab1!H2-Tab1!B2) | our working rule |
| B. Asked quickly? | =IF(A2="","",IF(A2<=3,"Yes","Check: was this without undue delay?")). The 3-day line is our own rule of thumb, not a legal limit | EDPB para. 159; threshold is our working rule |
| C. Paused days | =IF(OR(Tab1!H2="",Tab1!I2=""),"",Tab1!I2-Tab1!H2) | EDPB example 31 |
| D. New reply-by date | =IF(C2="","",WORKDAY(EDATE(Tab1!B2,1)+IF(B2="Yes",C2,0)-1,1,Holidays)). If you were slow to ask, it keeps the original date | Art. 12(3); EDPB paras. 159 to 161; our working rule |
The law sets "without undue delay" as the target and one month as the outer limit, so answer as soon as the identity is confirmed rather than waiting for the new date. The Holidays range is the same one used in the Article 12 deadline tracker.
Three made-up example rows
| Request | Check chosen | What happened |
|---|---|---|
| Access request in a dental clinic's booking chatbot, no login, asks for chat and call transcripts | Sensitive data: code to the phone on file first, ID check offered with cover-up advice | Asked the same day, code confirmed 4 days later; reply-by moved by 4 days; note "ID card was checked", no copy kept |
| Erasure request from the email address already on an online shop account | No reasonable doubt | No extra check; answered in 9 days |
| Agency client's lawyer asks for an employee's AI note-taker records | Proof of authority from the lawyer | Signed authority received; data sent to the lawyer only |
These rows are made up for illustration and do not describe any real business.
This sheet is a working aid, not a legal opinion or proof of compliance. References are to Regulation (EU) 2016/679 (Articles 11 and 12, as published on gdpr-info.eu) and the EDPB Guidelines 01/2022 on the right of access, version 2.0 (paras. 62 to 81 and 159, examples 12, 13 and 31). The EDPB guidance is written for access requests; we apply the same approach to the other rights in Articles 15 to 21 as our working rule. The check formula, the 3-day line and the pause count are our own working rules. National law may limit copying ID documents or set rules for representatives, so check your data protection authority's guidance. Checked on 27 October 2026. Spot an error in this guide? Write to mininglife7@gmail.com.
For accountants and tax advisers
Clients who run chatbots often ask for passport scans by default. Hand them tab 2 with the client AI inventory, stay inside your professional rules and refer legal questions on.
Know which AI tools hold each person's data
The EURO AI Register free edition runs in your browser with no account and no upload. It covers your first 10 AI systems and 10 evidence records, the screening questions, duties by role with dates, and a printable Article 4 AI-literacy record. Use its list of AI tools to see where a confirmed person's data sits, and attach this sheet as an evidence record.
When you need more than 10 systems, the EURO AI Register membership starts at $19 a month and adds unlimited systems, rule updates and email help. Neither tool is legal advice or proof of compliance.
Partner programme opening soon
Partner programme opening soon: join the free waitlist. Planned terms are 50% of each referred sale (75% once you have 5+ paying customers), single level, paid through Gumroad only from revenue received.
Free start: list your AI tools in the EURO AI Register free edition, then add this sheet. Related: Article 12 deadline tracker · Article 15 access requests · Article 17 and 21 requests · Article 32 access security
Sources
- Article 12 GDPR and Article 11 GDPR, Processing which does not require identification; official text: Regulation (EU) 2016/679
- EDPB Guidelines 01/2022 on data subject rights, right of access, version 2.0 (paras. 62 to 81 and 159, examples 12, 13 and 31)
Unadhi Guides are free, independent explainers. We correct errors as soon as we find them: write to mininglife7@gmail.com.