Identity Verification
Confirm that the person submitting a privacy request is who they say they are, before any data is touched.
Before your team acts on a privacy request, you need confidence that the person asking is the data subject they claim to be. Sending someone else's personal data, or deleting it on a stranger's instruction, is itself a privacy incident. MineOS handles this with identity verification: a short set of checks the data subject completes after submitting a request through your Privacy Center, before the request reaches your team.
How verification works
A request that hasn't finished verification has the status Unverified. It moves to Open, ready for your team to process, only after every verification step your setup requires is complete.
Verification is made of up to two steps, in this order:
- Email verification. The data subject receives a verification email and clicks Confirm my email address to prove they own the address on the request. See Email Verification.
- Phone verification (optional). If the request's brand is set to Verify using OTP, the data subject then enters a 6-digit code sent to their mobile number by SMS. See Phone Verification.
When phone verification isn't required, the request opens as soon as the email is confirmed.
Which requests are verified
Verification applies to requests submitted through the Privacy Center. Requests created through other channels are treated as verified from the start, because they come from your own team or systems:
- Requests added manually
- Imported requests
- Requests created through the API
Requests submitted by an authorized agent go through email verification but skip the phone step.
Where verification is configured
Verification settings live in two places, so it helps to know which controls what:
| Setting | Scope | Where |
|---|---|---|
| Send verification rule | Per privacy right | Communication rules for each right. Turns email verification on and selects the Verification Email Template. |
| Phone verification method | Per brand | DSR setup, on each brand's page. Decides whether and how the submitted phone number is verified. |
If you run several brands, each brand can use a different phone verification method. See Understanding Multibrand in DSR.
Unverified requests in the Requests page
Unverified requests appear in the Unverified view of the Requests page, and their due date shows as Pending verification. Open an unverified request to see which steps are complete and which are still pending.
Why it matters
Privacy regulations expect you to confirm who is asking before you respond. The CCPA regulations require businesses to use a reasonable method to verify the identity of a consumer making a request, and GDPR Article 12(6) allows a controller to request additional information when it has reasonable doubts about the identity of the person making the request. Identity verification gives you a consistent, documented way to meet that expectation, with each step recorded in the request's audit log.
Updated about 3 hours ago