Verifying who is asking

Before you disclose or delete anything, you need reasonable confidence the requester is who they claim to be. Blankitt Privacy gives you three levels of proof.

Level 1: email verification (automatic)

Every requester must click a verification link sent to the email they gave. That proves control of the address, and for many requests (especially where the data you hold is tied to that same email address) it's a proportionate check on its own.

The link is valid for 7 days. If it expires, the requester can ask for a new one from the intake portal.

Level 2: identity documents (when you need more)

If the request is sensitive or the match is uncertain, ask for photo ID through the secure message thread. The requester uploads it on their tracking page (up to 10 MB per file). It attaches to the request as an identity document.

When you're satisfied, click Verify identity on the request detail page. Two things happen:

1. The request moves forward and collection tasks fire.
2. The identity documents are permanently deleted, automatically. You keep the audit record that identity was verified, and by whom, without storing a copy of anyone's passport. There is nothing to clean up later and nothing to leak.

Level 3: agent authority (requests on someone else's behalf)

If the requester ticked "I am an authorised agent", the request cannot proceed until a proof-of-authority document (a signed letter, power of attorney, or similar) is uploaded and you've reviewed it. Unlike identity documents, authority documents are kept: they are your evidence that the disclosure was lawful.

Getting the proportionality right

UK and EU guidance is clear that identity checks must be proportionate. Don't demand photo ID for a newsletter unsubscribe. Do demand it before handing over years of order history. When in doubt, ask for the minimum that gives you reasonable confidence, and record your reasoning in a case note.