> Hey, when somebody sends you an email asking for personal data, how do you verify that the person making the request is the same as the person who uses the em

> Hey, when somebody sends you an email asking for personal data, how do you verify that the person making the request is the same as the person who uses the email. By the time someone has access to an email account, they could just reset the password and access the data anyway, no loss of trust. > Is the email "From" field safe to trust? Can it be spoofed? If it matches the account email address, send the response to that email. A simple spoof will only lead to the user getting a "your gdpr export is ready" but the attacker can't get to the data.