> Hey, when somebody sends you an email asking for personal data, how do you verify that the person making the request is the same as the person who uses the em

> Hey, when somebody sends you an email asking for personal data, how do you verify that the person making the request is the same as the person who uses the email. You send a message to the email address listed on the account. You don't reply to the initial email. To clarify what happened to me. I emailed them from an account which was not the same as the one used to sign up. (I emailed from admin@example, but the BSky address was 1234@example.com) They replied saying that they required me to email from the address associated with the account. I logged into BSky, changed the email address (to admin@), then replied to their message. They then replied to the account's email. I had successfully demonstrated that I was the person in control of the account. > Is it legal to assume that the controller of an email address is the same as the person who created the account using the email address? The law is about proportionality. Would a reasonable person / process assume that only the user controls their email? For a social network, probably. If this were a medical service, it might require passing 2FA. > If a users inbox has been compromised, can somebody just use GDPR to get all the DMs and data from every other service despite not having passwords to those services? Yes. But they could also do a password reset. Having MFA helps here.